Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/01/2025, 08:05

General

  • Target

    3d213353948aba4d80c28823d8661951.exe

  • Size

    1.8MB

  • MD5

    3d213353948aba4d80c28823d8661951

  • SHA1

    8c7dadac2ee5f348a8940ab47187b39fd025bead

  • SHA256

    877671c4a555e37e34c6b9ecab2cc958b28cc9617c6f53e3841a6386de180e19

  • SHA512

    36ba2c76563094e5c8248a05c088ad9c496573ccb6a9799759c38ef77f89e61b9832c617abc7322646c7c029ec8e573f82a4a1cc25b656bee5af82a188cab6c1

  • SSDEEP

    24576:/r34Nhem94rOh31QzGpKHaHYSvvv22db+PowhGhomMJV4ynedX4QD/d5lBxdU7it:/I6g1AqY2v22pVfSJKyiXRd5lKu

Score
10/10

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 18 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\3d213353948aba4d80c28823d8661951.exe
    "C:\Users\Admin\AppData\Local\Temp\3d213353948aba4d80c28823d8661951.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2544
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fXGEX6A4dX.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1588
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:2532
        • C:\Windows\system32\w32tm.exe
          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
          3⤵
            PID:2800
          • C:\Program Files (x86)\Windows Defender\it-IT\spoolsv.exe
            "C:\Program Files (x86)\Windows Defender\it-IT\spoolsv.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:3908
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\StartMenuExperienceHost.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4900
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\StartMenuExperienceHost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1172
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\StartMenuExperienceHost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4112
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\winlogon.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1416
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\winlogon.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1420
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\winlogon.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:508
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Windows\Temp\MsEdgeCrashpad\reports\smss.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4536
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\Temp\MsEdgeCrashpad\reports\smss.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:3636
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Windows\Temp\MsEdgeCrashpad\reports\smss.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:3984
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Defender\it-IT\spoolsv.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4028
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\it-IT\spoolsv.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:2832
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Defender\it-IT\spoolsv.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1528
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Start Menu\unsecapp.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:1212
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Users\Default\Start Menu\unsecapp.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:3112
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Start Menu\unsecapp.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4808
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "3d213353948aba4d80c28823d86619513" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\AppData\Local\Temp\3d213353948aba4d80c28823d8661951.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4704
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "3d213353948aba4d80c28823d8661951" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\3d213353948aba4d80c28823d8661951.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:220
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "3d213353948aba4d80c28823d86619513" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\AppData\Local\Temp\3d213353948aba4d80c28823d8661951.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Scheduled Task/Job: Scheduled Task
        PID:4020

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Mozilla Maintenance Service\StartMenuExperienceHost.exe

        Filesize

        1.8MB

        MD5

        3d213353948aba4d80c28823d8661951

        SHA1

        8c7dadac2ee5f348a8940ab47187b39fd025bead

        SHA256

        877671c4a555e37e34c6b9ecab2cc958b28cc9617c6f53e3841a6386de180e19

        SHA512

        36ba2c76563094e5c8248a05c088ad9c496573ccb6a9799759c38ef77f89e61b9832c617abc7322646c7c029ec8e573f82a4a1cc25b656bee5af82a188cab6c1

      • C:\Users\Admin\AppData\Local\Temp\fXGEX6A4dX.bat

        Filesize

        233B

        MD5

        b2cc767fa223ed3a82b55537a7366ad9

        SHA1

        3976af751b74cd1d085da5c3b6065c908042e772

        SHA256

        eee81322c0fa730d76db735c244fb0a56ceca8ba9400d6ad952c7e4f98cba1a1

        SHA512

        f48fa1941cec237ecba183dd8cc6a9ff7f81bdb4beca9ab9f6c5270c2f0a7d08a0dd78288e5473f43f0d48bb1f8cbca3bcfe4818b1ac533f924674f7ec91ffe1

      • memory/2544-11-0x000000001BF60000-0x000000001BFB0000-memory.dmp

        Filesize

        320KB

      • memory/2544-15-0x000000001BDA0000-0x000000001BDAE000-memory.dmp

        Filesize

        56KB

      • memory/2544-4-0x00007FF9E2CE0000-0x00007FF9E37A1000-memory.dmp

        Filesize

        10.8MB

      • memory/2544-6-0x000000001BD90000-0x000000001BD9E000-memory.dmp

        Filesize

        56KB

      • memory/2544-7-0x00007FF9E2CE0000-0x00007FF9E37A1000-memory.dmp

        Filesize

        10.8MB

      • memory/2544-10-0x00007FF9E2CE0000-0x00007FF9E37A1000-memory.dmp

        Filesize

        10.8MB

      • memory/2544-0-0x00007FF9E2CE3000-0x00007FF9E2CE5000-memory.dmp

        Filesize

        8KB

      • memory/2544-13-0x000000001BDE0000-0x000000001BDF8000-memory.dmp

        Filesize

        96KB

      • memory/2544-9-0x000000001BDC0000-0x000000001BDDC000-memory.dmp

        Filesize

        112KB

      • memory/2544-3-0x00007FF9E2CE0000-0x00007FF9E37A1000-memory.dmp

        Filesize

        10.8MB

      • memory/2544-16-0x00007FF9E2CE0000-0x00007FF9E37A1000-memory.dmp

        Filesize

        10.8MB

      • memory/2544-18-0x00007FF9E2CE0000-0x00007FF9E37A1000-memory.dmp

        Filesize

        10.8MB

      • memory/2544-2-0x00007FF9E2CE0000-0x00007FF9E37A1000-memory.dmp

        Filesize

        10.8MB

      • memory/2544-29-0x00007FF9E2CE0000-0x00007FF9E37A1000-memory.dmp

        Filesize

        10.8MB

      • memory/2544-33-0x00007FF9E2CE0000-0x00007FF9E37A1000-memory.dmp

        Filesize

        10.8MB

      • memory/2544-36-0x00007FF9E2CE0000-0x00007FF9E37A1000-memory.dmp

        Filesize

        10.8MB

      • memory/2544-1-0x0000000000FC0000-0x000000000119E000-memory.dmp

        Filesize

        1.9MB