Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
22-07-2024 23:45
Behavioral task
behavioral1
Sample
865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe
Resource
win10v2004-20240709-en
General
-
Target
865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe
-
Size
784KB
-
MD5
46a0e2b153610307b9e60b7a799e452e
-
SHA1
c97dddaa1d48cd01cf7d7172cce619db86bc037f
-
SHA256
865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a
-
SHA512
d3139a243ea3d067b0ae64c432ed08911fa0fb14e174ab5a499556a428b03496d90b1ef64f2a72ec6ab74f31c3544755cb041db8de99daa69a6ad97ea2cf949e
-
SSDEEP
12288:eqnO8YpD1oOJp+Ce1PSiG2jfIBoI5DyDwYMDxFesH0ioBw7oKk2:e+ORToOWSi5gBoS4wYUJ0eo2
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 8 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2780 2920 schtasks.exe 31 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2876 2920 schtasks.exe 31 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2760 2920 schtasks.exe 31 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2552 2920 schtasks.exe 31 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2680 2920 schtasks.exe 31 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1664 2920 schtasks.exe 31 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 324 2920 schtasks.exe 31 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2792 2920 schtasks.exe 31 -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe -
resource yara_rule behavioral1/memory/332-1-0x0000000000990000-0x0000000000A5A000-memory.dmp dcrat behavioral1/files/0x0005000000019d5e-32.dat dcrat behavioral1/memory/2900-105-0x0000000000970000-0x0000000000A3A000-memory.dmp dcrat -
Executes dropped EXE 1 IoCs
pid Process 2900 sppsvc.exe -
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\System32\\cscript\\winlogon.exe\"" 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\System32\\lsass\\lsass.exe\"" 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS\\OSPPSVC.exe\"" 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\System32\\cscdll\\sppsvc.exe\"" 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\System32\\tsbyuv\\spoolsv.exe\"" 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\System32\\ias\\smss.exe\"" 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\fveupdate\\explorer.exe\"" 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\PerfLogs\\Admin\\OSPPSVC.exe\"" 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe -
Drops file in System32 directory 20 IoCs
description ioc Process File created C:\Windows\System32\ias\smss.exe 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe File opened for modification C:\Windows\System32\lsass\RCXE757.tmp 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe File opened for modification C:\Windows\System32\cscdll\sppsvc.exe 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe File opened for modification C:\Windows\System32\tsbyuv\spoolsv.exe 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe File opened for modification C:\Windows\System32\ias\RCXEF66.tmp 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe File created C:\Windows\System32\cscript\cc11b995f2a76da408ea6a601e682e64743153ad 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe File created C:\Windows\System32\lsass\lsass.exe 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe File created C:\Windows\System32\tsbyuv\spoolsv.exe 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe File created C:\Windows\System32\ias\69ddcba757bf72f7d36c464c71f42baab150b2b9 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe File opened for modification C:\Windows\System32\cscript\RCXE553.tmp 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe File opened for modification C:\Windows\System32\cscdll\RCXEB5E.tmp 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe File created C:\Windows\System32\cscript\winlogon.exe 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe File created C:\Windows\System32\cscdll\sppsvc.exe 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe File created C:\Windows\System32\cscdll\0a1fd5f707cd16ea89afd3d6db52b2da58214a6c 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe File created C:\Windows\System32\tsbyuv\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe File opened for modification C:\Windows\System32\tsbyuv\RCXED62.tmp 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe File created C:\Windows\System32\lsass\6203df4a6bafc7c328ee7f6f8ca0a8a838a8a1b9 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe File opened for modification C:\Windows\System32\lsass\lsass.exe 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe File opened for modification C:\Windows\System32\ias\smss.exe 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe File opened for modification C:\Windows\System32\cscript\winlogon.exe 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS\OSPPSVC.exe 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS\1610b97d3ab4a74cd8ae104b51bea7bfcc5b9c6f 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS\RCXE95B.tmp 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS\OSPPSVC.exe 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\fveupdate\explorer.exe 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe File opened for modification C:\Windows\fveupdate\explorer.exe 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe File created C:\Windows\fveupdate\7a0fd90576e08807bde2cc57bcf9854bbce05fe3 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe File opened for modification C:\Windows\fveupdate\RCXE14B.tmp 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2760 schtasks.exe 2552 schtasks.exe 2680 schtasks.exe 1664 schtasks.exe 324 schtasks.exe 2792 schtasks.exe 2780 schtasks.exe 2876 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 332 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe 332 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe 332 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe 332 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe 332 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe 332 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe 332 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe 332 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe 332 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe 332 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe 332 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe 332 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe 332 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe 332 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe 332 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe 332 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe 332 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe 332 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe 332 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe 332 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe 332 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 332 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe Token: SeDebugPrivilege 2900 sppsvc.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 332 wrote to memory of 2900 332 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe 40 PID 332 wrote to memory of 2900 332 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe 40 PID 332 wrote to memory of 2900 332 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe 40 PID 332 wrote to memory of 2900 332 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe 40 PID 332 wrote to memory of 2900 332 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe 40 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe"C:\Users\Admin\AppData\Local\Temp\865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a.exe"1⤵
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:332 -
C:\Windows\System32\cscdll\sppsvc.exe"C:\Windows\System32\cscdll\sppsvc.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2900
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\fveupdate\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2780
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\PerfLogs\Admin\OSPPSVC.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2876
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\cscript\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2760
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\System32\lsass\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2552
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS\OSPPSVC.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2680
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\System32\cscdll\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1664
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\System32\tsbyuv\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:324
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\System32\ias\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2792
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS\OSPPSVC.exe
Filesize784KB
MD546a0e2b153610307b9e60b7a799e452e
SHA1c97dddaa1d48cd01cf7d7172cce619db86bc037f
SHA256865e772c568fd4c46de0c6f9004ecd450e9c14ef3506b8df064014441d02f79a
SHA512d3139a243ea3d067b0ae64c432ed08911fa0fb14e174ab5a499556a428b03496d90b1ef64f2a72ec6ab74f31c3544755cb041db8de99daa69a6ad97ea2cf949e