Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

Estynett start.exe

windows7-x64

10

Estynett start.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/10/2024, 16:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Estynett start.exe

  • Size

    1.4MB

  • MD5

    401d6a0e3eeb52ba552aa2b8586df60f

  • SHA1

    256abb3298479ce5b77ef443869e372f8df2b8e0

  • SHA256

    08451edb5b692cedf6cbb2b41d532f375707d69b8670054b95f973782705db25

  • SHA512

    f2518203a3a51080befbba6e92422cd2d8d471a685f1393be8e920d24767acf2c27871d9a508f7249abfa367c530492500f336a8f430764819260c536f699fd3

  • SSDEEP

    24576:U2G/nvxW3Ww0tphBpEOYFciGLT5KIM+K1BVRSO6lGd4LmujFS9jF8:UbA30phXEtcKp+mVRxMGd+HjwQ

Score
10/10
dcratdiscoveryevasioninfostealerpersistenceratspywarestealer

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Process spawned unexpected child process 21 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables Task Manager via registry modification
    evasion
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 44 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 44 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Estynett start.exe
    "C:\Users\Admin\AppData\Local\Temp\Estynett start.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4808
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\reviewcommon\uKjInGP.vbe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2124
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\reviewcommon\G7EIw56n.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4552
        • C:\reviewcommon\Hostdhcp.exe
          "C:\reviewcommon\Hostdhcp.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3948
          • C:\reviewcommon\winlogon.exe
            "C:\reviewcommon\winlogon.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3192
            • C:\Windows\explorer.exe
              "explorer.exe"
              6⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Enumerates connected drives
              • Checks SCSI registry key(s)
              • Modifies registry class
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:1628
            • C:\Windows\explorer.exe
              "explorer.exe"
              6⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Enumerates connected drives
              • Checks SCSI registry key(s)
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:5048
        • C:\Windows\SysWOW64\reg.exe
          reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry key
          PID:4372
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Windows\Speech\csrss.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:4848
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Speech\csrss.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:4020
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Windows\Speech\csrss.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:60
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Windows\Help\OEM\ContentStore\cmd.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:3416
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\Help\OEM\ContentStore\cmd.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2928
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Windows\Help\OEM\ContentStore\cmd.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:964
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\reviewcommon\taskhostw.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:3964
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\reviewcommon\taskhostw.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1260
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\reviewcommon\taskhostw.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2260
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\reviewcommon\winlogon.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:4732
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\reviewcommon\winlogon.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:3952
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\reviewcommon\winlogon.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1572
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Program Files\Reference Assemblies\Microsoft\sysmon.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:3984
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\sysmon.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:4708
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 10 /tr "'C:\Program Files\Reference Assemblies\Microsoft\sysmon.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:5032
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Windows\ModemLogs\fontdrvhost.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1728
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\ModemLogs\fontdrvhost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1952
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Windows\ModemLogs\fontdrvhost.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:952
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:748
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1556
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
    1⤵
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2920
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3512
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2032
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4852
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

1
T1547

Active Setup

1
T1547.014

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Active Setup

1
T1547.014

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

3
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Peripheral Device Discovery

2
T1120

Query Registry

4
T1012

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
    Filesize

    2KB

    MD5

    3946de94ef320ecc3edb46f1fe417dd4

    SHA1

    8b9f5d5cfd37b7e6ff84c283e73877a0738d47db

    SHA256

    171b3e8fd5b402b906a7ad4ea4b898de905483a9cd35d8405c7c339f930a77dc

    SHA512

    21350b142b6cd6c30aba389993b5bc57f7fa9cc99affe796ee05853694868579fb88f5e803f9ab7bae08494906a24562a55420bee1b99e5b70460f388118c4e9

    Download Submit

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133746048988715381.txt
    Filesize

    75KB

    MD5

    d5c60b8ea903ce1856296edb8bf71667

    SHA1

    e1a0a9962df4d82888223f62f0fd3d0dc7fcf526

    SHA256

    7a31074f4165cddf64cfdc81b59c58f6f63058db6401e9627fc9ecad3a307c02

    SHA512

    6c1277187f25e98c8c7fba9a657a1d21cabefadb72be76c44c803353f8c9524ded75d2e5d9a43fb01d96b17d87a44b22f68c5cebabacb7f8685f73e63538dc8a

    Download Submit

  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\YOZOSN6K\microsoft.windows[1].xml
    Filesize

    97B

    MD5

    e6ba99d8293b4c7951bad0a2c6761b8e

    SHA1

    87aaf2d975cdef4db219e4f9f2b1469dd05a6b0b

    SHA256

    773b2b8b752a5bfd3d93b7475dbb7f659bad014ffd06292ee0450c216892ac29

    SHA512

    e6861e87688861f4c43d80f9e98996fc476a11d4e147eb3c55f66d6f1abc065690e2662dd34dca32c0284b64056b95142d932697aa1fa6d6b755ef0f57031ee0

    Download Submit

  • C:\reviewcommon\G7EIw56n.bat
    Filesize

    142B

    MD5

    7a170561552899bb881e2b3b7ec97f59

    SHA1

    8b05b19901a1295592067520f14821a66da6c715

    SHA256

    6852f21deab3ed6df3b0957bf6b22fd4772c56c47bb7c1b446e978e06405d085

    SHA512

    b2ccf78cc27cedd27955017b0efd438fd9d18d8029a82330429d0592539655123dbfaf8fd6cf504cf5c838185fea112d6811322375c4d156d6a9bc3c7774a941

    Download Submit

  • C:\reviewcommon\Hostdhcp.exe
    Filesize

    1.1MB

    MD5

    5c46eb00a3f517f8a1bddda0d44ef6f1

    SHA1

    716a518ec7c084161bfc2d7f212c1196e9a3159f

    SHA256

    ba3402759b71df5f82271b3311fb3229a9ef08298178dd63edd8dea842b42798

    SHA512

    8fb50b833a3ce919bc4fcbc06214adf68dc8e7a0c967b729958ac002973159078507b03defc2055522aaa38e46cbf953a75dc669c463b33f54a8feb802b7364e

    Download Submit

  • C:\reviewcommon\uKjInGP.vbe
    Filesize

    197B

    MD5

    218315e5f589f6b5b8fd0b478d22f642

    SHA1

    e519a85a520980ca36450b9ce86bafe097311df4

    SHA256

    3b054e9b7c644fe7a9f0e938ad22e1a7a8341846d2ea53b02bb399fe154596be

    SHA512

    384d4410494fd3c9d79363a34950cc06b60093bc442ea8800827ba5ae642d773258f09ffb14e3d7b13d3a15c8e16b9ee94749af382b636eec1b30252c5073b50

    Download Submit

  • memory/1628-82-0x0000000003290000-0x0000000003291000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2032-84-0x000001C934500000-0x000001C934600000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/2032-118-0x000001C9358C0000-0x000001C9358E0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2032-103-0x000001C9354B0000-0x000001C9354D0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2032-88-0x000001C9354F0000-0x000001C935510000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2224-317-0x0000013C42C10000-0x0000013C42C30000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2224-280-0x0000013440700000-0x0000013440800000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/2224-297-0x0000013C42800000-0x0000013C42820000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2224-281-0x0000013440700000-0x0000013440800000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/2224-285-0x0000013C42840000-0x0000013C42860000-memory.dmp

    Filesize

    128KB

    Download

  • memory/3192-80-0x0000000000920000-0x0000000000936000-memory.dmp

    Filesize

    88KB

    Download

  • memory/3948-14-0x0000000001450000-0x000000000146C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/3948-15-0x000000001BE20000-0x000000001BE70000-memory.dmp

    Filesize

    320KB

    Download

  • memory/3948-16-0x0000000002C50000-0x0000000002C66000-memory.dmp

    Filesize

    88KB

    Download

  • memory/3948-13-0x00000000009E0000-0x0000000000B06000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/3948-12-0x00007FF9293E3000-0x00007FF9293E5000-memory.dmp

    Filesize

    8KB

    Download

  • memory/5048-278-0x0000000002240000-0x0000000002241000-memory.dmp

    Filesize

    4KB

    Download