908d43421933d1abf7868586042f28c6880f331dae593ec422c9af47516d9c0e

General

Target

908d43421933d1abf7868586042f28c6880f331dae593ec422c9af47516d9c0e.exe
Size

1.7MB
MD5

25a597ee4c316f9db24e759d7a2b71e0
SHA1

ada3372b3f2b58472ba02410de35d9782679d4f0
SHA256

908d43421933d1abf7868586042f28c6880f331dae593ec422c9af47516d9c0e
SHA512

bd0991ed891174194c2f5d4b6eaa0473ed59325def4c0e2a05b86f3cd8f48357bce27b67089c5bb5cda31d6fab8072bb55b329e3a10a81ab16045087bc162cee
SSDEEP

49152:DUUXu+FQWdQE5/qv9w3imteyIIyDtstDuCOux:DUeu+KW20/qv2ymYDIZp

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
300	taskgm.exe
1328	ElfCrack.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Wine	ElfCrack.exe

Loads dropped DLL 4 IoCs

pid	Process
1812	908d43421933d1abf7868586042f28c6880f331dae593ec422c9af47516d9c0e.exe
1812	908d43421933d1abf7868586042f28c6880f331dae593ec422c9af47516d9c0e.exe
1812	908d43421933d1abf7868586042f28c6880f331dae593ec422c9af47516d9c0e.exe
1812	908d43421933d1abf7868586042f28c6880f331dae593ec422c9af47516d9c0e.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	taskgm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\taskgm.exe = "C:\\Windows\\taskgm.exe"	taskgm.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ElfCrack.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	ElfCrack.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\taskgm.exe	taskgm.exe
File opened for modification	C:\Windows\taskgm.exe	taskgm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1328	ElfCrack.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 300	1812	908d43421933d1abf7868586042f28c6880f331dae593ec422c9af47516d9c0e.exe	28
PID 1812 wrote to memory of 300	1812	908d43421933d1abf7868586042f28c6880f331dae593ec422c9af47516d9c0e.exe	28
PID 1812 wrote to memory of 300	1812	908d43421933d1abf7868586042f28c6880f331dae593ec422c9af47516d9c0e.exe	28
PID 1812 wrote to memory of 300	1812	908d43421933d1abf7868586042f28c6880f331dae593ec422c9af47516d9c0e.exe	28
PID 1812 wrote to memory of 300	1812	908d43421933d1abf7868586042f28c6880f331dae593ec422c9af47516d9c0e.exe	28
PID 1812 wrote to memory of 300	1812	908d43421933d1abf7868586042f28c6880f331dae593ec422c9af47516d9c0e.exe	28
PID 1812 wrote to memory of 300	1812	908d43421933d1abf7868586042f28c6880f331dae593ec422c9af47516d9c0e.exe	28
PID 1812 wrote to memory of 1328	1812	908d43421933d1abf7868586042f28c6880f331dae593ec422c9af47516d9c0e.exe	29
PID 1812 wrote to memory of 1328	1812	908d43421933d1abf7868586042f28c6880f331dae593ec422c9af47516d9c0e.exe	29
PID 1812 wrote to memory of 1328	1812	908d43421933d1abf7868586042f28c6880f331dae593ec422c9af47516d9c0e.exe	29
PID 1812 wrote to memory of 1328	1812	908d43421933d1abf7868586042f28c6880f331dae593ec422c9af47516d9c0e.exe	29
PID 1812 wrote to memory of 1328	1812	908d43421933d1abf7868586042f28c6880f331dae593ec422c9af47516d9c0e.exe	29
PID 1812 wrote to memory of 1328	1812	908d43421933d1abf7868586042f28c6880f331dae593ec422c9af47516d9c0e.exe	29
PID 1812 wrote to memory of 1328	1812	908d43421933d1abf7868586042f28c6880f331dae593ec422c9af47516d9c0e.exe	29

C:\Users\Admin\AppData\Local\Temp\908d43421933d1abf7868586042f28c6880f331dae593ec422c9af47516d9c0e.exe
"C:\Users\Admin\AppData\Local\Temp\908d43421933d1abf7868586042f28c6880f331dae593ec422c9af47516d9c0e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Users\Admin\AppData\Local\Temp\WINDOWS\taskgm.exe
  "C:\Users\Admin\AppData\Local\Temp\WINDOWS\taskgm.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  PID:300
- C:\Users\Admin\AppData\Local\Temp\WINDOWS\ElfCrack.exe
  "C:\Users\Admin\AppData\Local\Temp\WINDOWS\ElfCrack.exe"
  2⤵
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Checks whether UAC is enabled
  - Writes to the Master Boot Record (MBR)
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1328

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\WINDOWS\ElfCrack.exe

Filesize
1.8MB

MD5
23b6a0aaae6431b6ba21dee282252fc6

SHA1
4a632912abed1eda48dc253a038ea77789785ed4

SHA256
fc758db6ce57c3536d974193a7c391af3fbc7a6945397f4815f7b25bac861f9d

SHA512
cbd5cb0b815048fa06c8c53b0842f92092499d8f6363954df9fd3d842540ca2e407d5d7f72d8cebe2276d5e5b96d8a915ce778475cfbf3119dd745ab74d6586e

Download Submit
C:\Users\Admin\AppData\Local\Temp\WINDOWS\taskgm.exe

Filesize
800KB

MD5
4e1d74c11dfb6cd836dca65362ec3358

SHA1
e113e0c279c069f16d438d4214dcdc09dba65b41

SHA256
cf92a7b248138680ea1253f97a7d0d3d2f34e8f7c813f0222f1d5c68d6e48eb3

SHA512
8ff7f67b063f2a7d43f92640a6f9536b17ffd70410469cb63b53c3d8be5007a2a8131a12f559e3bf7408fc981563ccfff470caa2d46e0535cf7e647bcbdd31c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\WINDOWS\taskgm.exe

Filesize
800KB

MD5
4e1d74c11dfb6cd836dca65362ec3358

SHA1
e113e0c279c069f16d438d4214dcdc09dba65b41

SHA256
cf92a7b248138680ea1253f97a7d0d3d2f34e8f7c813f0222f1d5c68d6e48eb3

SHA512
8ff7f67b063f2a7d43f92640a6f9536b17ffd70410469cb63b53c3d8be5007a2a8131a12f559e3bf7408fc981563ccfff470caa2d46e0535cf7e647bcbdd31c5

Download Submit
\Users\Admin\AppData\Local\Temp\WINDOWS\ElfCrack.exe

Filesize
1.8MB

MD5
23b6a0aaae6431b6ba21dee282252fc6

SHA1
4a632912abed1eda48dc253a038ea77789785ed4

SHA256
fc758db6ce57c3536d974193a7c391af3fbc7a6945397f4815f7b25bac861f9d

SHA512
cbd5cb0b815048fa06c8c53b0842f92092499d8f6363954df9fd3d842540ca2e407d5d7f72d8cebe2276d5e5b96d8a915ce778475cfbf3119dd745ab74d6586e

Download Submit
\Users\Admin\AppData\Local\Temp\WINDOWS\ElfCrack.exe

Filesize
1.8MB

MD5
23b6a0aaae6431b6ba21dee282252fc6

SHA1
4a632912abed1eda48dc253a038ea77789785ed4

SHA256
fc758db6ce57c3536d974193a7c391af3fbc7a6945397f4815f7b25bac861f9d

SHA512
cbd5cb0b815048fa06c8c53b0842f92092499d8f6363954df9fd3d842540ca2e407d5d7f72d8cebe2276d5e5b96d8a915ce778475cfbf3119dd745ab74d6586e

Download Submit
\Users\Admin\AppData\Local\Temp\WINDOWS\taskgm.exe

Filesize
800KB

MD5
4e1d74c11dfb6cd836dca65362ec3358

SHA1
e113e0c279c069f16d438d4214dcdc09dba65b41

SHA256
cf92a7b248138680ea1253f97a7d0d3d2f34e8f7c813f0222f1d5c68d6e48eb3

SHA512
8ff7f67b063f2a7d43f92640a6f9536b17ffd70410469cb63b53c3d8be5007a2a8131a12f559e3bf7408fc981563ccfff470caa2d46e0535cf7e647bcbdd31c5

Download Submit
\Users\Admin\AppData\Local\Temp\WINDOWS\taskgm.exe

Filesize
800KB

MD5
4e1d74c11dfb6cd836dca65362ec3358

SHA1
e113e0c279c069f16d438d4214dcdc09dba65b41

SHA256
cf92a7b248138680ea1253f97a7d0d3d2f34e8f7c813f0222f1d5c68d6e48eb3

SHA512
8ff7f67b063f2a7d43f92640a6f9536b17ffd70410469cb63b53c3d8be5007a2a8131a12f559e3bf7408fc981563ccfff470caa2d46e0535cf7e647bcbdd31c5

Download Submit
memory/1328-66-0x0000000000400000-0x00000000005CA000-memory.dmp

Filesize
1.8MB

Download
memory/1328-67-0x0000000000400000-0x00000000005CA000-memory.dmp

Filesize
1.8MB

Download
memory/1328-68-0x0000000000400000-0x00000000005CA000-memory.dmp

Filesize
1.8MB

Download
memory/1328-69-0x0000000000400000-0x00000000005CA000-memory.dmp

Filesize
1.8MB

Download
memory/1812-54-0x00000000753F1000-0x00000000753F3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads