Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/01/2025, 01:34
Behavioral task
behavioral1
Sample
71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe
Resource
win10v2004-20241007-en
General
-
Target
71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe
-
Size
783KB
-
MD5
cf1bfee7761c04cb3d6bac55fd17f8e9
-
SHA1
626a9ced8310839072e9025f576060792efcdaae
-
SHA256
71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6
-
SHA512
db31cca344fa6b94591b55ab6aa918058f3165f11fe8dacde5f9513e8d8057714444ceea9d25db95ac5e112309ee16874ed6957569b9a9c8420c9cc7d72dc102
-
SSDEEP
12288:GqnOYxdAgpoNeF91rg5iFdr0yQ9gYx+EIpakCYJRU7Q9bWoFzqK:G+OQbpbgsFdAyQvzSqaq8q
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 7 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 460 2788 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3768 2788 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1420 2788 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1068 2788 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2584 2788 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3912 2788 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1076 2788 schtasks.exe 82 -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe -
resource yara_rule behavioral2/memory/792-1-0x0000000000B50000-0x0000000000C1A000-memory.dmp dcrat behavioral2/files/0x0007000000023c92-33.dat dcrat behavioral2/files/0x0007000000023c9d-62.dat dcrat behavioral2/files/0x0008000000023c92-89.dat dcrat behavioral2/memory/4224-146-0x0000000000040000-0x000000000010A000-memory.dmp dcrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe -
Executes dropped EXE 1 IoCs
pid Process 4224 fontdrvhost.exe -
Adds Run key to start application 2 TTPs 7 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\Default\\fontdrvhost.exe\"" 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\mfh263enc\\dllhost.exe\"" 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\"" 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\tracing\\smss.exe\"" 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files\\Crashpad\\attachments\\SppExtComObj.exe\"" 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\7-Zip\\Lang\\RuntimeBroker.exe\"" 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Documents and Settings\\csrss.exe\"" 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\System32\mfh263enc\5940a34987c99120d96dace90a3f93f329dcad63 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe File opened for modification C:\Windows\System32\mfh263enc\RCXE362.tmp 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe File opened for modification C:\Windows\System32\mfh263enc\dllhost.exe 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe File created C:\Windows\System32\mfh263enc\dllhost.exe 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe -
Drops file in Program Files directory 8 IoCs
description ioc Process File created C:\Program Files\Crashpad\attachments\SppExtComObj.exe 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe File created C:\Program Files\Crashpad\attachments\e1ef82546f0b02b7e974f28047f3788b1128cce1 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe File created C:\Program Files\7-Zip\Lang\RuntimeBroker.exe 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe File created C:\Program Files\7-Zip\Lang\9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe File opened for modification C:\Program Files\Crashpad\attachments\RCXD97B.tmp 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe File opened for modification C:\Program Files\Crashpad\attachments\SppExtComObj.exe 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe File opened for modification C:\Program Files\7-Zip\Lang\RCXDBFC.tmp 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe File opened for modification C:\Program Files\7-Zip\Lang\RuntimeBroker.exe 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\tracing\smss.exe 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe File created C:\Windows\tracing\69ddcba757bf72f7d36c464c71f42baab150b2b9 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe File opened for modification C:\Windows\tracing\RCXD766.tmp 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe File opened for modification C:\Windows\tracing\smss.exe 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 7 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3768 schtasks.exe 1420 schtasks.exe 1068 schtasks.exe 2584 schtasks.exe 3912 schtasks.exe 1076 schtasks.exe 460 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 792 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe 792 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe 792 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe 792 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe 792 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe 792 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe 792 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe 792 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe 792 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe 792 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe 792 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe 792 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe 792 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe 792 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe 792 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 792 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe Token: SeDebugPrivilege 4224 fontdrvhost.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 792 wrote to memory of 4224 792 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe 90 PID 792 wrote to memory of 4224 792 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe 90 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe"C:\Users\Admin\AppData\Local\Temp\71be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6.exe"1⤵
- UAC bypass
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:792 -
C:\Users\Default\fontdrvhost.exe"C:\Users\Default\fontdrvhost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4224
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:460
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\tracing\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3768
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Crashpad\attachments\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1420
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1068
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Documents and Settings\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2584
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3912
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\mfh263enc\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1076
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
783KB
MD59c3f0159722dc36fabce163d5cd91477
SHA1401fd630467d8df43cb55ca6f88dccc63af8e1ab
SHA256b0c4736a48a8988670177972338facb97007395ff6940df8c042b0dc34742c57
SHA5120773174a36bb2a72a9f3fe8c2db847b8fbc2868330cd76f7a478b9d42f41695684c1ed2f3f01c7d762142c37b627b180af20483c0a4a98110714dee0d072f917
-
Filesize
783KB
MD5bb1c975cfbc7689ee7be062eec1ec1b0
SHA196ebbe77f716c618a4e9cbe1eb512fa2e34c6ddc
SHA256f8920ac2f028a22e2065235f88232ebff2c24cad4d5755ed6fa9154eeb842cab
SHA512a3312018df518185dfd0c7ca4ce27138240baf05533567a00f1361e76c0c8a20d78d90745602254c0b136aba455aee7f44a4f9d5d68ead9cb54894c6543ee14e
-
Filesize
783KB
MD5cf1bfee7761c04cb3d6bac55fd17f8e9
SHA1626a9ced8310839072e9025f576060792efcdaae
SHA25671be20190eec5f61710bdd083137d72791c5d1bf47b06dc9f7748e297ad945a6
SHA512db31cca344fa6b94591b55ab6aa918058f3165f11fe8dacde5f9513e8d8057714444ceea9d25db95ac5e112309ee16874ed6957569b9a9c8420c9cc7d72dc102