Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
174s -
max time network
182s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12/01/2025, 16:28
General
-
Target
RecentFiler-tools.exe
-
Size
3.8MB
-
MD5
ee83fe3104070859f841afb7af5cbfff
-
SHA1
3847b3459fca7aec48f5711bedf807a98b845808
-
SHA256
870cd80a419c1b2b24b3cef28291bba2155ebee9a34d7e100ea822a127458069
-
SHA512
95fa3e41197443f65dd323445fb615702af73e72e9f8b5cacda5d9eebb94bb60310a87ac4d5d3ea079f536c4dfa194dc8912ab59a968f41c836a5b2a26790ea8
-
SSDEEP
98304:ymjQg7O4z4P0bk/WgCMZcX08aj5nOq4EniheBXX:XjQga40Mb8WgCOcX0Vj5nv4Eihy
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 3 IoCs
-
Drops file in Program Files directory 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RecentFiler-tools.exe"C:\Users\Admin\AppData\Local\Temp\RecentFiler-tools.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\PortServerhostSvc\xl2BY7hUATvIvm8WXmzFfuGvvzOXUuoRYHPMiHR7I0i9cVaBUQZJ.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\PortServerhostSvc\SuMLTgi2uZW9T5eaPr1TCicpxOY3.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\PortServerhostSvc\ChainComponentBroker.exe"C:\PortServerhostSvc/ChainComponentBroker.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2ADQCeVkDb.bat"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650016⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵
-
-
C:\PortServerhostSvc\ChainComponentBroker.exe"C:\PortServerhostSvc\ChainComponentBroker.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\MeatSpin [Full].exe"C:\MeatSpin [Full].exe"7⤵
- Executes dropped EXE
-
-
-
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2c0 0x49c1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.7MB
MD5bb4a5266324a3dee6cb4b06d03f3f3e9
SHA19f08e998088faa8386928c4a4dcbca5214b4f422
SHA2567dd0d8c33379f84e3e23d29340051465197735d7fc1e5debf9bf5a6b4f220484
SHA51218fc7355ea1182096aac1786369e07b0828346dcb68405082089c2498fbaffce32563cb666600e6d50ea4c0810ffaa8bbbca014e4b5fd14a0c6100483885ad66
-
Filesize
3.5MB
MD52efa4ad7593974a4e0717d61e179dd0c
SHA1d259b483ace58d50c92006fb75029a0ec75bc494
SHA256b3ea7e9e2daf6379d02c8216b732f893da712de9019ae5bd6569477a773574e9
SHA512d378b579be3bf7c4a34ce5c98e134a4b0385f1cca1b6ecc35e727cc3442a8555c648b3924d20c944350b291945a372694305d61caac02a5d805c0e466cb800a2
-
Filesize
99B
MD56d2acf4f20a4b8eb620a8af617a30b1a
SHA148bf25a53cc71b1cb20a9d6a98cfcb374b61745c
SHA2560f3a9ca5ca00eba7a075c92d5ed4e9ee9c2c4ef9b2be772b576d58292defca41
SHA5126a3d8c6af2d2e3bd46b2d29dc33a991aa94872a894881c4c51ca4e02b96295e93cba6afab1457eb0882a070590adc4762a616b5fda6563f125e593fbda9e1fbc
-
Filesize
224B
MD5693e257a3b1da7e465e8b3f269d87573
SHA1fceec85970a091aaac391749cfa0eb680e9927ed
SHA25690b252e638ecfeac0c398110377415345ee7df3ec09854edd218eefdb5a18db3
SHA512d9c284106fe51577b5d841f1f852b44e188301965b31831d90b90f31d149b8d9889b7f54506c1fd502245df82d89e82d0067d4d5f9d1c59003623aa2d4215313
-
Filesize
1KB
MD598d93f7a2239452aef29ed995c71b759
SHA1d1fc6bff08e49cb16a1e5d0b0348232282cf5677
SHA256399712789c6f2c7bd1b7afdf835eb2ac525632424daf08e751186195ebdbba52
SHA5121073e74c9f065aa02be1bfb172308c555c0ad0c5ff35315d76de23d2c6daf1d3fe0b32042a428431847d09b679f14cb129c058af3277e9ed16787d37ae276d96
-
Filesize
221B
MD52e5e25788ce44e8b6bbe6cd26945eaa5
SHA1162e1d15375d477f1f119afcb468e517c5faf9fc
SHA256c43caf1406b02ef407a178930080a9efc9ba1b3ed0579b9196c314203692efd9
SHA512a9a959b7242a0eea59abf6b08029ec4cfbcdd2ae96e30ac355667b5682b82307f4c7f74fdd1b72eefb7bacc9dd91bae2d1f0a05315c32b8ffde4684efeb1a84b
-
Filesize
4.7MB
-
Filesize
5.2MB
-
Filesize
360KB
-
Filesize
64KB
-
Filesize
96KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
56KB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
88KB
-
Filesize
72KB
-
Filesize
112KB
-
Filesize
56KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
320KB
-
Filesize
56KB
-
Filesize
64KB
-
Filesize
56KB
-
Filesize
96KB
-
Filesize
48KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
56KB
-
Filesize
152KB
-
Filesize
8KB
-
Filesize
3.6MB
-
Filesize
312KB
-
Filesize
32KB