cd660bd4d4f7d33920a2c18be331041ba80d7770e1c47153a5dfae6da3f5e43e

Analysis

max time kernel
112s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20230221-es
resource tags

arch:x64arch:x86image:win10v2004-20230221-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
15-06-2023 05:33

Target

Crafty-v1.1/runtimes/linux-musl-x64/native/libSkiaSharp.so
Size

10.7MB
MD5

cc48075a52520c21ea4d1a32ff5b9aef
SHA1

2cec93d4a2d2f46a5a262ce59c3d58e50c580e00
SHA256

7f70ea29b3285f3417a18f540f2a37d35a3fe0c3bdea51a82d688c8860dd2a9b
SHA512

b1e8699e019dfb4a434e47fa5bf0b9e694f7406a9c1b21dd7c56838e52173e0edb4b9d96b7cbd9ab9d5e05408509a8675343f430b968c26117b450747c305315
SSDEEP

98304:o9z1LafkHA3g/m0hn4xTJOCx5SygZbyMxPxJx4IZ0h1fKvXORXreUAl6+8lwOEPS:o9Sg+aQdSfoI3R6wXWA

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

952 OpenWith.exe

pid	process
952	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Crafty-v1.1\runtimes\linux-musl-x64\native\libSkiaSharp.so
1⤵
- Modifies registry class
PID:1292

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact