Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

c4abef44de...a5.exe

windows7-x64

10

c4abef44de...a5.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    50s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    18/01/2025, 04:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c4abef44de234ff0d02add4b4a79084c2e1362944059a7207e621432e395b9a5.exe

  • Size

    737KB

  • MD5

    05f1f2214c8b7b660817c4849fdf5537

  • SHA1

    6af7aeb3078376bff17f06cd4c53993b31a48475

  • SHA256

    c4abef44de234ff0d02add4b4a79084c2e1362944059a7207e621432e395b9a5

  • SHA512

    58f46b2840f2165d4b51cbb1d39146929587c7d95de9711e0dec11a9c44b446429a7a49bd0c68473e97cb0880f9fb80b0466c75ffccfa848b655af91689eec23

  • SSDEEP

    12288:y+Tn9t4LxmlM9Itv2/JJMA+UpW3Ari4VVyZC0+1cqwNZ6:y+TnQmxv2BJMA+U3iE0nqY6

Score
10/10
dcratdiscoveryinfostealerratspywarestealer

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Process spawned unexpected child process 6 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 3 IoCs
    rat
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\c4abef44de234ff0d02add4b4a79084c2e1362944059a7207e621432e395b9a5.exe
    "C:\Users\Admin\AppData\Local\Temp\c4abef44de234ff0d02add4b4a79084c2e1362944059a7207e621432e395b9a5.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1552
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CHbNzddoi6.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2288
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:2168
        • C:\Windows\system32\PING.EXE
          ping -n 10 localhost
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:2600
        • C:\Users\Admin\AppData\Local\MsWebView2\wininit.exe
          "C:\Users\Admin\AppData\Local\MsWebView2\wininit.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2092
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\AppData\Local\MsWebView2\wininit.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2904
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\MsWebView2\wininit.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2912
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\AppData\Local\MsWebView2\wininit.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2896
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "c4abef44de234ff0d02add4b4a79084c2e1362944059a7207e621432e395b9a5c" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\AppData\Local\Temp\c4abef44de234ff0d02add4b4a79084c2e1362944059a7207e621432e395b9a5.exe'" /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2172
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "c4abef44de234ff0d02add4b4a79084c2e1362944059a7207e621432e395b9a5" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\c4abef44de234ff0d02add4b4a79084c2e1362944059a7207e621432e395b9a5.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2916
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "c4abef44de234ff0d02add4b4a79084c2e1362944059a7207e621432e395b9a5c" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\AppData\Local\Temp\c4abef44de234ff0d02add4b4a79084c2e1362944059a7207e621432e395b9a5.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:2776

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\MsWebView2\wininit.exe
      Filesize

      737KB

      MD5

      05f1f2214c8b7b660817c4849fdf5537

      SHA1

      6af7aeb3078376bff17f06cd4c53993b31a48475

      SHA256

      c4abef44de234ff0d02add4b4a79084c2e1362944059a7207e621432e395b9a5

      SHA512

      58f46b2840f2165d4b51cbb1d39146929587c7d95de9711e0dec11a9c44b446429a7a49bd0c68473e97cb0880f9fb80b0466c75ffccfa848b655af91689eec23

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\CHbNzddoi6.bat
      Filesize

      179B

      MD5

      f6f7b2f3dcd24dcf5c93f5a2c3a92dbf

      SHA1

      43ba17cbf438a5b57b64ecfabd8ffc907ba6b541

      SHA256

      3ea6060e1d0dea923e25d4ad7d2e2118e460057be5c4a04736d9a2fd09f410c9

      SHA512

      0f5885e94a8a59c61eae4a94e55800c42c3e1341d3b48836cac7cba497ceed5382f235445c55d03eb8729aee8a7d95e8aa4c6993af8eca0105c8e0ad85b0d265

      Download Submit

    • memory/1552-9-0x00000000004B0000-0x00000000004C8000-memory.dmp

      Filesize

      96KB

      Download

    • memory/1552-4-0x00000000001D0000-0x00000000001DE000-memory.dmp

      Filesize

      56KB

      Download

    • memory/1552-6-0x0000000000490000-0x00000000004AC000-memory.dmp

      Filesize

      112KB

      Download

    • memory/1552-7-0x000007FEF5160000-0x000007FEF5B4C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/1552-0-0x000007FEF5163000-0x000007FEF5164000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1552-13-0x000007FEF5160000-0x000007FEF5B4C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/1552-14-0x000007FEF5160000-0x000007FEF5B4C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/1552-15-0x000007FEF5160000-0x000007FEF5B4C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/1552-2-0x000007FEF5160000-0x000007FEF5B4C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/1552-21-0x000007FEF5160000-0x000007FEF5B4C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/1552-1-0x0000000000A10000-0x0000000000ACE000-memory.dmp

      Filesize

      760KB

      Download

    • memory/2092-24-0x0000000000EF0000-0x0000000000FAE000-memory.dmp

      Filesize

      760KB

      Download