Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
373s -
max time network
376s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30/01/2023, 20:47
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/crypterservice/CRAXS-RAT-V3-2023
Resource
win10v2004-20220812-en
General
-
Target
https://github.com/crypterservice/CRAXS-RAT-V3-2023
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings chrome.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 4704 chrome.exe 4704 chrome.exe 960 chrome.exe 960 chrome.exe 3420 chrome.exe 3420 chrome.exe 4260 chrome.exe 4260 chrome.exe 2244 chrome.exe 2244 chrome.exe 3396 chrome.exe 3396 chrome.exe 2036 chrome.exe 2036 chrome.exe 1460 chrome.exe 1460 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 1496 chrome.exe 4240 chrome.exe 4240 chrome.exe 4152 chrome.exe 4152 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeRestorePrivilege 3372 7zG.exe Token: 35 3372 7zG.exe Token: SeSecurityPrivilege 3372 7zG.exe Token: SeSecurityPrivilege 3372 7zG.exe Token: SeRestorePrivilege 3208 7zG.exe Token: 35 3208 7zG.exe Token: SeSecurityPrivilege 3208 7zG.exe Token: SeSecurityPrivilege 3208 7zG.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe 960 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 960 wrote to memory of 2144 960 chrome.exe 82 PID 960 wrote to memory of 2144 960 chrome.exe 82 PID 960 wrote to memory of 4764 960 chrome.exe 85 PID 960 wrote to memory of 4764 960 chrome.exe 85 PID 960 wrote to memory of 4764 960 chrome.exe 85 PID 960 wrote to memory of 4764 960 chrome.exe 85 PID 960 wrote to memory of 4764 960 chrome.exe 85 PID 960 wrote to memory of 4764 960 chrome.exe 85 PID 960 wrote to memory of 4764 960 chrome.exe 85 PID 960 wrote to memory of 4764 960 chrome.exe 85 PID 960 wrote to memory of 4764 960 chrome.exe 85 PID 960 wrote to memory of 4764 960 chrome.exe 85 PID 960 wrote to memory of 4764 960 chrome.exe 85 PID 960 wrote to memory of 4764 960 chrome.exe 85 PID 960 wrote to memory of 4764 960 chrome.exe 85 PID 960 wrote to memory of 4764 960 chrome.exe 85 PID 960 wrote to memory of 4764 960 chrome.exe 85 PID 960 wrote to memory of 4764 960 chrome.exe 85 PID 960 wrote to memory of 4764 960 chrome.exe 85 PID 960 wrote to memory of 4764 960 chrome.exe 85 PID 960 wrote to memory of 4764 960 chrome.exe 85 PID 960 wrote to memory of 4764 960 chrome.exe 85 PID 960 wrote to memory of 4764 960 chrome.exe 85 PID 960 wrote to memory of 4764 960 chrome.exe 85 PID 960 wrote to memory of 4764 960 chrome.exe 85 PID 960 wrote to memory of 4764 960 chrome.exe 85 PID 960 wrote to memory of 4764 960 chrome.exe 85 PID 960 wrote to memory of 4764 960 chrome.exe 85 PID 960 wrote to memory of 4764 960 chrome.exe 85 PID 960 wrote to memory of 4764 960 chrome.exe 85 PID 960 wrote to memory of 4764 960 chrome.exe 85 PID 960 wrote to memory of 4764 960 chrome.exe 85 PID 960 wrote to memory of 4764 960 chrome.exe 85 PID 960 wrote to memory of 4764 960 chrome.exe 85 PID 960 wrote to memory of 4764 960 chrome.exe 85 PID 960 wrote to memory of 4764 960 chrome.exe 85 PID 960 wrote to memory of 4764 960 chrome.exe 85 PID 960 wrote to memory of 4764 960 chrome.exe 85 PID 960 wrote to memory of 4764 960 chrome.exe 85 PID 960 wrote to memory of 4764 960 chrome.exe 85 PID 960 wrote to memory of 4764 960 chrome.exe 85 PID 960 wrote to memory of 4764 960 chrome.exe 85 PID 960 wrote to memory of 4704 960 chrome.exe 86 PID 960 wrote to memory of 4704 960 chrome.exe 86 PID 960 wrote to memory of 4372 960 chrome.exe 87 PID 960 wrote to memory of 4372 960 chrome.exe 87 PID 960 wrote to memory of 4372 960 chrome.exe 87 PID 960 wrote to memory of 4372 960 chrome.exe 87 PID 960 wrote to memory of 4372 960 chrome.exe 87 PID 960 wrote to memory of 4372 960 chrome.exe 87 PID 960 wrote to memory of 4372 960 chrome.exe 87 PID 960 wrote to memory of 4372 960 chrome.exe 87 PID 960 wrote to memory of 4372 960 chrome.exe 87 PID 960 wrote to memory of 4372 960 chrome.exe 87 PID 960 wrote to memory of 4372 960 chrome.exe 87 PID 960 wrote to memory of 4372 960 chrome.exe 87 PID 960 wrote to memory of 4372 960 chrome.exe 87 PID 960 wrote to memory of 4372 960 chrome.exe 87 PID 960 wrote to memory of 4372 960 chrome.exe 87 PID 960 wrote to memory of 4372 960 chrome.exe 87 PID 960 wrote to memory of 4372 960 chrome.exe 87 PID 960 wrote to memory of 4372 960 chrome.exe 87 PID 960 wrote to memory of 4372 960 chrome.exe 87 PID 960 wrote to memory of 4372 960 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://github.com/crypterservice/CRAXS-RAT-V3-20231⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff858d74f50,0x7ff858d74f60,0x7ff858d74f702⤵PID:2144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1712 /prefetch:22⤵PID:4764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2036 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2312 /prefetch:82⤵PID:4372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3036 /prefetch:12⤵PID:4272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3016 /prefetch:12⤵PID:4284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4300 /prefetch:82⤵PID:1848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4640 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4552 /prefetch:82⤵PID:4076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4324 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4376 /prefetch:82⤵PID:3492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4628 /prefetch:82⤵PID:1520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5116 /prefetch:82⤵PID:5016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4380 /prefetch:12⤵PID:3132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2620 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1584 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4280 /prefetch:12⤵PID:4312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2616 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4460 /prefetch:12⤵PID:4804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:12⤵PID:1768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1148 /prefetch:12⤵PID:3052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2616 /prefetch:82⤵PID:4880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4356 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4600 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4392 /prefetch:82⤵PID:2368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4392 /prefetch:82⤵PID:2684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4604 /prefetch:82⤵PID:4960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4632 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1644,14586057647414791472,11348453521562028646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5024 /prefetch:82⤵PID:3456
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1632
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3932
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap3795:96:7zEvent48861⤵
- Suspicious use of AdjustPrivilegeToken
PID:3372
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\CraxsRat V3 Crack\RAR PASSWORD.txt1⤵PID:3892
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\CraxsRat V3 Crack\" -an -ai#7zMap11012:120:7zEvent101101⤵
- Suspicious use of AdjustPrivilegeToken
PID:3208
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
193.8MB
MD5c94a8db54327d5f087902263325c98a5
SHA1e0a3b9a8803103038d3758203b5857ec28dabeb3
SHA256f65cb71124a756aa7859cc6eceb094553119e3b79de0d0ea98064034c6e6d892
SHA5122f0fda38ee1ee4285ab8545f2c3b190691230ea72912969b1f79c0176c489428ac71e6206b94a3e622963136f3e0587b623934c9e25d96d4aece35d6dca511aa
-
Filesize
193.1MB
MD5ff1eec621db4fb97f68e623b840251d1
SHA1ba89365c48a39c11f81cbc2f73ea225c95104c25
SHA256688955db779850776ca8eeaae42ad049bf1651deb603fd5d78ffe9872806d559
SHA512b3945366d1f150c64a6273c94d21020be65b2b15a430db8e46cb543df00e0d573b79ba99b37b468bed109f2e803c7e220a2c9b057a4f9d971658cd7250948fdf
-
Filesize
135B
MD59efe0d20692cd6934cd8ecdad6b9c066
SHA185c8a6a21a98c7cc1b928282dac8e5d0caad2996
SHA256308de667f6477193362a6265ae08f11a05aeb6c3a158458b124d8db20b59a04a
SHA5126edcffae83afb00d961b99e1998cfc665fab99ff07a23e1baf61f90532fe8157d1e6a00ef2fa5b56d355225dbc36559dae03e58e887febd451f03e05b9d5fa09