8f19212929974aa01856c9eb70644c8045caa3a05a4c405badc5907a6c57d43d

Analysis

max time kernel
132s
max time network
133s
platform
windows10-1703_x64
resource
win10-20231215-en
resource tags

arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
submitted
11/01/2024, 18:09

Target

Crypt.exe
Size

85KB
MD5

0f49d1500905a9a63ed8e902e442cbad
SHA1

a8f3bdc69d5ace9d8693c86213eed4a0eb9efefb
SHA256

8f19212929974aa01856c9eb70644c8045caa3a05a4c405badc5907a6c57d43d
SHA512

959419ec87ae463cf4f50a28048f10865b551616c11969172ebb3faf860141d8f57fb4842bb7d6480c0706d1fa873129b4a3d2d44d1dab782f7cf96037438edd
SSDEEP

1536:mkcOTzQeFz0Hr2xWmhhXXS1F9R/LeChbuUNSTpAMO3anyFM6Gu/uNUv1MeHffFUr:mkZTJFz0Hr6XhhHU3peaSMSy13LF7Gu+

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/312-0-0x0000000000F70000-0x0000000000FA8000-memory.dmp	upx
behavioral1/memory/312-1-0x0000000000F70000-0x0000000000FA8000-memory.dmp	upx

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1364394410-760759377-2797241167-1000_Classes\SystemFileAssociations	Crypt.exe
Key created	\REGISTRY\USER\S-1-5-21-1364394410-760759377-2797241167-1000_Classes\SystemFileAssociations\.cs	Crypt.exe
Key created	\REGISTRY\USER\S-1-5-21-1364394410-760759377-2797241167-1000_Classes\SystemFileAssociations\.cs\shell	Crypt.exe
Key created	\REGISTRY\USER\S-1-5-21-1364394410-760759377-2797241167-1000_Classes\SystemFileAssociations\.cs\shell\CustomCrypt\command	Crypt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1364394410-760759377-2797241167-1000_Classes\SystemFileAssociations\.cs\shell\CustomCrypt\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Crypt.exe\" \"%1\""	Crypt.exe
Key created	\REGISTRY\USER\S-1-5-21-1364394410-760759377-2797241167-1000_Classes\SystemFileAssociations\.cs\shell\CustomCrypt	Crypt.exe

C:\Users\Admin\AppData\Local\Temp\Crypt.exe
"C:\Users\Admin\AppData\Local\Temp\Crypt.exe"
1⤵
- Modifies registry class
PID:312

memory/312-0-0x0000000000F70000-0x0000000000FA8000-memory.dmp

Filesize
224KB

Download
memory/312-1-0x0000000000F70000-0x0000000000FA8000-memory.dmp

Filesize
224KB

Download