Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
15/12/2024, 22:03
General
-
Target
1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
-
Size
952KB
-
MD5
ea363f97b2eb4114d986a81633f21b20
-
SHA1
5358a564395c004068ed9907cc6a0809801b8581
-
SHA256
1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11
-
SHA512
b40d208dea8daa1ada700aa93e2559f3ee2d11e8f59b38a288ef8d402a8a11eef3636dd3460d21b72bf3bca78bd2c8ebfc9690bc95e40dd79e427e1122be1096
-
SSDEEP
24576:2+O7F9smBDJwWmIezBLwsHuWbxR4AK5ZJXX:R8/KfRTK
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Modifies WinLogon for persistence 2 TTPs 6 IoCs
-
Process spawned unexpected child process 6 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
UAC bypass 3 TTPs 6 IoCs
-
DCRat payload 4 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 10 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Drops file in System32 directory 10 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
-
System policy modification 1 TTPs 6 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe"C:\Users\Admin\AppData\Local\Temp\1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TItgMK42dD.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵
-
-
C:\PerfLogs\Admin\wininit.exe"C:\PerfLogs\Admin\wininit.exe"3⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\PerfLogs\Admin\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\PerfLogs\Admin\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\System32\clusapi\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\audiodg\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\PerfLogs\Admin\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
952KB
MD5f639d536abe7225c06a2bd2a0b1578bb
SHA17949648271ff732aec8cb63944debe768b2d57d6
SHA256c4fe15dc29fdee48e4eca8d81cb670427689b6280e4eb3de96975781f824e40f
SHA51223c5bfe789a570df99f9647d3d4417690da4e0b8a553b02b4be788df7c35df2e6b56d57534d0c6e7a58c2f7e3876397fc3396f4f48ad94c332c825c8e6844061
-
Filesize
193B
MD5b11c3bbd9d437416f3eac02b9a491f00
SHA1721f5e0ed653de5a78d0ccaa62ed7fd0b7c9bacd
SHA25647757d8f29ca55d2c0bbbc9967e628a082b86a4d22140d4a3710fa15a20d425a
SHA512118c8749d623475b0f76bbabe2a0c7f2585b1c6ae5f0cab502ab68af4e0f95a59a625519af405610524a6c0405e1504d4a7d0767227665b196ffcf47164e14d8
-
Filesize
952KB
MD5ea363f97b2eb4114d986a81633f21b20
SHA15358a564395c004068ed9907cc6a0809801b8581
SHA2561bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11
SHA512b40d208dea8daa1ada700aa93e2559f3ee2d11e8f59b38a288ef8d402a8a11eef3636dd3460d21b72bf3bca78bd2c8ebfc9690bc95e40dd79e427e1122be1096
-
Filesize
64KB
-
Filesize
48KB
-
Filesize
40KB
-
Filesize
48KB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
40KB
-
Filesize
4KB
-
Filesize
48KB
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
976KB
-
Filesize
9.9MB
-
Filesize
976KB