Analysis
-
max time kernel
89s -
max time network
84s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system -
submitted
01-03-2024 19:52
General
-
Target
CrxckrInstaller.exe
-
Size
296KB
-
MD5
dc1210b8ce592d38a6e6bbaac8d3f64c
-
SHA1
8b6ad187ee837db5e924a972943355ed1c82cb7d
-
SHA256
63a623df9e58f6705946b5473ab20fdad8dcdd93800b7ca8351fae0bf5c635ce
-
SHA512
c07c5f4543eb59282333f19c29b6eaaa76f003cb38da03969b7d73b0755619150d0d2b0b5c4bfdd045806e6cf54652ee10262b6aa465bc95b65735cce5ef176d
-
SSDEEP
6144:NloZM+rIkd8g+EtXHkv/iD4Ev9KiAfboixUyzzqtmb8e1mhi:PoZtL+EP8Ev9KiAfboixUyzzqov
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/4536-0-0x000002C58CB60000-0x000002C58CBB0000-memory.dmp family_umbral -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rescache\_merged\4183903823\810424605.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\3877292338.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
pid Process 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4536 CrxckrInstaller.exe Token: SeIncreaseQuotaPrivilege 3432 wmic.exe Token: SeSecurityPrivilege 3432 wmic.exe Token: SeTakeOwnershipPrivilege 3432 wmic.exe Token: SeLoadDriverPrivilege 3432 wmic.exe Token: SeSystemProfilePrivilege 3432 wmic.exe Token: SeSystemtimePrivilege 3432 wmic.exe Token: SeProfSingleProcessPrivilege 3432 wmic.exe Token: SeIncBasePriorityPrivilege 3432 wmic.exe Token: SeCreatePagefilePrivilege 3432 wmic.exe Token: SeBackupPrivilege 3432 wmic.exe Token: SeRestorePrivilege 3432 wmic.exe Token: SeShutdownPrivilege 3432 wmic.exe Token: SeDebugPrivilege 3432 wmic.exe Token: SeSystemEnvironmentPrivilege 3432 wmic.exe Token: SeRemoteShutdownPrivilege 3432 wmic.exe Token: SeUndockPrivilege 3432 wmic.exe Token: SeManageVolumePrivilege 3432 wmic.exe Token: 33 3432 wmic.exe Token: 34 3432 wmic.exe Token: 35 3432 wmic.exe Token: 36 3432 wmic.exe Token: SeIncreaseQuotaPrivilege 3432 wmic.exe Token: SeSecurityPrivilege 3432 wmic.exe Token: SeTakeOwnershipPrivilege 3432 wmic.exe Token: SeLoadDriverPrivilege 3432 wmic.exe Token: SeSystemProfilePrivilege 3432 wmic.exe Token: SeSystemtimePrivilege 3432 wmic.exe Token: SeProfSingleProcessPrivilege 3432 wmic.exe Token: SeIncBasePriorityPrivilege 3432 wmic.exe Token: SeCreatePagefilePrivilege 3432 wmic.exe Token: SeBackupPrivilege 3432 wmic.exe Token: SeRestorePrivilege 3432 wmic.exe Token: SeShutdownPrivilege 3432 wmic.exe Token: SeDebugPrivilege 3432 wmic.exe Token: SeSystemEnvironmentPrivilege 3432 wmic.exe Token: SeRemoteShutdownPrivilege 3432 wmic.exe Token: SeUndockPrivilege 3432 wmic.exe Token: SeManageVolumePrivilege 3432 wmic.exe Token: 33 3432 wmic.exe Token: 34 3432 wmic.exe Token: 35 3432 wmic.exe Token: 36 3432 wmic.exe Token: SeDebugPrivilege 704 CrxckrInstaller.exe Token: SeIncreaseQuotaPrivilege 820 wmic.exe Token: SeSecurityPrivilege 820 wmic.exe Token: SeTakeOwnershipPrivilege 820 wmic.exe Token: SeLoadDriverPrivilege 820 wmic.exe Token: SeSystemProfilePrivilege 820 wmic.exe Token: SeSystemtimePrivilege 820 wmic.exe Token: SeProfSingleProcessPrivilege 820 wmic.exe Token: SeIncBasePriorityPrivilege 820 wmic.exe Token: SeCreatePagefilePrivilege 820 wmic.exe Token: SeBackupPrivilege 820 wmic.exe Token: SeRestorePrivilege 820 wmic.exe Token: SeShutdownPrivilege 820 wmic.exe Token: SeDebugPrivilege 820 wmic.exe Token: SeSystemEnvironmentPrivilege 820 wmic.exe Token: SeRemoteShutdownPrivilege 820 wmic.exe Token: SeUndockPrivilege 820 wmic.exe Token: SeManageVolumePrivilege 820 wmic.exe Token: 33 820 wmic.exe Token: 34 820 wmic.exe Token: 35 820 wmic.exe -
Suspicious use of FindShellTrayWindow 29 IoCs
pid Process 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe -
Suspicious use of SendNotifyMessage 29 IoCs
pid Process 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe 212 taskmgr.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4536 wrote to memory of 3432 4536 CrxckrInstaller.exe 72 PID 4536 wrote to memory of 3432 4536 CrxckrInstaller.exe 72 PID 704 wrote to memory of 820 704 CrxckrInstaller.exe 80 PID 704 wrote to memory of 820 704 CrxckrInstaller.exe 80 PID 592 wrote to memory of 1856 592 CrxckrInstaller.exe 83 PID 592 wrote to memory of 1856 592 CrxckrInstaller.exe 83 PID 2192 wrote to memory of 2800 2192 CrxckrInstaller.exe 86 PID 2192 wrote to memory of 2800 2192 CrxckrInstaller.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\CrxckrInstaller.exe"C:\Users\Admin\AppData\Local\Temp\CrxckrInstaller.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3432
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\CrxckrInstaller.exe"C:\Users\Admin\AppData\Local\Temp\CrxckrInstaller.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:820
-
-
C:\Users\Admin\AppData\Local\Temp\CrxckrInstaller.exe"C:\Users\Admin\AppData\Local\Temp\CrxckrInstaller.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:592 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:1856
-
-
C:\Users\Admin\AppData\Local\Temp\CrxckrInstaller.exe"C:\Users\Admin\AppData\Local\Temp\CrxckrInstaller.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:2800
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:212
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD553ea0a2251276ba7ae39b07e6116d841
SHA15f591af152d71b2f04dfc3353a1c96fd4153117d
SHA2563f7b0412c182cbdefb3eedafe30233d209d734b1087234ac15409636006b3302
SHA512cf63abfe61389f241755eef4b8ed0f41701568b79d1263e885f8989ce3eca6bf9f8d5805b4cc7304aaaa5c7e14122b0d15bd9948e47108107bbb7219fd498306