Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    15s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    22/03/2025, 06:13

General

  • Target

    7ca42dc286ca99ecb75ab26cc68042f04556b199feb0ecdece718faf13b8de36.exe

  • Size

    2.0MB

  • MD5

    f21def2cacce9d2149abd673f344fbc0

  • SHA1

    ea64f2a295933c32fd01ce7ac91cf5e9cdaeb491

  • SHA256

    7ca42dc286ca99ecb75ab26cc68042f04556b199feb0ecdece718faf13b8de36

  • SHA512

    8d731bd745723001bed0796ea31751a90bc926a562e7ac6d315623c376e1ce6da03d648d35147571c3905180c9927f3d23ef3e017a3d4907e6e22b60103837a9

  • SSDEEP

    49152:7rYU+Yy4J8jao9UVlWAOjhRzsiYHjo++xTN:7dxVJC9UqRzsu+8N

Score
10/10

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • DCRat payload 1 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7ca42dc286ca99ecb75ab26cc68042f04556b199feb0ecdece718faf13b8de36.exe
    "C:\Users\Admin\AppData\Local\Temp\7ca42dc286ca99ecb75ab26cc68042f04556b199feb0ecdece718faf13b8de36.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2308-0-0x000007FEF64B3000-0x000007FEF64B4000-memory.dmp

    Filesize

    4KB

  • memory/2308-1-0x0000000001310000-0x000000000151A000-memory.dmp

    Filesize

    2.0MB

  • memory/2308-2-0x000007FEF64B0000-0x000007FEF6E9C000-memory.dmp

    Filesize

    9.9MB

  • memory/2308-3-0x00000000003D0000-0x00000000003DE000-memory.dmp

    Filesize

    56KB

  • memory/2308-4-0x00000000003E0000-0x00000000003EE000-memory.dmp

    Filesize

    56KB

  • memory/2308-5-0x000007FEF64B0000-0x000007FEF6E9C000-memory.dmp

    Filesize

    9.9MB