Overview
overview
10Static
static
10keygen-step-1.exe
windows7_x64
10keygen-step-1.exe
windows10_x64
10keygen-step-3.exe
windows7_x64
1keygen-step-3.exe
windows10_x64
7keygen-step-4.exe
windows7_x64
8keygen-step-4.exe
windows10_x64
10keygen-ste...ck.exe
windows7_x64
3keygen-ste...ck.exe
windows10_x64
10keygen-ste...33.exe
windows7_x64
9keygen-ste...33.exe
windows10_x64
9keygen-ste...H1.exe
windows7_x64
8keygen-ste...H1.exe
windows10_x64
8keygen-ste...ll.exe
windows7_x64
keygen-ste...ll.exe
windows10_x64
10keygen-ste...up.exe
windows7_x64
10keygen-ste...up.exe
windows10_x64
10keygen-step-4/low.exe
windows7_x64
10keygen-step-4/low.exe
windows10_x64
10keygen-ste...af.exe
windows7_x64
7keygen-ste...af.exe
windows10_x64
7keygen-ste...b1.exe
windows7_x64
10keygen-ste...b1.exe
windows10_x64
10keygen-step-6.exe
windows7_x64
6keygen-step-6.exe
windows10_x64
6keygen.bat
windows7_x64
10keygen.bat
windows10_x64
10Analysis
-
max time kernel
140s -
max time network
195s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
16-10-2021 06:51
Behavioral task
behavioral1
Sample
keygen-step-1.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
keygen-step-1.exe
Resource
win10-en-20210920
Behavioral task
behavioral3
Sample
keygen-step-3.exe
Resource
win7-en-20211014
Behavioral task
behavioral4
Sample
keygen-step-3.exe
Resource
win10-en-20210920
Behavioral task
behavioral5
Sample
keygen-step-4.exe
Resource
win7-en-20210920
Behavioral task
behavioral6
Sample
keygen-step-4.exe
Resource
win10-en-20211014
Behavioral task
behavioral7
Sample
keygen-step-4/Crack.exe
Resource
win7-en-20210920
Behavioral task
behavioral8
Sample
keygen-step-4/Crack.exe
Resource
win10-en-20211014
Behavioral task
behavioral9
Sample
keygen-step-4/DownFlSetup133.exe
Resource
win7-en-20210920
Behavioral task
behavioral10
Sample
keygen-step-4/DownFlSetup133.exe
Resource
win10-en-20211014
Behavioral task
behavioral11
Sample
keygen-step-4/IDWCH1.exe
Resource
win7-en-20210920
Behavioral task
behavioral12
Sample
keygen-step-4/IDWCH1.exe
Resource
win10-en-20210920
Behavioral task
behavioral13
Sample
keygen-step-4/Install.exe
Resource
win7-en-20211014
Behavioral task
behavioral14
Sample
keygen-step-4/Install.exe
Resource
win10-en-20210920
Behavioral task
behavioral15
Sample
keygen-step-4/Setup.exe
Resource
win7-en-20211014
Behavioral task
behavioral16
Sample
keygen-step-4/Setup.exe
Resource
win10-en-20210920
Behavioral task
behavioral17
Sample
keygen-step-4/low.exe
Resource
win7-en-20211014
Behavioral task
behavioral18
Sample
keygen-step-4/low.exe
Resource
win10-en-20210920
Behavioral task
behavioral19
Sample
keygen-step-4/md1_1eaf.exe
Resource
win7-en-20210920
Behavioral task
behavioral20
Sample
keygen-step-4/md1_1eaf.exe
Resource
win10-en-20211014
Behavioral task
behavioral21
Sample
keygen-step-4/pub1.exe
Resource
win7-en-20210920
Behavioral task
behavioral22
Sample
keygen-step-4/pub1.exe
Resource
win10-en-20211014
Behavioral task
behavioral23
Sample
keygen-step-6.exe
Resource
win7-en-20210920
Behavioral task
behavioral24
Sample
keygen-step-6.exe
Resource
win10-en-20211014
Behavioral task
behavioral25
Sample
keygen.bat
Resource
win7-en-20210920
Behavioral task
behavioral26
Sample
keygen.bat
Resource
win10-en-20210920
General
-
Target
keygen-step-4.exe
-
Size
4.3MB
-
MD5
0fbf068bab86c0fa123e8211ff92ade5
-
SHA1
7888a0db5569288d1b11b36620ede09f9401ecc8
-
SHA256
fd12164ece518635296ebae00c8c5d063a4deb9ee781543115522741faf8df86
-
SHA512
c8affc5c4a0f044275ef3e6b77fd05fda3ef54bd5833c13016857eb2b5f0c089ac5a10797945d48465f024a994bca43fbb1bfb7d697f69b83230cd7491ef1ba5
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Crack.exepid process 1612 Crack.exe -
Loads dropped DLL 4 IoCs
Processes:
keygen-step-4.exepid process 1200 keygen-step-4.exe 1200 keygen-step-4.exe 1200 keygen-step-4.exe 1200 keygen-step-4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
keygen-step-4.exedescription pid process target process PID 1200 wrote to memory of 1612 1200 keygen-step-4.exe Crack.exe PID 1200 wrote to memory of 1612 1200 keygen-step-4.exe Crack.exe PID 1200 wrote to memory of 1612 1200 keygen-step-4.exe Crack.exe PID 1200 wrote to memory of 1612 1200 keygen-step-4.exe Crack.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\keygen-step-4.exe"C:\Users\Admin\AppData\Local\Temp\keygen-step-4.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exeMD5
da3e5208d9182ffa5b46087596c64dfe
SHA14b0848af9eeb8846af0200e16243d98b4bc74cb9
SHA256dd3403e0d473095cc2caebf4b0a3f82ab36574e0e7bb4fb0de5c854f78cd53ae
SHA512980d06ea567591a5940c47b56a553b860bf04be673440ea31396df128bb75767e9d1eedc7f7bccd81e03575633b92b52aacbe6519b37a2d8cf70991e137f33b2
-
\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exeMD5
da3e5208d9182ffa5b46087596c64dfe
SHA14b0848af9eeb8846af0200e16243d98b4bc74cb9
SHA256dd3403e0d473095cc2caebf4b0a3f82ab36574e0e7bb4fb0de5c854f78cd53ae
SHA512980d06ea567591a5940c47b56a553b860bf04be673440ea31396df128bb75767e9d1eedc7f7bccd81e03575633b92b52aacbe6519b37a2d8cf70991e137f33b2
-
\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exeMD5
da3e5208d9182ffa5b46087596c64dfe
SHA14b0848af9eeb8846af0200e16243d98b4bc74cb9
SHA256dd3403e0d473095cc2caebf4b0a3f82ab36574e0e7bb4fb0de5c854f78cd53ae
SHA512980d06ea567591a5940c47b56a553b860bf04be673440ea31396df128bb75767e9d1eedc7f7bccd81e03575633b92b52aacbe6519b37a2d8cf70991e137f33b2
-
\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exeMD5
da3e5208d9182ffa5b46087596c64dfe
SHA14b0848af9eeb8846af0200e16243d98b4bc74cb9
SHA256dd3403e0d473095cc2caebf4b0a3f82ab36574e0e7bb4fb0de5c854f78cd53ae
SHA512980d06ea567591a5940c47b56a553b860bf04be673440ea31396df128bb75767e9d1eedc7f7bccd81e03575633b92b52aacbe6519b37a2d8cf70991e137f33b2
-
\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exeMD5
da3e5208d9182ffa5b46087596c64dfe
SHA14b0848af9eeb8846af0200e16243d98b4bc74cb9
SHA256dd3403e0d473095cc2caebf4b0a3f82ab36574e0e7bb4fb0de5c854f78cd53ae
SHA512980d06ea567591a5940c47b56a553b860bf04be673440ea31396df128bb75767e9d1eedc7f7bccd81e03575633b92b52aacbe6519b37a2d8cf70991e137f33b2
-
memory/1200-54-0x00000000751A1000-0x00000000751A3000-memory.dmpFilesize
8KB
-
memory/1612-59-0x0000000000000000-mapping.dmp