Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    cf9783f6f488f40f6b9309486b65c4218233e6b93403f662d357f3fc2b88a1f4

  • Size

    1.8MB

  • Sample

    240913-cvkmvszblf

  • MD5

    37c85ad6a6a43784e086433a06cc85c6

  • SHA1

    c51a7935cd6b16305e125a4b5cc9e162923429bf

  • SHA256

    cf9783f6f488f40f6b9309486b65c4218233e6b93403f662d357f3fc2b88a1f4

  • SHA512

    e6a73a792c99fe1d254c44d7ac00159608d117cf629ecf5c17b4b0eb4c65a0943f45fb6cc6e68d2a0440ed8bcacbc6e189d7ef55eef3a214868c751a69d562a8

  • SSDEEP

    49152:QodoalH3Fh0dZXAZPabJ10r+vJqB1zRIm:Qod93fQwFkhO2

Malware Config

Targets

    • Target

      cf9783f6f488f40f6b9309486b65c4218233e6b93403f662d357f3fc2b88a1f4

    • Size

      1.8MB

    • MD5

      37c85ad6a6a43784e086433a06cc85c6

    • SHA1

      c51a7935cd6b16305e125a4b5cc9e162923429bf

    • SHA256

      cf9783f6f488f40f6b9309486b65c4218233e6b93403f662d357f3fc2b88a1f4

    • SHA512

      e6a73a792c99fe1d254c44d7ac00159608d117cf629ecf5c17b4b0eb4c65a0943f45fb6cc6e68d2a0440ed8bcacbc6e189d7ef55eef3a214868c751a69d562a8

    • SSDEEP

      49152:QodoalH3Fh0dZXAZPabJ10r+vJqB1zRIm:Qod93fQwFkhO2

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks