Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22/03/2025, 06:25

General

  • Target

    35459ca7521a8565cf4acaadd346537b.exe

  • Size

    984KB

  • MD5

    35459ca7521a8565cf4acaadd346537b

  • SHA1

    c22ce5beb121ecbba910dec28dedc0781d379524

  • SHA256

    9622708341e5ac35563f5f258ae7736ad0a9f3c5875cfbf6e4570778b2e2c8bb

  • SHA512

    691dc64caeb7a892b54c970f5d750a47a525004b162994c7e71eefbd4821c5c65961b2bbf08c356799e005de7c258fede7058cc3cc7f939f5ce1cd4ba40becd1

  • SSDEEP

    12288:LzZvuvewk/0pPPXA5q/TQ9+n95vV25gnwHexSDwbwvDxlpaS98IUNldnd65EgF1s:LzZvuGD2PvA5YxwmbZB6Uv

Malware Config

Signatures

  • DcRat 6 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 4 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\35459ca7521a8565cf4acaadd346537b.exe
    "C:\Users\Admin\AppData\Local\Temp\35459ca7521a8565cf4acaadd346537b.exe"
    1⤵
    • DcRat
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1792
    • C:\Windows\System32\rasctrs\lsm.exe
      "C:\Windows\System32\rasctrs\lsm.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2300
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\System32\rasctrs\lsm.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2744
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\System32\wbem\WmiApRes\WmiPrvSE.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2692
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\lsass.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2820
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\System32\wbem\dsprov\WmiPrvSE.exe'" /rl HIGHEST /f
    1⤵
    • DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2896

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\System32\rasctrs\lsm.exe

    Filesize

    984KB

    MD5

    35459ca7521a8565cf4acaadd346537b

    SHA1

    c22ce5beb121ecbba910dec28dedc0781d379524

    SHA256

    9622708341e5ac35563f5f258ae7736ad0a9f3c5875cfbf6e4570778b2e2c8bb

    SHA512

    691dc64caeb7a892b54c970f5d750a47a525004b162994c7e71eefbd4821c5c65961b2bbf08c356799e005de7c258fede7058cc3cc7f939f5ce1cd4ba40becd1

  • C:\Windows\System32\rasctrs\lsm.exe

    Filesize

    984KB

    MD5

    4b3372179cee6f79f7dcabb57c30234f

    SHA1

    49831d8cc707168a9fb207ec294f51611dfc79ab

    SHA256

    5aeba2c8305e16ae2fa0a4d59c6a785805b140e12d39338507a142f91593185e

    SHA512

    8b01d5188ee9a6ee140e6749f9b1cb047d2fb5c08bcbc6710c0661b8f4ba0333d693fee64d0ba8c7a1427ba60b4e87058193df28eace72f69af73890522bfb85

  • memory/1792-8-0x0000000000580000-0x000000000058C000-memory.dmp

    Filesize

    48KB

  • memory/1792-9-0x00000000005A0000-0x00000000005B2000-memory.dmp

    Filesize

    72KB

  • memory/1792-4-0x00000000003B0000-0x00000000003C0000-memory.dmp

    Filesize

    64KB

  • memory/1792-5-0x0000000000560000-0x0000000000570000-memory.dmp

    Filesize

    64KB

  • memory/1792-6-0x0000000000570000-0x0000000000578000-memory.dmp

    Filesize

    32KB

  • memory/1792-7-0x0000000000590000-0x00000000005A0000-memory.dmp

    Filesize

    64KB

  • memory/1792-0-0x000007FEF5813000-0x000007FEF5814000-memory.dmp

    Filesize

    4KB

  • memory/1792-3-0x0000000000540000-0x000000000055C000-memory.dmp

    Filesize

    112KB

  • memory/1792-10-0x00000000005B0000-0x00000000005BC000-memory.dmp

    Filesize

    48KB

  • memory/1792-2-0x000007FEF5810000-0x000007FEF61FC000-memory.dmp

    Filesize

    9.9MB

  • memory/1792-56-0x000007FEF5810000-0x000007FEF61FC000-memory.dmp

    Filesize

    9.9MB

  • memory/1792-1-0x0000000000020000-0x000000000011C000-memory.dmp

    Filesize

    1008KB

  • memory/2300-55-0x0000000000070000-0x000000000016C000-memory.dmp

    Filesize

    1008KB

  • memory/2300-57-0x0000000000680000-0x0000000000692000-memory.dmp

    Filesize

    72KB