Analysis
-
max time kernel
121s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
23-11-2023 02:38
Behavioral task
behavioral1
Sample
EntropyCrack.exe
Resource
win7-20231023-en
windows7-x64
Behavioral task
behavioral2
Sample
EntropyCrack.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
main.pyc
Resource
win7-20231023-en
windows7-x64
Behavioral task
behavioral4
Sample
main.pyc
Resource
win10v2004-20231025-en
windows10-2004-x64
General
-
Target
EntropyCrack.exe
-
Size
17.7MB
-
MD5
dc87c0195358b499111717553896bf11
-
SHA1
5799afcd8103f826eb85737a4de083a0aab131ed
-
SHA256
ad671181b60d2cd470b1fab2ac88abd95a1daaa235eb01711be705fc59f1fce5
-
SHA512
2d556d84581f39728bed2e3d00b945d8d42466e53915f8fae278210852122312e2b709a1aa9a962dd4b89b5214251a14cce53b191c6ffa598a6d73a117d48f13
-
SSDEEP
393216:mqPnLFXlr8gQpDOETgsvfGz3gK1ctvEgNadLKq:LPLFXNlQoEaD1cCdB7
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2840 EntropyCrack.exe -
resource yara_rule behavioral1/files/0x0005000000019cfd-111.dat upx behavioral1/files/0x0005000000019cfd-112.dat upx behavioral1/memory/2840-113-0x000007FEF6430000-0x000007FEF689E000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 592 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 592 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe 592 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1748 wrote to memory of 2840 1748 EntropyCrack.exe 28 PID 1748 wrote to memory of 2840 1748 EntropyCrack.exe 28 PID 1748 wrote to memory of 2840 1748 EntropyCrack.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\EntropyCrack.exe"C:\Users\Admin\AppData\Local\Temp\EntropyCrack.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\EntropyCrack.exe"C:\Users\Admin\AppData\Local\Temp\EntropyCrack.exe"2⤵
- Loads dropped DLL
PID:2840
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:592
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD569d4f13fbaeee9b551c2d9a4a94d4458
SHA169540d8dfc0ee299a7ff6585018c7db0662aa629
SHA256801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046
SHA5128e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378
-
Filesize
1.4MB
MD569d4f13fbaeee9b551c2d9a4a94d4458
SHA169540d8dfc0ee299a7ff6585018c7db0662aa629
SHA256801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046
SHA5128e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378