Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/01/2025, 08:05
Static task
static1
Behavioral task
behavioral1
Sample
3d213353948aba4d80c28823d8661951.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
3d213353948aba4d80c28823d8661951.exe
Resource
win10v2004-20241007-en
General
-
Target
3d213353948aba4d80c28823d8661951.exe
-
Size
1.8MB
-
MD5
3d213353948aba4d80c28823d8661951
-
SHA1
8c7dadac2ee5f348a8940ab47187b39fd025bead
-
SHA256
877671c4a555e37e34c6b9ecab2cc958b28cc9617c6f53e3841a6386de180e19
-
SHA512
36ba2c76563094e5c8248a05c088ad9c496573ccb6a9799759c38ef77f89e61b9832c617abc7322646c7c029ec8e573f82a4a1cc25b656bee5af82a188cab6c1
-
SSDEEP
24576:/r34Nhem94rOh31QzGpKHaHYSvvv22db+PowhGhomMJV4ynedX4QD/d5lBxdU7it:/I6g1AqY2v22pVfSJKyiXRd5lKu
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 18 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4900 2860 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1172 2860 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4112 2860 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1416 2860 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1420 2860 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 508 2860 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4536 2860 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3636 2860 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3984 2860 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4028 2860 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2832 2860 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1528 2860 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1212 2860 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3112 2860 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4808 2860 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4704 2860 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 220 2860 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4020 2860 schtasks.exe 83 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation 3d213353948aba4d80c28823d8661951.exe -
Executes dropped EXE 1 IoCs
pid Process 3908 spoolsv.exe -
Drops file in Program Files directory 6 IoCs
description ioc Process File created C:\Program Files (x86)\Mozilla Maintenance Service\55b276f4edf653 3d213353948aba4d80c28823d8661951.exe File created C:\Program Files (x86)\Windows Defender\it-IT\spoolsv.exe 3d213353948aba4d80c28823d8661951.exe File created C:\Program Files (x86)\Windows Defender\it-IT\f3b6ecef712a24 3d213353948aba4d80c28823d8661951.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\winlogon.exe 3d213353948aba4d80c28823d8661951.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\cc11b995f2a76d 3d213353948aba4d80c28823d8661951.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\StartMenuExperienceHost.exe 3d213353948aba4d80c28823d8661951.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings 3d213353948aba4d80c28823d8661951.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3636 schtasks.exe 3984 schtasks.exe 4028 schtasks.exe 1528 schtasks.exe 3112 schtasks.exe 1416 schtasks.exe 1420 schtasks.exe 4536 schtasks.exe 2832 schtasks.exe 1212 schtasks.exe 220 schtasks.exe 4900 schtasks.exe 1172 schtasks.exe 4704 schtasks.exe 4112 schtasks.exe 508 schtasks.exe 4808 schtasks.exe 4020 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe 2544 3d213353948aba4d80c28823d8661951.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2544 3d213353948aba4d80c28823d8661951.exe Token: SeDebugPrivilege 3908 spoolsv.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2544 wrote to memory of 1588 2544 3d213353948aba4d80c28823d8661951.exe 102 PID 2544 wrote to memory of 1588 2544 3d213353948aba4d80c28823d8661951.exe 102 PID 1588 wrote to memory of 2532 1588 cmd.exe 104 PID 1588 wrote to memory of 2532 1588 cmd.exe 104 PID 1588 wrote to memory of 2800 1588 cmd.exe 105 PID 1588 wrote to memory of 2800 1588 cmd.exe 105 PID 1588 wrote to memory of 3908 1588 cmd.exe 107 PID 1588 wrote to memory of 3908 1588 cmd.exe 107 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d213353948aba4d80c28823d8661951.exe"C:\Users\Admin\AppData\Local\Temp\3d213353948aba4d80c28823d8661951.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fXGEX6A4dX.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Windows\system32\chcp.comchcp 650013⤵PID:2532
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵PID:2800
-
-
C:\Program Files (x86)\Windows Defender\it-IT\spoolsv.exe"C:\Program Files (x86)\Windows Defender\it-IT\spoolsv.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3908
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\StartMenuExperienceHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4900
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1172
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4112
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1416
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1420
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:508
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Windows\Temp\MsEdgeCrashpad\reports\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4536
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\Temp\MsEdgeCrashpad\reports\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3636
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Windows\Temp\MsEdgeCrashpad\reports\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3984
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Defender\it-IT\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4028
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\it-IT\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2832
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Defender\it-IT\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1528
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Start Menu\unsecapp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1212
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Users\Default\Start Menu\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3112
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Start Menu\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4808
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "3d213353948aba4d80c28823d86619513" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\AppData\Local\Temp\3d213353948aba4d80c28823d8661951.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4704
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "3d213353948aba4d80c28823d8661951" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\3d213353948aba4d80c28823d8661951.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:220
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "3d213353948aba4d80c28823d86619513" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\AppData\Local\Temp\3d213353948aba4d80c28823d8661951.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4020
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD53d213353948aba4d80c28823d8661951
SHA18c7dadac2ee5f348a8940ab47187b39fd025bead
SHA256877671c4a555e37e34c6b9ecab2cc958b28cc9617c6f53e3841a6386de180e19
SHA51236ba2c76563094e5c8248a05c088ad9c496573ccb6a9799759c38ef77f89e61b9832c617abc7322646c7c029ec8e573f82a4a1cc25b656bee5af82a188cab6c1
-
Filesize
233B
MD5b2cc767fa223ed3a82b55537a7366ad9
SHA13976af751b74cd1d085da5c3b6065c908042e772
SHA256eee81322c0fa730d76db735c244fb0a56ceca8ba9400d6ad952c7e4f98cba1a1
SHA512f48fa1941cec237ecba183dd8cc6a9ff7f81bdb4beca9ab9f6c5270c2f0a7d08a0dd78288e5473f43f0d48bb1f8cbca3bcfe4818b1ac533f924674f7ec91ffe1