Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13/01/2025, 13:53
General
-
Target
Echo test.exe
-
Size
3.8MB
-
MD5
a6055484fbf56a8cfe6a8ce1ad5fe91c
-
SHA1
5e159ecd3265c619dcaae0dbdfaa71fa0533c6f6
-
SHA256
7a2e63f7601af70c3660110cd7d0967d909b2c5ad2ab3bdf834c85d900fe5c94
-
SHA512
6f0dc67e4c14b34cc000e3ad1886f4586d02bba55f5ae8f7ae46eb7269f9603b9120ffe7053fc2cfd91ee3f2f6eb250a47e6cad53e73cbe9e637cfc6f9f847f7
-
SSDEEP
98304:yTApDs2KOw0axITDx00qlvqZpXSfU7dFDSfJtMKSGM:Cp2Kf0ZTDx0z88fUdEIKSGM
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Drops file in Program Files directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Echo test.exe"C:\Users\Admin\AppData\Local\Temp\Echo test.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\PortServerhostSvc\0u1xIFn5uBTahgPweE61XDW6gni0pA9hGvjOu.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\PortServerhostSvc\deeiCKZkZiO4AO25b.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\PortServerhostSvc\ChainComponentBroker.exe"C:\PortServerhostSvc/ChainComponentBroker.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PbkuXlrJQx.bat"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650016⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵
-
-
C:\Recovery\WindowsRE\RuntimeBroker.exe"C:\Recovery\WindowsRE\RuntimeBroker.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
213B
MD51756f8178d512638ebc8309601aee1da
SHA1b860c43f352f88394555c3e9377114d03265554d
SHA2564b404d99abccf5a372b76f904723e69d2c52746305f51d26c82d4a59842e4aaa
SHA512be69f0e7ce83717de283f44e95ba46c6d192d926060315bd43c393fd5dacf89213fd41e545586c27479f678fa29ad4b4a12823c163e8d555a071488981d6b622
-
Filesize
3.5MB
MD5748b7d9fafaffefe123f11305dd0383b
SHA19e94086fce6fc65a72e2f339cb5cffeb3545390c
SHA2568c9eb584cec3f2640cbdb865cdbb38413f63e7d1485d41bde77bc56624b00890
SHA5124ab9d407d0d8f5e8ab6c9f8a802fedbfe5b49eccc590e52495dbb1ee0f948b65c7bc3aefbc94c6a500c22453114a423404e9ce00b74642d8c9314d6c032e9354
-
Filesize
88B
MD5c8423ea58aa138504ea50ad34e8dcd74
SHA1f3054ba306c1605084d4c4ac6b213b3130061d85
SHA256a02c0e705931f16ed8c56c6797eab6f0a1f14fbc4237f529244278b3c117feae
SHA5127151a7f841b05c0a1d1f48f176416ee8988508bee65f9253a9973284ab83cfdf2898ade5979bd30e5a80e2fe41cfc849ebdc8fa0b526be9369b50d32ab4d321b
-
Filesize
215B
MD55cfacbb71ec0ecc8e5e7d30e9622c1e0
SHA195a3ab3313f5f7e255c03442289bf9a89a4f21ab
SHA256be590728c58cff36c3b4d5afb6e83ed39db21f280aa7165c20a151b73971b4f0
SHA5128717e4efdc60ed49bcc4633b69df38c2990b0b8385b502ed5503d4ec7220499e6223519ce039fe6185978c37259e92eb9d1ef8db9442484c26b3e8274f275ebc
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
56KB
-
Filesize
112KB
-
Filesize
320KB
-
Filesize
64KB
-
Filesize
96KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
56KB
-
Filesize
3.5MB
-
Filesize
64KB
-
Filesize
88KB
-
Filesize
152KB
-
Filesize
5.2MB
-
Filesize
56KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
360KB
-
Filesize
56KB
-
Filesize
64KB
-
Filesize
56KB
-
Filesize
96KB
-
Filesize
48KB
-
Filesize
312KB
-
Filesize
8KB
-
Filesize
1.1MB