Overview
overview
9Static
static
9Crafty-v1....rp.dll
windows10-2004-x64
1Crafty-v1.1/Splat.dll
windows10-2004-x64
1Crafty-v1....on.dll
windows10-2004-x64
1Crafty-v1....es.dll
windows10-2004-x64
1Crafty-v1....ve.dll
windows10-2004-x64
1Crafty-v1....ta.dll
windows10-2004-x64
1Crafty-v1....ol.dll
windows10-2004-x64
1Crafty-v1....et.dll
windows10-2004-x64
1Crafty-v1....arp.so
windows10-2004-x64
3Crafty-v1....arp.so
windows10-2004-x64
3Crafty-v1....arp.so
windows10-2004-x64
3Crafty-v1....arp.so
windows10-2004-x64
3Crafty-v1....arp.so
windows10-2004-x64
3Crafty-v1....arp.so
windows10-2004-x64
3Crafty-v1....arp.so
windows10-2004-x64
3Crafty-v1....arp.so
windows10-2004-x64
3Crafty-v1.....dylib
windows10-2004-x64
3Crafty-v1.....dylib
windows10-2004-x64
3Crafty-v1.....dylib
windows10-2004-x64
3Crafty-v1....on.dll
windows10-2004-x64
1Crafty-v1....v2.dll
windows10-2004-x64
1Crafty-v1....rp.dll
windows10-2004-x64
1Crafty-v1....rp.dll
windows10-2004-x64
1Crafty-v1....v2.dll
windows10-2004-x64
3Crafty-v1....rp.dll
windows10-2004-x64
3Crafty-v1....rp.dll
windows10-2004-x64
1Crafty-v1....v2.dll
windows10-2004-x64
3Crafty-v1....rp.dll
windows10-2004-x64
3Crafty-v1....rp.dll
windows10-2004-x64
1Crafty-v1....ts.dll
windows10-2004-x64
1Crafty-v1....on.dll
windows10-2004-x64
1Crafty-v1....ta.dll
windows10-2004-x64
1Analysis
-
max time kernel
114s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-es -
resource tags
arch:x64arch:x86image:win10v2004-20230220-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
15-06-2023 05:33
Behavioral task
behavioral1
Sample
Crafty-v1.1/SkiaSharp.dll
Resource
win10v2004-20230220-es
Behavioral task
behavioral2
Sample
Crafty-v1.1/Splat.dll
Resource
win10v2004-20230220-es
Behavioral task
behavioral3
Sample
Crafty-v1.1/System.Drawing.Common.dll
Resource
win10v2004-20230220-es
Behavioral task
behavioral4
Sample
Crafty-v1.1/System.IO.Pipelines.dll
Resource
win10v2004-20230221-es
Behavioral task
behavioral5
Sample
Crafty-v1.1/System.Reactive.dll
Resource
win10v2004-20230220-es
Behavioral task
behavioral6
Sample
Crafty-v1.1/System.Security.Cryptography.ProtectedData.dll
Resource
win10v2004-20230220-es
Behavioral task
behavioral7
Sample
Crafty-v1.1/Tmds.DBus.Protocol.dll
Resource
win10v2004-20230220-es
Behavioral task
behavioral8
Sample
Crafty-v1.1/XboxAuthNet.dll
Resource
win10v2004-20230220-es
Behavioral task
behavioral9
Sample
Crafty-v1.1/runtimes/linux-arm/native/libHarfBuzzSharp.so
Resource
win10v2004-20230220-es
Behavioral task
behavioral10
Sample
Crafty-v1.1/runtimes/linux-arm/native/libSkiaSharp.so
Resource
win10v2004-20230220-es
Behavioral task
behavioral11
Sample
Crafty-v1.1/runtimes/linux-arm64/native/libHarfBuzzSharp.so
Resource
win10v2004-20230220-es
Behavioral task
behavioral12
Sample
Crafty-v1.1/runtimes/linux-arm64/native/libSkiaSharp.so
Resource
win10v2004-20230220-es
Behavioral task
behavioral13
Sample
Crafty-v1.1/runtimes/linux-musl-x64/native/libHarfBuzzSharp.so
Resource
win10v2004-20230220-es
Behavioral task
behavioral14
Sample
Crafty-v1.1/runtimes/linux-musl-x64/native/libSkiaSharp.so
Resource
win10v2004-20230221-es
Behavioral task
behavioral15
Sample
Crafty-v1.1/runtimes/linux-x64/native/libHarfBuzzSharp.so
Resource
win10v2004-20230220-es
Behavioral task
behavioral16
Sample
Crafty-v1.1/runtimes/linux-x64/native/libSkiaSharp.so
Resource
win10v2004-20230220-es
Behavioral task
behavioral17
Sample
Crafty-v1.1/runtimes/osx/native/libAvaloniaNative.dylib
Resource
win10v2004-20230220-es
Behavioral task
behavioral18
Sample
Crafty-v1.1/runtimes/osx/native/libHarfBuzzSharp.dylib
Resource
win10v2004-20230221-es
Behavioral task
behavioral19
Sample
Crafty-v1.1/runtimes/osx/native/libSkiaSharp.dylib
Resource
win10v2004-20230220-es
Behavioral task
behavioral20
Sample
Crafty-v1.1/runtimes/unix/lib/net6.0/System.Drawing.Common.dll
Resource
win10v2004-20230220-es
Behavioral task
behavioral21
Sample
Crafty-v1.1/runtimes/win-arm64/native/av_libglesv2.dll
Resource
win10v2004-20230220-es
Behavioral task
behavioral22
Sample
Crafty-v1.1/runtimes/win-arm64/native/libHarfBuzzSharp.dll
Resource
win10v2004-20230220-es
Behavioral task
behavioral23
Sample
Crafty-v1.1/runtimes/win-arm64/native/libSkiaSharp.dll
Resource
win10v2004-20230221-es
Behavioral task
behavioral24
Sample
Crafty-v1.1/runtimes/win-x64/native/av_libglesv2.dll
Resource
win10v2004-20230220-es
Behavioral task
behavioral25
Sample
Crafty-v1.1/runtimes/win-x64/native/libHarfBuzzSharp.dll
Resource
win10v2004-20230220-es
Behavioral task
behavioral26
Sample
Crafty-v1.1/runtimes/win-x64/native/libSkiaSharp.dll
Resource
win10v2004-20230220-es
Behavioral task
behavioral27
Sample
Crafty-v1.1/runtimes/win-x86/native/av_libglesv2.dll
Resource
win10v2004-20230220-es
Behavioral task
behavioral28
Sample
Crafty-v1.1/runtimes/win-x86/native/libHarfBuzzSharp.dll
Resource
win10v2004-20230220-es
Behavioral task
behavioral29
Sample
Crafty-v1.1/runtimes/win-x86/native/libSkiaSharp.dll
Resource
win10v2004-20230220-es
Behavioral task
behavioral30
Sample
Crafty-v1.1/runtimes/win/lib/net6.0/Microsoft.Win32.SystemEvents.dll
Resource
win10v2004-20230220-es
Behavioral task
behavioral31
Sample
Crafty-v1.1/runtimes/win/lib/net6.0/System.Drawing.Common.dll
Resource
win10v2004-20230221-es
Behavioral task
behavioral32
Sample
Crafty-v1.1/runtimes/win/lib/netstandard2.0/System.Security.Cryptography.ProtectedData.dll
Resource
win10v2004-20230220-es
General
-
Target
Crafty-v1.1/runtimes/linux-x64/native/libHarfBuzzSharp.so
-
Size
1.5MB
-
MD5
b706a61c448ffe33f4781b2570eaef90
-
SHA1
b6b4c66bcac83fa61c0f462a4f634d93733a5d1a
-
SHA256
2779e29d004287bc140446f2173c23fe22540e22404b99cc5c61749b892d3b59
-
SHA512
c6be9fba318b3863c024b8caca5ac68329c2d1aa8b7c81c053ee82e7082b2b96d898f4abac8bf96089a5226c216442b682827388e6d26c42094d343ab9691052
-
SSDEEP
49152:4oj837i/1PPsQQaCcbktFK1sEgHLyGInq1VlhAJfY1H0newnUcN8Slx00KSNGrEB:39nsVlhAJfY1H0newnUwxK
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 1768 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Crafty-v1.1\runtimes\linux-x64\native\libHarfBuzzSharp.so1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx