Analysis
-
max time kernel
144s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
28-03-2023 03:31
General
-
Target
CrystalDiskInfo8_17_5.exe
-
Size
5.0MB
-
MD5
8360ed8f8351c16f6259b88ce8c86353
-
SHA1
ceaa5c1bddbb1486826ca3427bbb0450e5ad8bcf
-
SHA256
892fad32d6aa24b24dbdd5757ba026206f24a7e78b84ffc1a579510c5a294137
-
SHA512
8bbeecb698c00a7c992a4c08ebf0565f6edd2a08b45ddbc5bd1762e42175a38767400b3e5d9db8b5b1e08e2a899a5d00dd6f4e107babd4c18f4ed4b00b65f610
-
SSDEEP
98304:ikLKxHcD7YjjIygnuXRv9ERNcM3dyMEBWdpObW:tKpcD7YXmSqRMMqEObW
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 8 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CrystalDiskInfo8_17_5.exe"C:\Users\Admin\AppData\Local\Temp\CrystalDiskInfo8_17_5.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-ATHVJ.tmp\CrystalDiskInfo8_17_5.tmp"C:\Users\Admin\AppData\Local\Temp\is-ATHVJ.tmp\CrystalDiskInfo8_17_5.tmp" /SL5="$70124,4163908,857600,C:\Users\Admin\AppData\Local\Temp\CrystalDiskInfo8_17_5.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5f8b559a259cfe0f8eb39d1596f371767
SHA1fdb89b6a1f08f7d8e83fd862403da71e110f737f
SHA256c964d3efbe51d9c9ceb113d6eee196e1fd19938cadd733011c24b91d093f16de
SHA512d8ab05bfac764187049cc0ca3c7a5e7112e5bd685b083d01fee6ea1939b8ff53c1a316e549f3a4c2a1e011fea101155fe36109c875593884972dbb0fbbef171a
-
Filesize
1KB
MD5cd53ebbeedfcdbe04ac94f0323440d83
SHA12249087471df17ab704b9e24c620a7d7f9e406d9
SHA25616e367b75d0cb12efeb05cf23e696c06941e319509302bd99942b06d8daa4cb6
SHA51207bbf2cfff944579a68dc337ecf7ededebd408ba7849f58e4de6215656f94f04d6af3b197c00b147092cb018dfaf196b1fbdd384360319fb1367fc55c77e2ee6
-
Filesize
1KB
MD58d1ad40d84930c904a3c46a2e876110e
SHA1b49b07507ded62c5be9db303de3c0ac129eeb89c
SHA256d7ad392146e0be9b808bf4568cf9e10d8f6c20c2055aee1f26763118fd6d422a
SHA512d8f63bacd180132d4d63a9ef40fea46c0b2a712ccfca9b05814ebecd300e31e2f55a72dec9a7fe18c150866a0abf0eb88aceed5ff6c856895dfc2ed0cd052137
-
Filesize
1KB
MD5e8799e2989a9ec24ea55195adf9d2e89
SHA13ba12b043c5d27b56b9691271d53d037dbe0f410
SHA2563ff066b7b8d75fa423837c5880f45727b86e1f2366852c399d672c3dcf6a80ae
SHA51205b854ac0c5faef1f255e2d24c1923c40019f1eef8d4a77215469ecba004720e6f781f84a872e790a9163799be6cd7cec088e04200e15aed5b7ada174b2436b7
-
Filesize
923B
MD5dce02b9a45fba2a70042c8c1e03d9b94
SHA1978e46984c3122ca2ecc5392b6b6f877dbe178b3
SHA2560b0106761cac0e726c84c5883c989fae0e33c9ec90f3951e9a16e0e6128c183f
SHA512476d6d814e6d5402d33748469d4cc86acb41aa79b9e4ce851c1531fb6706b9adcf1386b44cb293c8abb0b11768fb004ba89814a0caaab4579538d35edfa3060f
-
Filesize
2.7MB
MD54d02f1b59c8e224216b2219bd99f9546
SHA1da6bba4a3738263c14d99538be3ddc28d17bdb6f
SHA2567211f990c24732bb70aa9df130745a5a6edd80f6f6fadbfffa1b7b7c3267c19e
SHA5125ac3ca578ce1b369be33deb35529bfc379634c87decc7128396050fe55e4f41aef78c9f8c5fd69dd8a629174758ee0c5617df9800c65d109c41092fbe8e94b2d
-
Filesize
3.1MB
MD51ba538756b5bd8fd4c9296f0cd461a5c
SHA138bc3f16a7d054ed5368dff5726d16b23580129b
SHA256f946d2ec91242ba4ff46c3e73c1f51f885391f1f56f5689ea973bafcc584a8ae
SHA512fd1effa65a993604894e575b7617d8f32a0eb839fb08f58625c2485795dce369e3cdf15608974d4ff8a09c6867a24861f002f9ceee8d81677220d696b45bedb6
-
Filesize
3.1MB
MD51ba538756b5bd8fd4c9296f0cd461a5c
SHA138bc3f16a7d054ed5368dff5726d16b23580129b
SHA256f946d2ec91242ba4ff46c3e73c1f51f885391f1f56f5689ea973bafcc584a8ae
SHA512fd1effa65a993604894e575b7617d8f32a0eb839fb08f58625c2485795dce369e3cdf15608974d4ff8a09c6867a24861f002f9ceee8d81677220d696b45bedb6
-
Filesize
3.1MB
MD51ba538756b5bd8fd4c9296f0cd461a5c
SHA138bc3f16a7d054ed5368dff5726d16b23580129b
SHA256f946d2ec91242ba4ff46c3e73c1f51f885391f1f56f5689ea973bafcc584a8ae
SHA512fd1effa65a993604894e575b7617d8f32a0eb839fb08f58625c2485795dce369e3cdf15608974d4ff8a09c6867a24861f002f9ceee8d81677220d696b45bedb6
-
Filesize
2.5MB
MD580bff73c6e61647a327b227130d0a8f3
SHA12a15c2f0271dfdd7027e6be438dfc993671e4ce4
SHA25628a06d450d6b52c78777d2af878761557cb121d5318aad65c5c31bddaa3ccc50
SHA5124a3209875fe6b967d205c712e6a1f06e0196c975daefe09844ec34fb52a2bcb6f942e2ed5b633d03b0cd566489e6b8f9936689d75b5d1d6d76d6b5899fdfe058
-
Filesize
2.7MB
MD54d02f1b59c8e224216b2219bd99f9546
SHA1da6bba4a3738263c14d99538be3ddc28d17bdb6f
SHA2567211f990c24732bb70aa9df130745a5a6edd80f6f6fadbfffa1b7b7c3267c19e
SHA5125ac3ca578ce1b369be33deb35529bfc379634c87decc7128396050fe55e4f41aef78c9f8c5fd69dd8a629174758ee0c5617df9800c65d109c41092fbe8e94b2d
-
Filesize
2.7MB
MD54d02f1b59c8e224216b2219bd99f9546
SHA1da6bba4a3738263c14d99538be3ddc28d17bdb6f
SHA2567211f990c24732bb70aa9df130745a5a6edd80f6f6fadbfffa1b7b7c3267c19e
SHA5125ac3ca578ce1b369be33deb35529bfc379634c87decc7128396050fe55e4f41aef78c9f8c5fd69dd8a629174758ee0c5617df9800c65d109c41092fbe8e94b2d
-
Filesize
2.7MB
MD54d02f1b59c8e224216b2219bd99f9546
SHA1da6bba4a3738263c14d99538be3ddc28d17bdb6f
SHA2567211f990c24732bb70aa9df130745a5a6edd80f6f6fadbfffa1b7b7c3267c19e
SHA5125ac3ca578ce1b369be33deb35529bfc379634c87decc7128396050fe55e4f41aef78c9f8c5fd69dd8a629174758ee0c5617df9800c65d109c41092fbe8e94b2d
-
Filesize
2.7MB
MD54d02f1b59c8e224216b2219bd99f9546
SHA1da6bba4a3738263c14d99538be3ddc28d17bdb6f
SHA2567211f990c24732bb70aa9df130745a5a6edd80f6f6fadbfffa1b7b7c3267c19e
SHA5125ac3ca578ce1b369be33deb35529bfc379634c87decc7128396050fe55e4f41aef78c9f8c5fd69dd8a629174758ee0c5617df9800c65d109c41092fbe8e94b2d
-
Filesize
2.7MB
MD54d02f1b59c8e224216b2219bd99f9546
SHA1da6bba4a3738263c14d99538be3ddc28d17bdb6f
SHA2567211f990c24732bb70aa9df130745a5a6edd80f6f6fadbfffa1b7b7c3267c19e
SHA5125ac3ca578ce1b369be33deb35529bfc379634c87decc7128396050fe55e4f41aef78c9f8c5fd69dd8a629174758ee0c5617df9800c65d109c41092fbe8e94b2d
-
Filesize
2.7MB
MD54d02f1b59c8e224216b2219bd99f9546
SHA1da6bba4a3738263c14d99538be3ddc28d17bdb6f
SHA2567211f990c24732bb70aa9df130745a5a6edd80f6f6fadbfffa1b7b7c3267c19e
SHA5125ac3ca578ce1b369be33deb35529bfc379634c87decc7128396050fe55e4f41aef78c9f8c5fd69dd8a629174758ee0c5617df9800c65d109c41092fbe8e94b2d
-
Filesize
3.1MB
MD51ba538756b5bd8fd4c9296f0cd461a5c
SHA138bc3f16a7d054ed5368dff5726d16b23580129b
SHA256f946d2ec91242ba4ff46c3e73c1f51f885391f1f56f5689ea973bafcc584a8ae
SHA512fd1effa65a993604894e575b7617d8f32a0eb839fb08f58625c2485795dce369e3cdf15608974d4ff8a09c6867a24861f002f9ceee8d81677220d696b45bedb6
-
Filesize
892KB
-
Filesize
892KB
-
Filesize
3.1MB
-
Filesize
4KB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
4KB