Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/01/2025, 07:51
Static task
static1
Behavioral task
behavioral1
Sample
3d213353948aba4d80c28823d8661951.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3d213353948aba4d80c28823d8661951.exe
Resource
win10v2004-20241007-en
General
-
Target
3d213353948aba4d80c28823d8661951.exe
-
Size
1.8MB
-
MD5
3d213353948aba4d80c28823d8661951
-
SHA1
8c7dadac2ee5f348a8940ab47187b39fd025bead
-
SHA256
877671c4a555e37e34c6b9ecab2cc958b28cc9617c6f53e3841a6386de180e19
-
SHA512
36ba2c76563094e5c8248a05c088ad9c496573ccb6a9799759c38ef77f89e61b9832c617abc7322646c7c029ec8e573f82a4a1cc25b656bee5af82a188cab6c1
-
SSDEEP
24576:/r34Nhem94rOh31QzGpKHaHYSvvv22db+PowhGhomMJV4ynedX4QD/d5lBxdU7it:/I6g1AqY2v22pVfSJKyiXRd5lKu
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 18 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2772 2176 schtasks.exe 31 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2912 2176 schtasks.exe 31 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2948 2176 schtasks.exe 31 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1100 2176 schtasks.exe 31 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2160 2176 schtasks.exe 31 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2964 2176 schtasks.exe 31 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2664 2176 schtasks.exe 31 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2592 2176 schtasks.exe 31 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3068 2176 schtasks.exe 31 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2388 2176 schtasks.exe 31 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1320 2176 schtasks.exe 31 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1704 2176 schtasks.exe 31 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2036 2176 schtasks.exe 31 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1824 2176 schtasks.exe 31 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2188 2176 schtasks.exe 31 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2024 2176 schtasks.exe 31 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1996 2176 schtasks.exe 31 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 864 2176 schtasks.exe 31 -
Executes dropped EXE 1 IoCs
pid Process 1080 Idle.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft.NET\Idle.exe 3d213353948aba4d80c28823d8661951.exe File created C:\Program Files (x86)\Microsoft.NET\6ccacd8608530f 3d213353948aba4d80c28823d8661951.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\de-DE\services.exe 3d213353948aba4d80c28823d8661951.exe File created C:\Windows\de-DE\c5b4cb5e9653cc 3d213353948aba4d80c28823d8661951.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2676 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2676 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2772 schtasks.exe 2948 schtasks.exe 2592 schtasks.exe 2388 schtasks.exe 2024 schtasks.exe 1824 schtasks.exe 1996 schtasks.exe 2912 schtasks.exe 2160 schtasks.exe 2964 schtasks.exe 1320 schtasks.exe 2036 schtasks.exe 2664 schtasks.exe 3068 schtasks.exe 1704 schtasks.exe 1100 schtasks.exe 2188 schtasks.exe 864 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 2112 3d213353948aba4d80c28823d8661951.exe 1080 Idle.exe 1080 Idle.exe 1080 Idle.exe 1080 Idle.exe 1080 Idle.exe 1080 Idle.exe 1080 Idle.exe 1080 Idle.exe 1080 Idle.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2112 3d213353948aba4d80c28823d8661951.exe Token: SeDebugPrivilege 1080 Idle.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2112 wrote to memory of 1428 2112 3d213353948aba4d80c28823d8661951.exe 50 PID 2112 wrote to memory of 1428 2112 3d213353948aba4d80c28823d8661951.exe 50 PID 2112 wrote to memory of 1428 2112 3d213353948aba4d80c28823d8661951.exe 50 PID 1428 wrote to memory of 1640 1428 cmd.exe 52 PID 1428 wrote to memory of 1640 1428 cmd.exe 52 PID 1428 wrote to memory of 1640 1428 cmd.exe 52 PID 1428 wrote to memory of 2676 1428 cmd.exe 53 PID 1428 wrote to memory of 2676 1428 cmd.exe 53 PID 1428 wrote to memory of 2676 1428 cmd.exe 53 PID 1428 wrote to memory of 1080 1428 cmd.exe 55 PID 1428 wrote to memory of 1080 1428 cmd.exe 55 PID 1428 wrote to memory of 1080 1428 cmd.exe 55 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d213353948aba4d80c28823d8661951.exe"C:\Users\Admin\AppData\Local\Temp\3d213353948aba4d80c28823d8661951.exe"1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8DQov0eSAS.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\system32\chcp.comchcp 650013⤵PID:1640
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2676
-
-
C:\Program Files (x86)\Microsoft.NET\Idle.exe"C:\Program Files (x86)\Microsoft.NET\Idle.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1080
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsml" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Desktop\lsm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2772
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Users\All Users\Desktop\lsm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2912
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Desktop\lsm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2948
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft.NET\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1100
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2160
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft.NET\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2964
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Windows\de-DE\services.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2592
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\de-DE\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2664
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Windows\de-DE\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3068
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2388
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Admin\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1320
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1704
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2036
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\MSOCache\All Users\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1824
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2188
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "3d213353948aba4d80c28823d86619513" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\AppData\Local\Temp\3d213353948aba4d80c28823d8661951.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2024
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "3d213353948aba4d80c28823d8661951" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\3d213353948aba4d80c28823d8661951.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1996
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "3d213353948aba4d80c28823d86619513" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\AppData\Local\Temp\3d213353948aba4d80c28823d8661951.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:864
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
173B
MD562f515305225600b91ad2f92018aa525
SHA13839e03c85195288d7484ddbed2e944dd6ddb116
SHA25639bde120874723b0ba659183330ac588e098b5063286cbbd5cec30ed109d6f0e
SHA51292a1452d3481ae31fce9d62d62748bb1ad1398c3060660c214defc1f3d3b13b90f4a0b4cbc557d5bd87c0b385dc05e72ed728455c157dfa2200570b3b795f906
-
Filesize
1.8MB
MD53d213353948aba4d80c28823d8661951
SHA18c7dadac2ee5f348a8940ab47187b39fd025bead
SHA256877671c4a555e37e34c6b9ecab2cc958b28cc9617c6f53e3841a6386de180e19
SHA51236ba2c76563094e5c8248a05c088ad9c496573ccb6a9799759c38ef77f89e61b9832c617abc7322646c7c029ec8e573f82a4a1cc25b656bee5af82a188cab6c1