Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30/01/2025, 03:46
Behavioral task
behavioral1
Sample
fcf5d6647e4d2e13f8083d42fd2f354735453e847d5e5c2f4ae78c78a6b4254b.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fcf5d6647e4d2e13f8083d42fd2f354735453e847d5e5c2f4ae78c78a6b4254b.exe
Resource
win10v2004-20250129-en
General
-
Target
fcf5d6647e4d2e13f8083d42fd2f354735453e847d5e5c2f4ae78c78a6b4254b.exe
-
Size
1.2MB
-
MD5
383cad8eb4744a1be8c2b17c74b97b0a
-
SHA1
23ccdd08ba293d56ac66b682b57585a85e1742a1
-
SHA256
fcf5d6647e4d2e13f8083d42fd2f354735453e847d5e5c2f4ae78c78a6b4254b
-
SHA512
713896072fd43a6566c895ff96f47fb13442864004e1977a79632818537fdf42401fe0659b2ffe21cdf30a097c5d1576b8856046629822cede88f5f77c0a275d
-
SSDEEP
24576:MATnwO965z/roRbcJEV2oLI2gDMwifE+O3jV5kF9BrK:XuaKEEgTBr
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 27 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2076 2088 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1968 2088 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2712 2088 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2828 2088 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3012 2088 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2748 2088 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2720 2088 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2812 2088 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2856 2088 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2644 2088 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 280 2088 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2620 2088 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1880 2088 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2328 2088 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2260 2088 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 980 2088 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1396 2088 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1940 2088 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2824 2088 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1728 2088 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1924 2088 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 272 2088 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2132 2088 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 324 2088 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1720 2088 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2888 2088 schtasks.exe 30 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1308 2088 schtasks.exe 30 -
resource yara_rule behavioral1/memory/2056-1-0x0000000001070000-0x00000000011AE000-memory.dmp dcrat behavioral1/files/0x0009000000016de4-14.dat dcrat behavioral1/memory/2952-31-0x0000000000BC0000-0x0000000000CFE000-memory.dmp dcrat -
Executes dropped EXE 1 IoCs
pid Process 2952 OSPPSVC.exe -
Drops file in Program Files directory 10 IoCs
description ioc Process File created C:\Program Files (x86)\Uninstall Information\6203df4a6bafc7 fcf5d6647e4d2e13f8083d42fd2f354735453e847d5e5c2f4ae78c78a6b4254b.exe File created C:\Program Files\DVD Maker\fr-FR\System.exe fcf5d6647e4d2e13f8083d42fd2f354735453e847d5e5c2f4ae78c78a6b4254b.exe File created C:\Program Files\DVD Maker\fr-FR\27d1bcfc3c54e0 fcf5d6647e4d2e13f8083d42fd2f354735453e847d5e5c2f4ae78c78a6b4254b.exe File created C:\Program Files\Windows Media Player\es-ES\b75386f1303e64 fcf5d6647e4d2e13f8083d42fd2f354735453e847d5e5c2f4ae78c78a6b4254b.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Idle.exe fcf5d6647e4d2e13f8083d42fd2f354735453e847d5e5c2f4ae78c78a6b4254b.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\6ccacd8608530f fcf5d6647e4d2e13f8083d42fd2f354735453e847d5e5c2f4ae78c78a6b4254b.exe File created C:\Program Files (x86)\Uninstall Information\lsass.exe fcf5d6647e4d2e13f8083d42fd2f354735453e847d5e5c2f4ae78c78a6b4254b.exe File created C:\Program Files (x86)\Reference Assemblies\WmiPrvSE.exe fcf5d6647e4d2e13f8083d42fd2f354735453e847d5e5c2f4ae78c78a6b4254b.exe File created C:\Program Files (x86)\Reference Assemblies\24dbde2999530e fcf5d6647e4d2e13f8083d42fd2f354735453e847d5e5c2f4ae78c78a6b4254b.exe File created C:\Program Files\Windows Media Player\es-ES\taskhost.exe fcf5d6647e4d2e13f8083d42fd2f354735453e847d5e5c2f4ae78c78a6b4254b.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\TAPI\fcf5d6647e4d2e13f8083d42fd2f354735453e847d5e5c2f4ae78c78a6b4254b.exe fcf5d6647e4d2e13f8083d42fd2f354735453e847d5e5c2f4ae78c78a6b4254b.exe File opened for modification C:\Windows\TAPI\fcf5d6647e4d2e13f8083d42fd2f354735453e847d5e5c2f4ae78c78a6b4254b.exe fcf5d6647e4d2e13f8083d42fd2f354735453e847d5e5c2f4ae78c78a6b4254b.exe File created C:\Windows\TAPI\5aeef0fbe1d9cb fcf5d6647e4d2e13f8083d42fd2f354735453e847d5e5c2f4ae78c78a6b4254b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2076 schtasks.exe 324 schtasks.exe 280 schtasks.exe 2620 schtasks.exe 1396 schtasks.exe 2828 schtasks.exe 2720 schtasks.exe 2644 schtasks.exe 272 schtasks.exe 1880 schtasks.exe 2260 schtasks.exe 2824 schtasks.exe 1728 schtasks.exe 1924 schtasks.exe 1308 schtasks.exe 2712 schtasks.exe 3012 schtasks.exe 2748 schtasks.exe 2812 schtasks.exe 2132 schtasks.exe 1720 schtasks.exe 2328 schtasks.exe 980 schtasks.exe 1940 schtasks.exe 2888 schtasks.exe 1968 schtasks.exe 2856 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2056 fcf5d6647e4d2e13f8083d42fd2f354735453e847d5e5c2f4ae78c78a6b4254b.exe 2056 fcf5d6647e4d2e13f8083d42fd2f354735453e847d5e5c2f4ae78c78a6b4254b.exe 2056 fcf5d6647e4d2e13f8083d42fd2f354735453e847d5e5c2f4ae78c78a6b4254b.exe 2952 OSPPSVC.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2056 fcf5d6647e4d2e13f8083d42fd2f354735453e847d5e5c2f4ae78c78a6b4254b.exe Token: SeDebugPrivilege 2952 OSPPSVC.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2056 wrote to memory of 2952 2056 fcf5d6647e4d2e13f8083d42fd2f354735453e847d5e5c2f4ae78c78a6b4254b.exe 58 PID 2056 wrote to memory of 2952 2056 fcf5d6647e4d2e13f8083d42fd2f354735453e847d5e5c2f4ae78c78a6b4254b.exe 58 PID 2056 wrote to memory of 2952 2056 fcf5d6647e4d2e13f8083d42fd2f354735453e847d5e5c2f4ae78c78a6b4254b.exe 58 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\fcf5d6647e4d2e13f8083d42fd2f354735453e847d5e5c2f4ae78c78a6b4254b.exe"C:\Users\Admin\AppData\Local\Temp\fcf5d6647e4d2e13f8083d42fd2f354735453e847d5e5c2f4ae78c78a6b4254b.exe"1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\Saved Games\OSPPSVC.exe"C:\Users\Admin\Saved Games\OSPPSVC.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2952
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fcf5d6647e4d2e13f8083d42fd2f354735453e847d5e5c2f4ae78c78a6b4254bf" /sc MINUTE /mo 10 /tr "'C:\Windows\TAPI\fcf5d6647e4d2e13f8083d42fd2f354735453e847d5e5c2f4ae78c78a6b4254b.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fcf5d6647e4d2e13f8083d42fd2f354735453e847d5e5c2f4ae78c78a6b4254b" /sc ONLOGON /tr "'C:\Windows\TAPI\fcf5d6647e4d2e13f8083d42fd2f354735453e847d5e5c2f4ae78c78a6b4254b.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1968
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fcf5d6647e4d2e13f8083d42fd2f354735453e847d5e5c2f4ae78c78a6b4254bf" /sc MINUTE /mo 10 /tr "'C:\Windows\TAPI\fcf5d6647e4d2e13f8083d42fd2f354735453e847d5e5c2f4ae78c78a6b4254b.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2712
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2828
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3012
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2748
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Uninstall Information\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2720
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Uninstall Information\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2812
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Uninstall Information\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2856
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Reference Assemblies\WmiPrvSE.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2644
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:280
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Reference Assemblies\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2620
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1880
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2328
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2260
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Users\Default\System.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:980
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Default\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1396
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Users\Default\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1940
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Saved Games\OSPPSVC.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2824
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Users\Admin\Saved Games\OSPPSVC.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1728
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Saved Games\OSPPSVC.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1924
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Media Player\es-ES\taskhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:272
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\es-ES\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2132
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Media Player\es-ES\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:324
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Program Files\DVD Maker\fr-FR\System.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1720
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\DVD Maker\fr-FR\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Program Files\DVD Maker\fr-FR\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1308
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5383cad8eb4744a1be8c2b17c74b97b0a
SHA123ccdd08ba293d56ac66b682b57585a85e1742a1
SHA256fcf5d6647e4d2e13f8083d42fd2f354735453e847d5e5c2f4ae78c78a6b4254b
SHA512713896072fd43a6566c895ff96f47fb13442864004e1977a79632818537fdf42401fe0659b2ffe21cdf30a097c5d1576b8856046629822cede88f5f77c0a275d