Overview

overview

8

Static

static

8

interium/crack/v4.dll

windows10-1703-x64

8

interium/crack/v4.exe

windows10-1703-x64

4

Resubmissions

15-01-2023 00:36

230115-aybg9abe6s 8

15-01-2023 00:11

230115-agp93sfe58 8

15-01-2023 00:06

230115-ad4y3abc3t 8

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    15-01-2023 00:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    interium/crack/v4.exe

  • Size

    5KB

  • MD5

    67601d1b4381c7dafe8e7ad94f38a142

  • SHA1

    16e6e3a8f666429c1a4941e9c0945a22afd6377a

  • SHA256

    04a007a31de14d111ec54030e3646422d5ee224177dae95795ac2826a55336f7

  • SHA512

    63b4666f7212f08c8c9ae24cf914d1694dec5a1daacad0e9e742c0dc39662cc97f1c66722dce99656d3a70277485b25374eb5abad06821c55e73b7f3be7172a3

  • SSDEEP

    48:C7zRekJFF6G3N1zcuzrRr1nnzrQYAPSC1iF9vhAHyhdUXhQB8sXlE6mN0F3ybCV3:Kjd6uzrh1nf2PSCA3vhghQK+l2K3iw

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 19 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\interium\crack\v4.exe
    "C:\Users\Admin\AppData\Local\Temp\interium\crack\v4.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:2664
  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2904
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      2⤵
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4428
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4428.0.359270579\1585489403" -parentBuildID 20200403170909 -prefsHandle 1504 -prefMapHandle 1196 -prefsLen 1 -prefMapSize 220115 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4428 "\\.\pipe\gecko-crash-server-pipe.4428" 1604 gpu
        3⤵
          PID:4132
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4428.3.2029043737\963625170" -childID 1 -isForBrowser -prefsHandle 2164 -prefMapHandle 2160 -prefsLen 156 -prefMapSize 220115 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4428 "\\.\pipe\gecko-crash-server-pipe.4428" 2176 tab
          3⤵
            PID:3412
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4428.13.1749673083\2029123368" -childID 2 -isForBrowser -prefsHandle 3404 -prefMapHandle 3400 -prefsLen 6938 -prefMapSize 220115 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4428 "\\.\pipe\gecko-crash-server-pipe.4428" 3208 tab
            3⤵
              PID:3924
        • C:\Windows\System32\SystemSettingsBroker.exe
          C:\Windows\System32\SystemSettingsBroker.exe -Embedding
          1⤵
            PID:2636
          • \??\c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s RmSvc
            1⤵
              PID:3376
            • \??\c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k localservice -s SstpSvc
              1⤵
                PID:1544
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
                1⤵
                • Drops file in Windows directory
                • Checks SCSI registry key(s)
                • Modifies data under HKEY_USERS
                PID:4904
              • \??\c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
                1⤵
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                PID:4308
              • \??\c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s RasMan
                1⤵
                  PID:4340

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Windows\INF\netsstpa.PNF
                  Filesize

                  6KB

                  MD5

                  01e21456e8000bab92907eec3b3aeea9

                  SHA1

                  39b34fe438352f7b095e24c89968fca48b8ce11c

                  SHA256

                  35ad0403fdef3fce3ef5cd311c72fef2a95a317297a53c02735cda4bd6e0c74f

                  SHA512

                  9d5153450e8fe3f51f20472bae4a2ab2fed43fad61a89b04a70325559f6ffed935dd72212671cc6cfc0288458d359bc71567f0d9af8e5770d696adc5bdadd7ec

                  Download Submit

                • memory/2664-119-0x0000000077770000-0x00000000778FE000-memory.dmp

                  Filesize

                  1.6MB

                  Download

                • memory/2664-120-0x0000000077770000-0x00000000778FE000-memory.dmp

                  Filesize

                  1.6MB

                  Download

                • memory/2664-121-0x0000000077770000-0x00000000778FE000-memory.dmp

                  Filesize

                  1.6MB

                  Download

                • memory/2664-122-0x0000000077770000-0x00000000778FE000-memory.dmp

                  Filesize

                  1.6MB

                  Download

                • memory/2664-123-0x0000000077770000-0x00000000778FE000-memory.dmp

                  Filesize

                  1.6MB

                  Download

                • memory/2664-124-0x0000000077770000-0x00000000778FE000-memory.dmp

                  Filesize

                  1.6MB

                  Download

                • memory/2664-125-0x0000000077770000-0x00000000778FE000-memory.dmp

                  Filesize

                  1.6MB

                  Download