Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/01/2025, 05:25

General

  • Target

    be08dac8fc827b41b19be240140f13e19a802e6c6108105cc303a873c57a20c4.exe

  • Size

    2.7MB

  • MD5

    d07543cb1bc6f660adcb7107ab33f270

  • SHA1

    8421ed19516a2152e4a53d694179107f3ef585c0

  • SHA256

    be08dac8fc827b41b19be240140f13e19a802e6c6108105cc303a873c57a20c4

  • SHA512

    03b6e377af1022d298aeac70c779b621cb5c0e636874e7739fa7ad30b1d64a08a16429719f89dcd0122f8b7309b20708672f8da32577e0265c3c8b34bae2add0

  • SSDEEP

    49152:GB7nRsoz7nIZgHltNj/VImvhIudDXtNHUxQ:Y7nq27nIENjqihIerHUxQ

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Modifies WinLogon for persistence 2 TTPs 6 IoCs
  • Process spawned unexpected child process 18 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 12 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\be08dac8fc827b41b19be240140f13e19a802e6c6108105cc303a873c57a20c4.exe
    "C:\Users\Admin\AppData\Local\Temp\be08dac8fc827b41b19be240140f13e19a802e6c6108105cc303a873c57a20c4.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4856
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\surrogatesession\9Jg3KVOjcV42zUZPCuIVZgehfMBu6YbdOPQ48qfJn162TYBQ.vbe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2924
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\surrogatesession\SnwsOZ2aiJutXMyXmD.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4588
        • C:\surrogatesession\BlockPortdriverCommon.exe
          "C:\surrogatesession/BlockPortdriverCommon.exe"
          4⤵
          • Modifies WinLogon for persistence
          • Checks computer location settings
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Program Files directory
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3132
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lfpkzqzo\lfpkzqzo.cmdline"
            5⤵
            • Drops file in System32 directory
            • Suspicious use of WriteProcessMemory
            PID:2260
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB556.tmp" "c:\Windows\System32\CSCAD5BD8D3EE547599C5EDAA86CDEC7E.TMP"
              6⤵
                PID:4964
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\301yS01mbE.bat"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:4440
              • C:\Windows\system32\chcp.com
                chcp 65001
                6⤵
                  PID:4600
                • C:\Windows\system32\w32tm.exe
                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                  6⤵
                    PID:1424
                  • C:\surrogatesession\fontdrvhost.exe
                    "C:\surrogatesession\fontdrvhost.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2300
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Users\Public\AccountPictures\System.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:1976
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Public\AccountPictures\System.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2448
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Users\Public\AccountPictures\System.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3868
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:548
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2216
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3672
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Downloads\conhost.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2872
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Public\Downloads\conhost.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4420
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Downloads\conhost.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:1516
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\surrogatesession\fontdrvhost.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3620
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\surrogatesession\fontdrvhost.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4328
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\surrogatesession\fontdrvhost.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4808
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\dllhost.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2664
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\dllhost.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:1816
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\dllhost.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3436
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "BlockPortdriverCommonB" /sc MINUTE /mo 13 /tr "'C:\surrogatesession\BlockPortdriverCommon.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:1644
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "BlockPortdriverCommon" /sc ONLOGON /tr "'C:\surrogatesession\BlockPortdriverCommon.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2228
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "BlockPortdriverCommonB" /sc MINUTE /mo 14 /tr "'C:\surrogatesession\BlockPortdriverCommon.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4584

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\301yS01mbE.bat

          Filesize

          211B

          MD5

          e9eba2725ceb056f0a498e59ea74e1ff

          SHA1

          dfeb943eb5b749a2b435237aea582a8f36450844

          SHA256

          129981936ecf8872ce20da7b978bbbc7c1d13ea5a5a8c5533b2afee0b2b63d98

          SHA512

          fbb487b8031b6686c3225f644630bab48f646d1cb5d548d2382c1dc0c592737f1b3bf22ea815a7ed156b5279e157ea9da6d0e6a10867d78d4d9a6b7036c2e9f2

        • C:\Users\Admin\AppData\Local\Temp\RESB556.tmp

          Filesize

          1KB

          MD5

          e13006b09469b17cdeedd3b987a6174d

          SHA1

          61075bb4c76a29b4f20afee1af13f6c9e14a68a1

          SHA256

          3f5045a014565891c64d8603fe80ef65e5c6364bf1c00806dbe55d47b643f341

          SHA512

          0621fc10377c9b9e99674a62037b779235fba4b0f4001f87ddba0c30273eaa0bb9a02cdf9ae956d00ade70174fc78be6716c18a19efc1cc3ccec13532c9f0b06

        • C:\surrogatesession\9Jg3KVOjcV42zUZPCuIVZgehfMBu6YbdOPQ48qfJn162TYBQ.vbe

          Filesize

          213B

          MD5

          f8702ecc9e0f72ccee89fdef7a40b971

          SHA1

          a495334be7d04fd4d3d4ceba0b1b846a0ad76d78

          SHA256

          eea23b38c07a415c44a958410d435a4266ebdf7b7cdbb57c2f011b094df99cd5

          SHA512

          68c8b4ebc2c57f0716b6c62d2596686f50a1a02b58a8090dcffec1615125b05ad76e9650be78e094b9df29f4ca3ac91d4ca7718abe4502266ecca8b44c872ee4

        • C:\surrogatesession\BlockPortdriverCommon.exe

          Filesize

          2.0MB

          MD5

          77905da28eb0ae1c97f92d614f341411

          SHA1

          aa7a9229ede890bc8efd667aa4ac488517260f32

          SHA256

          3c53924669c7c88687d862775af6f78fb2c656d93577f8c96358918e984d8a42

          SHA512

          66b36b0bc4f38d069ab02adb7d0d2a030ea2268bc826c24533193bc3477c703d941bad86433cfd04af27af6854ee60f17eb1dd84440ebab9494b1d5b0d8ba904

        • C:\surrogatesession\SnwsOZ2aiJutXMyXmD.bat

          Filesize

          105B

          MD5

          c4ede3cc43ab27c5ac840dfd8cd98632

          SHA1

          61b6df44c8563c5d400c50bbedd91ee9d8c4b28c

          SHA256

          64eab9ebe09f70865dbb3f35b7e5b76d3ac1c6246bfe7d08569d218a6d0bcfcb

          SHA512

          715182ee0e5a1a38be29484d6b241a80360dd6afcf9991330d5b278c8bb7ea371d89cd7edf4d943dcc405ce85ff276ea882b219eb1f50526307c02ce1f354ade

        • \??\c:\Users\Admin\AppData\Local\Temp\lfpkzqzo\lfpkzqzo.0.cs

          Filesize

          374B

          MD5

          33fa509abdc57872151e32d35c55ed14

          SHA1

          46ac9c3df3c48020c0d85d1e66e645dfb7e19a9e

          SHA256

          c2d6273a90a35526d305e633c28f348731d5eb783457e9fc97cc8219d98521c7

          SHA512

          23faf23c4f54f702190b4bc244ae33f9a99bacb500e4dbab53128e80444f1f59adc7db296bd7473566afa5164dfea7ce365b633c83edb34baf5eb39e0348db36

        • \??\c:\Users\Admin\AppData\Local\Temp\lfpkzqzo\lfpkzqzo.cmdline

          Filesize

          235B

          MD5

          6004e85e850196d2e634017bb48eb794

          SHA1

          91f6a33ad73ca32b9116ea1981778d4996261d87

          SHA256

          d4dfa1ef4d431fd167681c807bfabce553a6e513a108fb34f638e48bbc69e95f

          SHA512

          14312f63e88d79ae3bfa231bc74dff2e7e4315b4047434739d205593797495feeb641f316828895231ff1580d0138ff522a35700ecb9dc2bcf9d98a66bf909d2

        • \??\c:\Windows\System32\CSCAD5BD8D3EE547599C5EDAA86CDEC7E.TMP

          Filesize

          1KB

          MD5

          d544bac668d308d2aba58ded2c13d82d

          SHA1

          e5dd50ef24d5c16629092f9290661a92387773b3

          SHA256

          84b05d56c45fd0382410fcd59e16aeef467ed0a455595dda88386dd5c87d7a02

          SHA512

          0826de2bc95d93dde2c540d2d768a0188481ee88f1da79f9c7d70d7ccd3c8715b8f1d62053f84d14f19e4d2b0a13e67084d970a158464e6223e340eb0733e1b0

        • memory/3132-24-0x0000000003080000-0x000000000308C000-memory.dmp

          Filesize

          48KB

        • memory/3132-33-0x000000001BB50000-0x000000001BB58000-memory.dmp

          Filesize

          32KB

        • memory/3132-20-0x000000001BB20000-0x000000001BB38000-memory.dmp

          Filesize

          96KB

        • memory/3132-26-0x0000000003090000-0x000000000309E000-memory.dmp

          Filesize

          56KB

        • memory/3132-28-0x000000001BB60000-0x000000001BB72000-memory.dmp

          Filesize

          72KB

        • memory/3132-29-0x000000001C540000-0x000000001CA68000-memory.dmp

          Filesize

          5.2MB

        • memory/3132-31-0x000000001BB40000-0x000000001BB4C000-memory.dmp

          Filesize

          48KB

        • memory/3132-22-0x0000000003060000-0x000000000306E000-memory.dmp

          Filesize

          56KB

        • memory/3132-35-0x000000001BB80000-0x000000001BB8C000-memory.dmp

          Filesize

          48KB

        • memory/3132-18-0x000000001BFC0000-0x000000001C010000-memory.dmp

          Filesize

          320KB

        • memory/3132-17-0x000000001BB00000-0x000000001BB1C000-memory.dmp

          Filesize

          112KB

        • memory/3132-15-0x0000000003050000-0x000000000305E000-memory.dmp

          Filesize

          56KB

        • memory/3132-13-0x0000000000CA0000-0x0000000000EB2000-memory.dmp

          Filesize

          2.1MB

        • memory/3132-12-0x00007FFDFA403000-0x00007FFDFA405000-memory.dmp

          Filesize

          8KB