Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14/01/2025, 02:05

General

  • Target

    079172ddcc7b1086b9bf972b21d0d579dbff695fde14811165a986efe322873a.exe

  • Size

    3.2MB

  • MD5

    4fabffd3dfad2d1e11ae2317b40b6e4a

  • SHA1

    df2ce294dc75060632bfb45add20e69ccc9396c1

  • SHA256

    079172ddcc7b1086b9bf972b21d0d579dbff695fde14811165a986efe322873a

  • SHA512

    bc6ab0e0286913472d6ca8cd19e95b4066d433fbb6247ed377e6ade995a74c201902c32463361e9d9746277fe8898d95b8a08114eedc027f062b38d4ea9550ed

  • SSDEEP

    49152:ubA3jIe1fNayqo7lKdSD6qVvWakQ4BnFxFkUP6IqG7bZ0Z2lOWvOhvECUQb:ubQNuAD3vyQ9bLG7yglVv4vHUy

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 6 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 3 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\079172ddcc7b1086b9bf972b21d0d579dbff695fde14811165a986efe322873a.exe
    "C:\Users\Admin\AppData\Local\Temp\079172ddcc7b1086b9bf972b21d0d579dbff695fde14811165a986efe322873a.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1924
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\runtimebrokerHost\P6MatiaJbshfFUR3.vbe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2088
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\runtimebrokerHost\Gjynmp1cQgbqqAJzLCDkc0fMhQUnd.bat" "
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2372
        • C:\runtimebrokerHost\webnetdhcp.exe
          "C:\runtimebrokerHost\webnetdhcp.exe"
          4⤵
          • Drops file in Drivers directory
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3032
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\runtimebrokerHost\webnetdhcp.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1048
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Games\lsass.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1248
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\dllhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1812
          • C:\Program Files\Microsoft Games\lsass.exe
            "C:\Program Files\Microsoft Games\lsass.exe"
            5⤵
            • Executes dropped EXE
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:624
            • C:\Windows\System32\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\08f82371-0208-4da7-9183-189d5628c9d7.vbs"
              6⤵
                PID:1316
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a0f3acf3-c85d-4328-97a2-b620c4d3d340.vbs"
                6⤵
                  PID:872
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Games\lsass.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2580
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Microsoft Games\lsass.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2636
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Games\lsass.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2612
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\dllhost.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2608
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\dllhost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2044
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\dllhost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1092
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
          PID:1240

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\08f82371-0208-4da7-9183-189d5628c9d7.vbs

          Filesize

          717B

          MD5

          2e674e64f7e52d763e7c5a8843cce175

          SHA1

          3060f2cd02fb93baefe76ee0212eeecae1697ba4

          SHA256

          73217e64e5a5fd0e9939d53f4dc1e829c86716e8d4538c22a88936714cecfb1d

          SHA512

          ded64d0005e0cc35d70613727a59d03e7e20959630da503bc5938857689a53886b03ad7600a2eec36adc48e717500301b37a06cd6e38dfc9d6ab73dcdf7083c4

        • C:\Users\Admin\AppData\Local\Temp\a0f3acf3-c85d-4328-97a2-b620c4d3d340.vbs

          Filesize

          494B

          MD5

          eeaa68eadeb4e83d656b69bba9ef68ec

          SHA1

          75bb49b159c20be65a0186ab0bf1331baa5d0cb9

          SHA256

          25d5334fe356e04f82ccbcfe2504290ea53bd9d9faa222fa07a664eb8080a1e2

          SHA512

          a2e2e86a3d982eb62a734e5ddb8fe6c26c0b296fa34594d65049bbe6e19f8aebb043f866ff5ccb95309452039ab0d06e47d57fc7be0b41becaf5b38ecbbfd1e2

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

          Filesize

          7KB

          MD5

          4a228c3e0b8a9af315bba660c86161e2

          SHA1

          03241de4de1e413a4a1fe61104511f5afc09bcb5

          SHA256

          1bda147a0fa8d833c4cf12569f0b801fc5c12a2c48be9ee5da32035d158ae50e

          SHA512

          c6a79fe8534528f11f9ddd672c214851b2fa6e8c049eaede637c5371e8b19f256c59f4d471a7cea2f90f9103e595c6bbbd7e87f3f8bf3251eed26cb0f71f3d9f

        • C:\runtimebrokerHost\Gjynmp1cQgbqqAJzLCDkc0fMhQUnd.bat

          Filesize

          37B

          MD5

          2f75cb9c29ad8dc8dab47b39673a8f09

          SHA1

          89b9602bcf66bea31f020c426878acc7aa922b44

          SHA256

          a42bdf46c460b2e7baa4ec022dba0474a9a9a9eef343ae824a533e1ff700417e

          SHA512

          54e8c98fafbeeb42af261747afcf763e17113ef5ee4e23501f6088da93fd004c9db28c1d41c7c9a3fe05211abf9cd40ada3db993cbdd545cb88c32c77eb07812

        • C:\runtimebrokerHost\P6MatiaJbshfFUR3.vbe

          Filesize

          223B

          MD5

          e63c96d58301c1f1e3dae1378b1b0eca

          SHA1

          186598fa4a820157a4c284450f13c567bb3cb90e

          SHA256

          ee8722b767b0c57b52c64cdb9f7b4eca2b3593fbcde9c6106391a6b065195b2a

          SHA512

          390d7a2404c0379ff64c26bc6e046e09d6ab420aade79d7a1e8e2aada032c81621f4aaa5faaa1d3c4049799e3fca91f08198e306d2b2e0a2a0947a50e7d345c8

        • \runtimebrokerHost\webnetdhcp.exe

          Filesize

          2.9MB

          MD5

          eec01d18c981a5973da10c8cbac73764

          SHA1

          a366e8aff64b3b84c129a54615700b9a6a3238c1

          SHA256

          4c8610c40e37fb70da6b33ad42c7f5d8a0cc34a16c34a3837af521efbf79fa2f

          SHA512

          6425dd22c982be9bc1b10a5b885ca1e610b6ee30f2c3a5181f5d6bcdb5a84bdf6b4a5a851c9552f9b7b1f29d5141ecd2ffb0d00d41f3b70c64f7f332a877f165

        • memory/624-67-0x00000000022F0000-0x0000000002302000-memory.dmp

          Filesize

          72KB

        • memory/624-66-0x00000000009A0000-0x00000000009B2000-memory.dmp

          Filesize

          72KB

        • memory/624-49-0x0000000000330000-0x0000000000628000-memory.dmp

          Filesize

          3.0MB

        • memory/1812-64-0x000000001B530000-0x000000001B812000-memory.dmp

          Filesize

          2.9MB

        • memory/1812-65-0x0000000002810000-0x0000000002818000-memory.dmp

          Filesize

          32KB

        • memory/3032-29-0x0000000001110000-0x000000000111C000-memory.dmp

          Filesize

          48KB

        • memory/3032-35-0x000000001ABF0000-0x000000001ABFC000-memory.dmp

          Filesize

          48KB

        • memory/3032-23-0x0000000000CF0000-0x0000000000CFC000-memory.dmp

          Filesize

          48KB

        • memory/3032-24-0x0000000000D00000-0x0000000000D08000-memory.dmp

          Filesize

          32KB

        • memory/3032-25-0x0000000001060000-0x000000000106C000-memory.dmp

          Filesize

          48KB

        • memory/3032-26-0x0000000001070000-0x0000000001078000-memory.dmp

          Filesize

          32KB

        • memory/3032-28-0x0000000001100000-0x0000000001112000-memory.dmp

          Filesize

          72KB

        • memory/3032-21-0x0000000000CE0000-0x0000000000CE8000-memory.dmp

          Filesize

          32KB

        • memory/3032-30-0x000000001ABA0000-0x000000001ABA8000-memory.dmp

          Filesize

          32KB

        • memory/3032-31-0x000000001ABB0000-0x000000001ABBA000-memory.dmp

          Filesize

          40KB

        • memory/3032-32-0x000000001ABC0000-0x000000001ABCE000-memory.dmp

          Filesize

          56KB

        • memory/3032-33-0x000000001ABD0000-0x000000001ABDE000-memory.dmp

          Filesize

          56KB

        • memory/3032-34-0x000000001ABE0000-0x000000001ABE8000-memory.dmp

          Filesize

          32KB

        • memory/3032-22-0x000000001AFD0000-0x000000001B026000-memory.dmp

          Filesize

          344KB

        • memory/3032-36-0x000000001B020000-0x000000001B028000-memory.dmp

          Filesize

          32KB

        • memory/3032-37-0x000000001B230000-0x000000001B23A000-memory.dmp

          Filesize

          40KB

        • memory/3032-38-0x000000001B240000-0x000000001B24C000-memory.dmp

          Filesize

          48KB

        • memory/3032-20-0x0000000000AA0000-0x0000000000AB2000-memory.dmp

          Filesize

          72KB

        • memory/3032-19-0x0000000000C40000-0x0000000000C56000-memory.dmp

          Filesize

          88KB

        • memory/3032-18-0x0000000000A90000-0x0000000000A98000-memory.dmp

          Filesize

          32KB

        • memory/3032-17-0x0000000000A70000-0x0000000000A8C000-memory.dmp

          Filesize

          112KB

        • memory/3032-16-0x0000000000A60000-0x0000000000A68000-memory.dmp

          Filesize

          32KB

        • memory/3032-15-0x0000000000990000-0x000000000099E000-memory.dmp

          Filesize

          56KB

        • memory/3032-14-0x0000000000980000-0x000000000098E000-memory.dmp

          Filesize

          56KB

        • memory/3032-13-0x0000000001120000-0x0000000001418000-memory.dmp

          Filesize

          3.0MB