Analysis
-
max time kernel
135s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
18-02-2024 08:54
General
-
Target
xone.crack.rar
-
Size
1.7MB
-
MD5
2296fb98f59c1838a2d0be321d48d75a
-
SHA1
dfd35f27d572c07d55bef988dc2e039d47315f47
-
SHA256
841f53fc09a19fc5edd5e18ef724432e14abadbd3aa040c248b2daeb84c98ab5
-
SHA512
1bd577a3340281bed1c1cde6ee65eae31f11994e67fa7a594fecef6d31e36589ff495d46a8daff41ae15f185fbefd88c49d8042ca8ed0d536f4bd868bef8ebf6
-
SSDEEP
49152:UWm6d5sOY8JFCXBqKkcKdJKG900cMfx3J48HTWronskPZ:06rsECXmcysGGUfJ6QT1R
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 26 IoCs
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\xone.crack.rar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\xone.crack.rar"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\Desktop\New folder\xone.crack.exe"C:\Users\Admin\Desktop\New folder\xone.crack.exe"1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\pcwrun.exeC:\Windows\system32\pcwrun.exe "C:\Users\Admin\Desktop\New folder\xone.crack.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\msdt.exeC:\Windows\System32\msdt.exe -path C:\Windows\diagnostics\index\PCWDiagnostic.xml -af C:\Users\Admin\AppData\Local\Temp\PCW4E8D.xml /skip TRUE2⤵
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\sdiagnhost.exeC:\Windows\System32\sdiagnhost.exe -Embedding1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0rdmmplg.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES55CF.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC55CE.tmp"3⤵
-
-
-
C:\Users\Admin\Desktop\New folder\xone.crack.exe"C:\Users\Admin\Desktop\New folder\xone.crack.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3052 -s 2682⤵
- Loads dropped DLL
-
-
C:\Users\Admin\Desktop\New folder\xone.crack.exe"C:\Users\Admin\Desktop\New folder\xone.crack.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1900 -s 2682⤵
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD559ee017e084de75e3be6a060451979e5
SHA159d13ec5721f3d494ca9657fa568c5c04dde4d8c
SHA2565bbd33340155ff258423b04999eaa588e00b50cc874eabf546e7b7f8faed310b
SHA51256f490b6176f15a61515098587d2944d41e7fa5249569f294cbbb4d2414595226f23a6fbd9cdd14ca379aded3bcaac726c4066fc62c1c1a1eee087e54d07ad74
-
Filesize
4KB
MD59b6b53167456189adc2962c30ede40be
SHA109cd80d0552657e44031ed7d4cb992fd872eb645
SHA2563bdf77941a8deb3aa3a7350ae9aaf5a0f1f682f319fad9dd35d00772c5911154
SHA512828b13fd3f522f2331c7f43d915a4d22e80b87940b09aa3f0ee5e0f0f217a7505eb405834950d844c2613d362d9876539109095f4d17527254a8836f8c9b66dc
-
Filesize
11KB
MD52b7a232a9f8f7e82c46795e90c702604
SHA1613af61870e432b1c21f032c2afa0c3aa62bcfb4
SHA256da3a01593bf44699572d599e243fb841f962502a48398c96192aca3dc1becfcd
SHA51229d2909c2fb8f9f25103974584d4d7ad8cc3c38127febec20d6f626c376232403afa0183da088d8e3537612fad496dc2e9cb6392577ecd96921868b46bc089b0
-
Filesize
736B
MD5cb367c2edf9069ee02e87b37d04f04f6
SHA115b88c213afcbd815b88fbe44ecd012612d8a96f
SHA25676a019db978388dbd26fb6cd1796a96172760653f2726474d1a59a24ca220498
SHA51236044fba1ade5e3095596c17ac2367a9d552ddc07589d110a0cb4b08ac19d1885d93a14156d22923cddc96137c3398fab5753613dc921f7aa1633d49f954b968
-
Filesize
1KB
MD5a019959365cc45e27c0391bad8b845cf
SHA181621cd4c817ddf20fe5b89ad7b6f02efb593cc6
SHA25661332b033f2d73fbc1ce44daae2cc4695c179fc2c127197b1111de60aa458875
SHA5124e7e776c0137adb41c048a9ef0e335c802427ffe0a6dda0e2bc476d070fba18ac1ceead7941674db1cc6e754075111c5cf7e8150c189f1d1762be4ba8b85f0bc
-
Filesize
334KB
MD5dacaf98050c89eb0713913d4472cb0e7
SHA1f408c4497d6c0f16f3eadc7daa962759ff889b5d
SHA256c41dc6ddedc335b439300b6b4dc0b10b04beab0dc4fa9689dc1ea739c53b5064
SHA5122dd661967c7a4d349c179bd40652e0c92da3c91207bc261a8d393d212ba45481a730137c1ed2b5c7351bcaae45e84e8474d5ef7548b193ea9e23c6e50ff1b161
-
Filesize
193KB
MD52aa854d6ed64e17fe90c439e0de0196f
SHA14a7fe453c2f5e43ba670da6c47a0cfd3b374832a
SHA25656c2f3475c4d2c2fa33fa5d172e77450dce511a105d1a3179f05b01a59aa5e24
SHA51294da00d038025f8dd03ab7b6204035678d068145297f2650d4431fb96e069bd90efe7e3d5067688ac1eb4bf644754e57eb699e36c6c0fdb374e74182585f80df
-
Filesize
1.9MB
MD550892c4677cd1a02705574ec82197655
SHA141663ee90bdf2d7c11590f59fae2f295e0626eb2
SHA256ebe9598b5519d019f9617e15f97cae13a60ba37ec076b29280a89c9b2c77bed6
SHA5126e4c902bea9808194d6d5b1758e1a45c5b385eb41f40dbef69d440125e7547eda25f8d1fae052a37688719316f70e1d2f34d8ee311235b13d75c5c7eaf55b590
-
Filesize
581KB
MD5c4efb9a3821ec80d6675fe42cf6e1221
SHA150901ff227296d003eda4460669e855e09fc80e5
SHA256660414e31c51ffd3012846d3375df1ab7facf364459ae2e8d29d40f205a87f5b
SHA5123c7593f820db5b86bce6fc63f455168d3bc53a77fb8d746077f2d64149c51c47880848662aa6a0e2ad10c2a95820105248ba2e8037bc1fe8ad16e4e8ce7e0210
-
Filesize
9KB
MD546e22c2582b54be56d80d7a79fec9bb5
SHA1604fac637a35f60f5c89d1367c695feb68255ccd
SHA256459af2960b08e848573d45a7350223657adb2115f24a3c37e69ffe61dea647f9
SHA512a9a24df3fb391738405d2ea32cd3ef8657d8d00d7366858a39c624dc9ebbf0b64d2817355d41eed6ad3cc7703d264d2921c8a2590ff95601d89f3cca72ba786f
-
Filesize
6KB
MD55e03d8afb0fae97904a14d6b2d1cac9a
SHA178f401b1944ed92965d7a48dba036413688f949a
SHA256538a5f22a12b0be59a7a83e0381c6ff661932f07643a87c2d3a542eade741671
SHA512884c0494728dd9f1a4fc8092152b2253350304b745d6fc1e4b02c9cd2366bc8c92a169c549cd77bcd67e5e2e515d89d46c1d11de5eeb500d531d87839365cd19
-
Filesize
64KB
MD5e382ec1c184e7d7d6da1e0b3eacfa84b
SHA19a0d95eb339774874f4f0da35d10fd326438b56c
SHA256786d95dc0d59089e14055385cce8765888f55236b5220fdfd28cf2d9b07e63ee
SHA512019bcb4f41b5bc5853db2fa528ef126e839c5b0d0dc096dd441ba02d8c71e7913efd16b74aed93952ad2cc5422b151c12d3017fc22a65ae5ce2e7e1fc72a396c
-
Filesize
8KB
MD5526bcf713fe4662e9f8a245a3a57048f
SHA1cf0593c3a973495c395bbce779aef8764719abf7
SHA256c8190f45d62c5c03013ffc66b3f9bf60f52a32464fa271d2fad5fd10432da606
SHA512df7e93617461c2fd25b5b684311126e66b7cf9f1ecfbf4c8a944f65fb2c904194ec635a9c7b962d4583ea77b0312435c7dc1b5ecbcb1fb3a5a74fc1eb2c21d04
-
Filesize
965B
MD5b0dc59b099ca7c12fb8ad72d3c50c82c
SHA1f19e28849921cf51e322824c5a8ae8bc00014cd1
SHA256e75eaaa3d7908fb05000c0a957048d20091a0d2575e87d091d11cdb3a5b562e5
SHA512852c937d36afe3b6df5826b9f1877d511259e2a0ffcdf229c8c655ced7346b36e526928537386121e3ecbc8b1285144dabe3b760db1873cb3baaf70a0f21c364
-
Filesize
309B
MD5f398e7d59167261ceac4c5246499730f
SHA1a9c6a20dbc1a1b2a761e07ffacbe73af3ec3eb6e
SHA25657dafd962466de03ceb0521ecd1cf88e53c58f1b1dc5f1be88e118b9a10bc1c3
SHA512b6bf36deede17b9bbbfbb0cbce3c2ce3b3f9b3545703fe875e6c0464e4b25a14ac5089d4277b70cd8318625d32111d2ac7443b8d0fe6461d11d0e9a4a06910bf
-
Filesize
652B
MD5874ef05df47d6bec5bd48ae3389e98a0
SHA1cf84c7442937ee2aa5c8e6ad1db0f0fc6aacd59f
SHA256bfa8f34c5180e72d0a731d54ef1eaf5e991a906269b4612f012a24e70eb6e20c
SHA512409ddf9639a416412c187d6dad128319901133b90915fbe4a81b6c18e451430f6df8a43369a16ffbef9f75c38801a0ac342affdcf3a0f787df502f8a4196cfa6
-
Filesize
279KB
MD533670e169a4507451a3be3f937381109
SHA1cf2cad3dcc40b2822d1cfd29336a22a99f757699
SHA25626b281a9657fd36a229b5aa8d404b477017e14407845da5da4a49546ab3c2eae
SHA51271ea470921c527b1ed23420d9ab0e0dd5cc71590a00de5c3dc915627f4121fdab01cce6297f0aa8bd3fcfb3fc37b8c77a7f249b8bae4514cd7253bb9a4edd37c
-
Filesize
399KB
MD5def0b303d62c9aee265bc22c0b90bbf3
SHA1b643ffad5fdcec22b07346c2bab252e39c1ffd24
SHA2564fc4a341179caf38abc7c45ea7791db31f55baa06e4e68f1204157655bd81dde
SHA5121137176e4aff6c965f65f260f40f0b59a8ef577401e1e5e51b90e78ea49d1a50f8f14e6503a45806f69eb35799383b60107b62ca03d1cdc494c2a2a30116bcdd
-
Filesize
384KB
MD51732cc9804d90eb81fa2240f9365f381
SHA17661806fdc9fcba6d7b22152f74e3787aa2530ba
SHA25695eff20b3bb897af6f68938cfb3ccb9c438fb119bad8ecb597802197457853e9
SHA5128545f772caf5e34c7943816d99bae2b33578fa60ecc79ae20fd39f6572c3c35d363f1b078deada69b2f4dd3d70ce17861be734a46f83e2a79de244ebfa4c376f
-
Filesize
205KB
MD500a24fe2ad7390feb194f3dfb2404497
SHA1334a4406d3e6fbe2cc12015f17040f3701d9c82d
SHA2569397fa1eefc58e6ced58c9936a5449ae49b32b03a28e1212240511b074f3fe3a
SHA512fd7fce0e07ee1d1ffe1d2e6eec0c9ef3079e63470031f8ee63e64857f52ccf7efc859080cc6e51c5fda2eccd6a106d0b57486cd11231888cfaac286ae0fa09a0
-
Filesize
320KB
MD518c3b7c90eeb82724afcdaae569125a3
SHA1c1b5998de5b5780fb62459991537bb2b9171f9cf
SHA256b907a4697a60e5ffece0bbf8d73cb8d54e901a8a581da4e87d8808532eb180ca
SHA5123e7efe6daea60ba8e26ff41e15a5172605489d3a0ccc2d150fbb86105b159a90cb6a5427576c1707042c768964061b915b9267187bee3c8b2a3ff1b413b14fcd
-
Filesize
1.4MB
MD5b0424e78c59e1f4057d66313d87aaff6
SHA1d578706c74bfdffe587a4623160e967c29374abc
SHA25696a340973495ad711e4b427df17f8a66cc831e583c0f75263e61eb92dd6cf098
SHA5129010bf249d05989c62da1a6a5f1a7eeef5a0a1b308eee4194f423d99e6703ba181b042e6ed125a769cc85ffd6e2951b5de56cb7259068d7ddd618db8497b5023
-
Filesize
1.6MB
MD5faf411505a84adc97150cb7259f77d5a
SHA14efe9c25edbf76b8e0d77d1e5ca9d131b8a7d67a
SHA256b30bdbc02098c62e9b46cc64a321560e291ab7f3d1bfbb44364e2211c469835d
SHA512362a750aaadcd1caf44a099b9906aab343eb85054e3faf7db65aded0cf9e0f646cf207014962950262d316f36c7d67391b177c41c2fb2da8c0461e3cdfae3755
-
Filesize
538KB
MD55380adfea71fefb23d5575c737e6859c
SHA157385af146289106efa61d3c09704574029c65db
SHA25671e3f873255f3a4c010daac52d5c66e72dc87bf34c418caeeec5ea07b0a0cd09
SHA512ce6baabbda92c60970ebd82dd5e780813d1ddee698920b5625691c8e12d69e490f936232c0bfc7809e4fb449205d5698168490f5635525b13fcb231a00d450b9
-
Filesize
531KB
MD5d8091d530b1ee6975cff3f72bafcf944
SHA16c8474c71f1911d9f1aa5842b34df75352e3458c
SHA256b010b190c856bd87dda62a05bc8def1289855e97db0def99671dae5cd07c439e
SHA5121b39eb10f40e48685964c5465ced20d3ca4a2c16bccdd2f8bd916f077973ddc19ca7fa54760b61cb288045fd36b3492646f9c53178a294aa6e84a7ac9b53c833
-
Filesize
653KB
MD5d9f49e49a422f1b5a029e532323f25a6
SHA1d3a281e2354e689b1d3170a9a307e5ab98580bf1
SHA25669e2d9261a6f200a9ec3fd7959cff0091ed45ddbed183296984546cb82c73384
SHA512cb12abe28f7b1e47d944945a9b053e0e273d8665d8c752f9171999e996a1296702616412fa8785f0a3db0b1e249e3d004faa2f6cb583ff195bc72ed1744e017d
-
Filesize
551KB
MD535347ee5dae43e0149b754516cc40938
SHA11bae9fdecac264c8c795f5c2fbc6f99cbf5cbf52
SHA256fd51ce75fbf0de2f4852a3a8f4d697a58e3a0553a35344b4a42a32ab545799cf
SHA512df8c688a1695026b0cae4147b2e8723dd6d9fb32e97c342cde55668f8ade7f01b2db06d2dec0fef82eed05827438faa564b37918537072585ef4a6b92a81dcf3
-
Filesize
182KB
MD5d27af78e184236ffd1f782ce4a66585b
SHA1328f548dc63ffd3a3ee3c6c4f9a2aeda554f8792
SHA2560a1744c0493584ff19298c391bddf31ea291c3c57cf2ca845d2daa6e192c5038
SHA512b4b51e69f1cedc2e248f5ca51cc311bede023d99ecb1a8cac61d6a06265ea0fc24556e6ae9695187c01d2c781987e973f837612902013646d0aed30772aa3924
-
Filesize
3.0MB
MD5f30a440ee9e7712c24b116c0d6fb6b65
SHA188c762631d6a992488aa14ceb8c889bdff641ba2
SHA256e9a8db51562b17189f48daa561d23c3f439d5867b5fae6ec44bf2d1b883239a7
SHA512f2b17e88a0a5062adcf943601657486e7e18b6602df9c81358816351501d39100deaffa304bcc215da289a251b6fcb3bb397b38b5ee2563349c834d4f1350f0a
-
Filesize
2.7MB
MD5dd0f86f694f8091f9de610a6e25f6637
SHA1d651daef70ee91b8e8eb918119914feeaaea453e
SHA25684448bdaa8d74ef88a8ef4e9982cca9d68fd87c83a472525da212e5ec461066f
SHA51243995ae27134593697cfb21311caeadc507ab479049bbbffbdcd535e5b57816dbb458b2dab3f64d8cc4664101e5c343551ad88c82420c45ffca2c96b2a074220
-
Filesize
591KB
MD50c7fdd36aec07a5775d31cd80159ccb5
SHA186e5992ab8b149b0567796e1a0213abb95bf3128
SHA256d6583404035b1b4693aeec319a4dea68e83f7fcea989223b8a31b44b857570e1
SHA512456230cb58a3e24eb2501be2d63b8999973a8ce58e9c0ffa8f0723b8dd7b435b6c8f1e97dd947adc22755e87eb6d45e5f441ba444ca3aeb7e3c26a757fda3b36
-
Filesize
4.3MB
MD5d8ce4ef56ff10aa1a9625d76509993bc
SHA1a032f36290695d1f8f744d188d025993d62b1dab
SHA256ab714198bd03a5b9577fe4f974f08eb8bc4d63de51ace8964f2dbc279c1c2f86
SHA51284f2f1e205f90b2c48304481f300c7dd171a59f9f2fdbae00279578aae2164e0db162c78d75024779064728f47e98de49a67a9d6b5b14e80f1d650b8c11d9e83
-
Filesize
2.8MB
MD5caf60adca4dd5703b3b27789f438e795
SHA12eda596c209b0cf242763926ce6547f9b621dc59
SHA256816f832e1479831810406eea3747f46126f115c89a34496086379a01531f0a16
SHA5124171e2e74e3c26a5daeed7093c840c1600e2921a9871b91641c5536aa55b57054b8b7c575d95bdf5d60aa619a1f138243dff05fc8bca185b8ea903fe17ebf08c
-
Filesize
3.0MB
MD574430ffaba5d087e27bfdd2db07b5031
SHA1fba42b0bb186749ce290eeb332f83eca103f6a4b
SHA256e609de57b809b1587845a0caa0f4c72b88f9c2016665295dfab3dd4e559777db
SHA51251aaf3ecc2514db2080217ce3b8ff6a8dc8d112c8cb2eba3aaa5b9fe940d353d5b6bc40018171b710fc6ab502a858ee31de115c3f88d854f9d3a000294b8b4af
-
Filesize
1.3MB
MD5a99737760a5d89d4e305e8a260a5b2b6
SHA1434838f00d4bad8e6297f41851338d76e956bd77
SHA256f96097ab084540d75ad1dec2576ce605d0396873babbf378c74d6149813365c5
SHA512f0a90ada0729b3afc1d62a7ff7301184f387df2b8cd07355394a3e71a050eb8b7a973ccd16d4755133a0e4d9f77ecc38a8bf79b905f00aa28ea8184f2463dd46
-
Filesize
2.3MB
MD55fd265f07c4bbf29665266fb20b7b6bb
SHA16c41ef0c42111563a518792eb8beea00ef2f1145
SHA256ee9cec5cbc7f6035d2d87b232519d9dc344d8ab8c398610afcbc83b2597c6f37
SHA5129d263c6c000407b8530b2a5eba42d34ed793fcc3caae0cd2a3ef12b803a71dc38f1d122378efbccbb00f20ccc212ab3fab6e2b9b077c6d886e824e38dc27b294
-
Filesize
2.2MB
MD5ada5811be7aedd34784300dab0284bde
SHA1b66937699c08a02415f3b3b2f9f26cfa85fae013
SHA2567ff639030ae3ce7f0855cb8fcc83a07a1d4f284d47cb1c1e2ee04aae4ca54e47
SHA512110b940a8fca5a83cc9214035e9270054ec4c9a1810cc4268dae5f4adc2270caf44eedf85ea157fb2664cb704b1ffa149d647dd132e26fcfecc352d98f7c05ca
-
Filesize
531KB
MD5ba95329076d57fc8b4730d26b03da658
SHA11f915b3a4b7cfe5df4ebcb7d10cdd854144ae8b4
SHA256432387478da980bbffa185b8e98c22d85a7caac0730a6dcc5c332d37588c54e4
SHA512a8310cdbeadd3fc597bdb9167c4e466835b5cb9fa505184444577a311eef3293bf8a5bf733276b57555ee040c1fcafa53100a030721d72a7aa7383895d3af766
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
32KB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB