Analysis

  • max time kernel
    60s
  • max time network
    43s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    18/07/2023, 15:28

General

  • Target

    CraxsRat.exe

  • Size

    41.8MB

  • MD5

    13f7a89150f4d9014cc361333a11fda4

  • SHA1

    9ec23eead82b5407507f954f8246813467d1ee2e

  • SHA256

    4224619bd0192263ebc4fe70e1eef9bd3482ece592b20928680e281d8c58cda6

  • SHA512

    f747ad818a34ae3bdb45e9315b229738384fc72fa95f68826bfafe91771f495a18f07d8f418825fb49a07209bb2f017682035ef3d6db15843a040b908ce06db3

  • SSDEEP

    98304:r7fTTykeqo9xUZJkaOFPL7UcnFjBJvdg+2NVCCvdM2V51:r7fYzU8lF/UcnFjr72vNlHt

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Detected potential entity reuse from brand microsoft.
  • Drops file in Windows directory 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CraxsRat.exe
    "C:\Users\Admin\AppData\Local\Temp\CraxsRat.exe"
    1⤵
    • Checks computer location settings
    PID:1916
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
    1⤵
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3812
  • C:\Windows\system32\browser_broker.exe
    C:\Windows\system32\browser_broker.exe -Embedding
    1⤵
    • Modifies Internet Explorer settings
    PID:3296
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1240
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3084
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies registry class
    PID:2720
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    PID:3244
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    PID:4984
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:3432

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TKY5VT23\edgecompatviewlist[1].xml

    Filesize

    74KB

    MD5

    d4fc49dc14f63895d997fa4940f24378

    SHA1

    3efb1437a7c5e46034147cbbc8db017c69d02c31

    SHA256

    853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

    SHA512

    cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\P5HUAGPV\favicon[1].ico

    Filesize

    16KB

    MD5

    12e3dac858061d088023b2bd48e2fa96

    SHA1

    e08ce1a144eceae0c3c2ea7a9d6fbc5658f24ce5

    SHA256

    90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21

    SHA512

    c5030c55a855e7a9e20e22f4c70bf1e0f3c558a9b7d501cfab6992ac2656ae5e41b050ccac541efa55f9603e0d349b247eb4912ee169d44044271789c719cd01

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\ImageStore\2y31ue2\imagestore.dat

    Filesize

    17KB

    MD5

    17029088d0b9ec48c056a86c3cde5a78

    SHA1

    f93e25cdb5facd762f03ee4b7957dc4b15ba7751

    SHA256

    ba50acc1ff2311a78604dc20ce9f3f34ae5556c845d389fa133342814ffd52eb

    SHA512

    8fab9a9b23d74dfd660687749147f418ead3c6ee0b00c7242c8a30471a262f2fbf2de16e1aefebd2e04eff90091141f22c0fb40242c531b793c3681bd7c43f35

  • memory/2720-242-0x00000200A3680000-0x00000200A36A0000-memory.dmp

    Filesize

    128KB

  • memory/2720-184-0x000002008DAD0000-0x000002008DAD2000-memory.dmp

    Filesize

    8KB

  • memory/2720-187-0x000002008DAF0000-0x000002008DAF2000-memory.dmp

    Filesize

    8KB

  • memory/2720-251-0x00000200A4140000-0x00000200A4142000-memory.dmp

    Filesize

    8KB

  • memory/2720-256-0x00000200A4160000-0x00000200A4162000-memory.dmp

    Filesize

    8KB

  • memory/2720-259-0x00000200A4190000-0x00000200A4192000-memory.dmp

    Filesize

    8KB

  • memory/2720-181-0x000002008DA70000-0x000002008DA72000-memory.dmp

    Filesize

    8KB

  • memory/3812-121-0x0000025423120000-0x0000025423130000-memory.dmp

    Filesize

    64KB

  • memory/3812-281-0x0000025429C50000-0x0000025429C51000-memory.dmp

    Filesize

    4KB

  • memory/3812-282-0x0000025429C60000-0x0000025429C61000-memory.dmp

    Filesize

    4KB

  • memory/3812-156-0x00000254232E0000-0x00000254232E2000-memory.dmp

    Filesize

    8KB

  • memory/3812-137-0x0000025423500000-0x0000025423510000-memory.dmp

    Filesize

    64KB