Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows10-1703_x64 -
resource
win10-20230915-en -
resource tags
arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system -
submitted
21-09-2023 16:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
crack jordanX.exe
Resource
win10-20230915-en
windows10-1703-x64
15 signatures
150 seconds
General
-
Target
crack jordanX.exe
-
Size
5.9MB
-
MD5
f6019eccee4932eff045d4f00c9ac13a
-
SHA1
71f5601a7191b72d68189493896075189fe1efbe
-
SHA256
51350034de2aa39cc25c628a5d94736585624e0abe2d4896a521f0f137e8bce3
-
SHA512
a524a3e1457064427dfc3af243a6be8f8a7d98cc77531b4aafcaff2626dd6c565d1d42a9f8de445bb9ed4c8e60dff45cfd22e878740ba2b6b775636acc6cb7ae
-
SSDEEP
98304:E3r3P5N5KAGIZ3bFO3f5XtvPoRJRGoXgX9tttcGighIL7JxKDiRIU53zvqWlrL7v:E78O83f5Xt3oRJRGpUGigeKiIU5bxd5t
Score
10/10
Malware Config
Signatures
-
ElysiumStealer
ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
-
ElysiumStealer Support DLL 1 IoCs
resource yara_rule behavioral1/files/0x000700000001af89-5.dat elysiumstealer_dll -
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "0" crack jordanX.exe -
Loads dropped DLL 1 IoCs
pid Process 3364 crack jordanX.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\Logs\Runtime.MSIL.1.0.0.0\cc.dll crack jordanX.exe File created C:\Windows\rescache\_merged\4183903823\810424605.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\3877292338.pri taskmgr.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1248 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies Control Panel 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000\Control Panel\Desktop\AutoEndTasks = "1" crack jordanX.exe Set value (str) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000\Control Panel\Desktop\HungAppTimeout = "1000" crack jordanX.exe Set value (str) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000\Control Panel\Desktop\MenuShowDelay = "0" crack jordanX.exe Set value (str) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000\Control Panel\Desktop\WaitToKillAppTimeout = "2000" crack jordanX.exe Set value (str) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000\Control Panel\Desktop\LowLevelHooksTimeout = "1000" crack jordanX.exe Set value (str) \REGISTRY\USER\S-1-5-21-1137129745-4190849146-4270886183-1000\Control Panel\Mouse\MouseHoverTime = "0" crack jordanX.exe -
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\Copy To crack jordanX.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\Copy To\ = "{C2FBB630-2971-11D1-A18C-00C04FD75D13}" crack jordanX.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\Move To crack jordanX.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\Move To\ = "{C2FBB631-2971-11D1-A18C-00C04FD75D13}" crack jordanX.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 2652 taskmgr.exe 2652 taskmgr.exe 3364 crack jordanX.exe 2652 taskmgr.exe 3364 crack jordanX.exe 2652 taskmgr.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 2652 taskmgr.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 2652 taskmgr.exe 3364 crack jordanX.exe 2652 taskmgr.exe 3364 crack jordanX.exe 3364 crack jordanX.exe 2652 taskmgr.exe 3364 crack jordanX.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3364 crack jordanX.exe Token: SeDebugPrivilege 2652 taskmgr.exe Token: SeSystemProfilePrivilege 2652 taskmgr.exe Token: SeCreateGlobalPrivilege 2652 taskmgr.exe Token: 33 2652 taskmgr.exe Token: SeIncBasePriorityPrivilege 2652 taskmgr.exe -
Suspicious use of FindShellTrayWindow 44 IoCs
pid Process 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe -
Suspicious use of SendNotifyMessage 44 IoCs
pid Process 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe 2652 taskmgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3364 wrote to memory of 1292 3364 crack jordanX.exe 70 PID 3364 wrote to memory of 1292 3364 crack jordanX.exe 70 PID 3364 wrote to memory of 1292 3364 crack jordanX.exe 70 PID 1292 wrote to memory of 1248 1292 cmd.exe 72 PID 1292 wrote to memory of 1248 1292 cmd.exe 72 PID 1292 wrote to memory of 1248 1292 cmd.exe 72
Processes
-
C:\Users\Admin\AppData\Local\Temp\crack jordanX.exe"C:\Users\Admin\AppData\Local\Temp\crack jordanX.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C sc config "RemoteRegistry" start= disabled2⤵
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\SysWOW64\sc.exesc config "RemoteRegistry" start= disabled3⤵
- Launches sc.exe
PID:1248
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2652
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD594173de2e35aa8d621fc1c4f54b2a082
SHA1fbb2266ee47f88462560f0370edb329554cd5869
SHA2567e2c70b7732fb1a9a61d7ce3d7290bc7b31ea28cbfb1dbc79d377835615b941f
SHA512cadbf4db0417283a02febbabd337bf17b254a6eb6e771f8a553a140dd2b04efd0672b1f3175c044a3edd0a911ce59d6695f765555262560925f3159bb8f3b798