Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    25/01/2025, 16:56

General

  • Target

    51ee1c43b8c4c83a1ee89f486a002e8a.exe

  • Size

    1.9MB

  • MD5

    51ee1c43b8c4c83a1ee89f486a002e8a

  • SHA1

    ac3559b85e9f8328fc661c4f7dc17d464aa461fa

  • SHA256

    2c359780ff1c635fd866c9f81e53ea9a95c0af2c9b303aec259675882dd13253

  • SHA512

    3191012d5078beb815ff733c3981545858a30e5051ffbbb7b4bb1dff5bab82004809a0d407af0d8312b241c05738591d7a83ce2e01e0c9b2e8f9d325ca9649d6

  • SSDEEP

    49152:SIsY+oZb+wZGTt6IDmYYg+tfxXi1Mq39V:SIg6IDatJXbM9V

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Modifies WinLogon for persistence 2 TTPs 6 IoCs
  • Process spawned unexpected child process 18 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 12 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\51ee1c43b8c4c83a1ee89f486a002e8a.exe
    "C:\Users\Admin\AppData\Local\Temp\51ee1c43b8c4c83a1ee89f486a002e8a.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:628
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qxtgffdb\qxtgffdb.cmdline"
      2⤵
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:3032
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE60B.tmp" "c:\Windows\System32\CSCDEDAB071B0F64DE09691ADF5636D8BE.TMP"
        3⤵
          PID:1776
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\audiodg.exe'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:2268
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\audiodg.exe'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:2344
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Setup\Idle.exe'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:1772
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\csrss.exe'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:1100
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\dllhost.exe'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:2240
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\51ee1c43b8c4c83a1ee89f486a002e8a.exe'
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:1596
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\r4rizFZOU7.bat"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2024
        • C:\Windows\system32\chcp.com
          chcp 65001
          3⤵
            PID:1416
          • C:\Windows\system32\w32tm.exe
            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
            3⤵
              PID:896
            • C:\Windows\Setup\Idle.exe
              "C:\Windows\Setup\Idle.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:1364
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\audiodg.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2720
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Users\Default User\audiodg.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2612
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\audiodg.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2620
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Sidebar\audiodg.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2868
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\audiodg.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2900
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Sidebar\audiodg.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2928
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Windows\Setup\Idle.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2064
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\Setup\Idle.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:1188
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Windows\Setup\Idle.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:1196
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Sidebar\csrss.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:1036
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\csrss.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2104
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Sidebar\csrss.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:264
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\AppData\dllhost.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2796
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Admin\AppData\dllhost.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:1524
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\AppData\dllhost.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:1604
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "51ee1c43b8c4c83a1ee89f486a002e8a5" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\AppData\Local\Temp\51ee1c43b8c4c83a1ee89f486a002e8a.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2000
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "51ee1c43b8c4c83a1ee89f486a002e8a" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\51ee1c43b8c4c83a1ee89f486a002e8a.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2188
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "51ee1c43b8c4c83a1ee89f486a002e8a5" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\AppData\Local\Temp\51ee1c43b8c4c83a1ee89f486a002e8a.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:1600

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\RESE60B.tmp

          Filesize

          1KB

          MD5

          8e4aefa079f5292f6ac30954830a5eb0

          SHA1

          7cc247720ade3256d835c08b3db0153990e1dfec

          SHA256

          c4357308c78ef68572b068d68facff8ac6e37da51f357324a40f05ee0da08096

          SHA512

          14c9ea30d9d98d8ef7281f0fc91a10e43b6199f20a16fa084bdc5989c6ab16c6637c586349eedc2f523efbb789c60893ca4345d69c09bebec9f3b9b38d101fc5

        • C:\Users\Admin\AppData\Local\Temp\r4rizFZOU7.bat

          Filesize

          201B

          MD5

          27d0b5229146d95fb16032266d06adc9

          SHA1

          30152ac8a3e48384b5ea6233643645df241aec89

          SHA256

          ce2e4e1c24f624d59a5ae109e22745407d0fe7a749f44ed829a9afc7c6a8f57c

          SHA512

          df712ebf91c92ecef278a5f294da0a48bf2c612dac5b6a428fd1da3c0d5b43060baa06611f8bdb356623c28ea4bf46dbef65985c987384db6584777a8a69c1e7

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

          Filesize

          7KB

          MD5

          6d7b261fe79ac8ce6930fe492a312ba8

          SHA1

          a4ed9e41d92285d46dfc260627e3b2035ea365f7

          SHA256

          0788294f9b647f7342f5387d65380e7b955919f4bea084cbbf17dee655d78105

          SHA512

          b10d4a57ae56f464b8a34cc31083ddc9f03cf15a7f50d3ac3bd1e952aee218ebac2d8b9b94fd3ec6da777b81d3857c3d762810e14e91d1939c0a14be7c324b61

        • C:\Users\Default\audiodg.exe

          Filesize

          1.9MB

          MD5

          51ee1c43b8c4c83a1ee89f486a002e8a

          SHA1

          ac3559b85e9f8328fc661c4f7dc17d464aa461fa

          SHA256

          2c359780ff1c635fd866c9f81e53ea9a95c0af2c9b303aec259675882dd13253

          SHA512

          3191012d5078beb815ff733c3981545858a30e5051ffbbb7b4bb1dff5bab82004809a0d407af0d8312b241c05738591d7a83ce2e01e0c9b2e8f9d325ca9649d6

        • \??\c:\Users\Admin\AppData\Local\Temp\qxtgffdb\qxtgffdb.0.cs

          Filesize

          365B

          MD5

          68c3a3838b33acb4afbdca44a1ae8009

          SHA1

          dcd4a944b27c31e013a7b1f2acc623da9b13348e

          SHA256

          8beb67b7d15a6684a450a40453943ea89b95e50cc51f05dc4b8c8dca63e81e24

          SHA512

          144439322fa15372eb4963a7bad46af0b75afb2f51373be88e25dc6f2be97de661952c3a789d25d2981ef7dcc86347d099245a76f3220cb486059aa5b8e559b6

        • \??\c:\Users\Admin\AppData\Local\Temp\qxtgffdb\qxtgffdb.cmdline

          Filesize

          235B

          MD5

          114554d05044eb27154ce1db7f0284b6

          SHA1

          f87e786090db9a26be57785fb1b20a5d0239a5fd

          SHA256

          17552327528ff3fbcf24f71bc568420bcac76d983f532a89b1da09fcd3d2f4c3

          SHA512

          2d91d1035c59b19a707bf5a39603e96aa78b5ad9a2e4a1c723a3f3f0349f00615cd7cccff0aea66ab4f6821f0b2369f705a2c7898018388267849b0b1cb0a75a

        • \??\c:\Windows\System32\CSCDEDAB071B0F64DE09691ADF5636D8BE.TMP

          Filesize

          1KB

          MD5

          b74f131aab310dc6e37b43e729c24199

          SHA1

          bade4cf35d7e80e79880396c1fdd518d9ab78bdf

          SHA256

          5fdff2a34cc18e36619ff327b292a8255286dc102d85074b7fc625ccbdbe1858

          SHA512

          733cb12c94d0a8bedc9a38c073dff2fc46553854d7e835767aaa749b4754beef77fa3bc8232eab21c92bc808c08b150cafe5c035bb33d82292fbf76fec55d885

        • memory/628-13-0x0000000000530000-0x000000000053E000-memory.dmp

          Filesize

          56KB

        • memory/628-34-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

          Filesize

          9.9MB

        • memory/628-10-0x0000000000570000-0x0000000000588000-memory.dmp

          Filesize

          96KB

        • memory/628-15-0x0000000000540000-0x0000000000548000-memory.dmp

          Filesize

          32KB

        • memory/628-17-0x0000000000590000-0x000000000059C000-memory.dmp

          Filesize

          48KB

        • memory/628-18-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

          Filesize

          9.9MB

        • memory/628-0-0x000007FEF5D53000-0x000007FEF5D54000-memory.dmp

          Filesize

          4KB

        • memory/628-30-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

          Filesize

          9.9MB

        • memory/628-31-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

          Filesize

          9.9MB

        • memory/628-32-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

          Filesize

          9.9MB

        • memory/628-33-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

          Filesize

          9.9MB

        • memory/628-11-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

          Filesize

          9.9MB

        • memory/628-8-0x0000000000550000-0x000000000056C000-memory.dmp

          Filesize

          112KB

        • memory/628-6-0x0000000000520000-0x000000000052E000-memory.dmp

          Filesize

          56KB

        • memory/628-4-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

          Filesize

          9.9MB

        • memory/628-3-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

          Filesize

          9.9MB

        • memory/628-47-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

          Filesize

          9.9MB

        • memory/628-2-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

          Filesize

          9.9MB

        • memory/628-1-0x0000000000DD0000-0x0000000000FB8000-memory.dmp

          Filesize

          1.9MB

        • memory/628-56-0x000007FEF5D50000-0x000007FEF673C000-memory.dmp

          Filesize

          9.9MB

        • memory/1364-87-0x00000000008F0000-0x0000000000AD8000-memory.dmp

          Filesize

          1.9MB

        • memory/2268-58-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

          Filesize

          2.9MB

        • memory/2268-59-0x0000000002730000-0x0000000002738000-memory.dmp

          Filesize

          32KB