Overview
overview
9Static
static
9Crafty-v1....rp.dll
windows10-2004-x64
1Crafty-v1.1/Splat.dll
windows10-2004-x64
1Crafty-v1....on.dll
windows10-2004-x64
1Crafty-v1....es.dll
windows10-2004-x64
1Crafty-v1....ve.dll
windows10-2004-x64
1Crafty-v1....ta.dll
windows10-2004-x64
1Crafty-v1....ol.dll
windows10-2004-x64
1Crafty-v1....et.dll
windows10-2004-x64
1Crafty-v1....arp.so
windows10-2004-x64
3Crafty-v1....arp.so
windows10-2004-x64
3Crafty-v1....arp.so
windows10-2004-x64
3Crafty-v1....arp.so
windows10-2004-x64
3Crafty-v1....arp.so
windows10-2004-x64
3Crafty-v1....arp.so
windows10-2004-x64
3Crafty-v1....arp.so
windows10-2004-x64
3Crafty-v1....arp.so
windows10-2004-x64
3Crafty-v1.....dylib
windows10-2004-x64
3Crafty-v1.....dylib
windows10-2004-x64
3Crafty-v1.....dylib
windows10-2004-x64
3Crafty-v1....on.dll
windows10-2004-x64
1Crafty-v1....v2.dll
windows10-2004-x64
1Crafty-v1....rp.dll
windows10-2004-x64
1Crafty-v1....rp.dll
windows10-2004-x64
1Crafty-v1....v2.dll
windows10-2004-x64
3Crafty-v1....rp.dll
windows10-2004-x64
3Crafty-v1....rp.dll
windows10-2004-x64
1Crafty-v1....v2.dll
windows10-2004-x64
3Crafty-v1....rp.dll
windows10-2004-x64
3Crafty-v1....rp.dll
windows10-2004-x64
1Crafty-v1....ts.dll
windows10-2004-x64
1Crafty-v1....on.dll
windows10-2004-x64
1Crafty-v1....ta.dll
windows10-2004-x64
1Analysis
-
max time kernel
110s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-es -
resource tags
arch:x64arch:x86image:win10v2004-20230220-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
15-06-2023 05:33
Behavioral task
behavioral1
Sample
Crafty-v1.1/SkiaSharp.dll
Resource
win10v2004-20230220-es
Behavioral task
behavioral2
Sample
Crafty-v1.1/Splat.dll
Resource
win10v2004-20230220-es
Behavioral task
behavioral3
Sample
Crafty-v1.1/System.Drawing.Common.dll
Resource
win10v2004-20230220-es
Behavioral task
behavioral4
Sample
Crafty-v1.1/System.IO.Pipelines.dll
Resource
win10v2004-20230221-es
Behavioral task
behavioral5
Sample
Crafty-v1.1/System.Reactive.dll
Resource
win10v2004-20230220-es
Behavioral task
behavioral6
Sample
Crafty-v1.1/System.Security.Cryptography.ProtectedData.dll
Resource
win10v2004-20230220-es
Behavioral task
behavioral7
Sample
Crafty-v1.1/Tmds.DBus.Protocol.dll
Resource
win10v2004-20230220-es
Behavioral task
behavioral8
Sample
Crafty-v1.1/XboxAuthNet.dll
Resource
win10v2004-20230220-es
Behavioral task
behavioral9
Sample
Crafty-v1.1/runtimes/linux-arm/native/libHarfBuzzSharp.so
Resource
win10v2004-20230220-es
Behavioral task
behavioral10
Sample
Crafty-v1.1/runtimes/linux-arm/native/libSkiaSharp.so
Resource
win10v2004-20230220-es
Behavioral task
behavioral11
Sample
Crafty-v1.1/runtimes/linux-arm64/native/libHarfBuzzSharp.so
Resource
win10v2004-20230220-es
Behavioral task
behavioral12
Sample
Crafty-v1.1/runtimes/linux-arm64/native/libSkiaSharp.so
Resource
win10v2004-20230220-es
Behavioral task
behavioral13
Sample
Crafty-v1.1/runtimes/linux-musl-x64/native/libHarfBuzzSharp.so
Resource
win10v2004-20230220-es
Behavioral task
behavioral14
Sample
Crafty-v1.1/runtimes/linux-musl-x64/native/libSkiaSharp.so
Resource
win10v2004-20230221-es
Behavioral task
behavioral15
Sample
Crafty-v1.1/runtimes/linux-x64/native/libHarfBuzzSharp.so
Resource
win10v2004-20230220-es
Behavioral task
behavioral16
Sample
Crafty-v1.1/runtimes/linux-x64/native/libSkiaSharp.so
Resource
win10v2004-20230220-es
Behavioral task
behavioral17
Sample
Crafty-v1.1/runtimes/osx/native/libAvaloniaNative.dylib
Resource
win10v2004-20230220-es
Behavioral task
behavioral18
Sample
Crafty-v1.1/runtimes/osx/native/libHarfBuzzSharp.dylib
Resource
win10v2004-20230221-es
Behavioral task
behavioral19
Sample
Crafty-v1.1/runtimes/osx/native/libSkiaSharp.dylib
Resource
win10v2004-20230220-es
Behavioral task
behavioral20
Sample
Crafty-v1.1/runtimes/unix/lib/net6.0/System.Drawing.Common.dll
Resource
win10v2004-20230220-es
Behavioral task
behavioral21
Sample
Crafty-v1.1/runtimes/win-arm64/native/av_libglesv2.dll
Resource
win10v2004-20230220-es
Behavioral task
behavioral22
Sample
Crafty-v1.1/runtimes/win-arm64/native/libHarfBuzzSharp.dll
Resource
win10v2004-20230220-es
Behavioral task
behavioral23
Sample
Crafty-v1.1/runtimes/win-arm64/native/libSkiaSharp.dll
Resource
win10v2004-20230221-es
Behavioral task
behavioral24
Sample
Crafty-v1.1/runtimes/win-x64/native/av_libglesv2.dll
Resource
win10v2004-20230220-es
Behavioral task
behavioral25
Sample
Crafty-v1.1/runtimes/win-x64/native/libHarfBuzzSharp.dll
Resource
win10v2004-20230220-es
Behavioral task
behavioral26
Sample
Crafty-v1.1/runtimes/win-x64/native/libSkiaSharp.dll
Resource
win10v2004-20230220-es
Behavioral task
behavioral27
Sample
Crafty-v1.1/runtimes/win-x86/native/av_libglesv2.dll
Resource
win10v2004-20230220-es
Behavioral task
behavioral28
Sample
Crafty-v1.1/runtimes/win-x86/native/libHarfBuzzSharp.dll
Resource
win10v2004-20230220-es
Behavioral task
behavioral29
Sample
Crafty-v1.1/runtimes/win-x86/native/libSkiaSharp.dll
Resource
win10v2004-20230220-es
Behavioral task
behavioral30
Sample
Crafty-v1.1/runtimes/win/lib/net6.0/Microsoft.Win32.SystemEvents.dll
Resource
win10v2004-20230220-es
Behavioral task
behavioral31
Sample
Crafty-v1.1/runtimes/win/lib/net6.0/System.Drawing.Common.dll
Resource
win10v2004-20230221-es
Behavioral task
behavioral32
Sample
Crafty-v1.1/runtimes/win/lib/netstandard2.0/System.Security.Cryptography.ProtectedData.dll
Resource
win10v2004-20230220-es
General
-
Target
Crafty-v1.1/runtimes/linux-arm64/native/libHarfBuzzSharp.so
-
Size
1.3MB
-
MD5
f2444a16900d297e1120dfa2b7934e96
-
SHA1
05bae572ee923ae98e978438ddacb9492ef73783
-
SHA256
b75e8ee2025ade030da55027efedc41c18c07c91d4910003bb0eaaa81def70b1
-
SHA512
db1801c49718cc1abb885135b5ac663d80974208a77cdcf50b4f034ebd4cb2a75600b11f918ff1797a230c98a128a1eecd01af2b45c84b694efe85094fcd7c68
-
SSDEEP
24576:spWxLpZbvPOhxm8q8ccmYMyVIkWim+67Hbx+RchMNwDF4/000oGSFFLM:sp+P+xmyccmYMyVuHbx+mQwDF4/p0oG5
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 5076 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Crafty-v1.1\runtimes\linux-arm64\native\libHarfBuzzSharp.so1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx