0d900cb2be48cef95db3dbe86221d8d1007ba294b963ee580c2293c6be37f07a

Resubmissions

02/03/2024, 17:29

240302-v2y3yafh788

02/03/2024, 17:24

240302-vysrrafh3810

02/03/2024, 17:22

240302-vxn26sfd2110

Analysis

max time kernel
38s
max time network
44s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
02/03/2024, 17:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
crazyCore.exe
Size 15.0MB
Sample240302-vxn26sfd21
SHA256 0d900cb2be48cef95db3dbe86221d8d1007ba294b963ee580c2293c6be37f07a
MD5 3e69eb9b5ab82999bdc78d6232917e2f
SHA1 3516807c3f86bfb9298cfb9840dacbff99fb8f48
SHA512 f0f0f3dc549d989e710b3db10674629adaed4291e700f38fdcfa52ab4847a02aecf63fbc0197a747fae2ca997a6a6e8ed454e58e83ebbdae20cb30d01810de9e
SSDEEP 49152:celaraJaKaoCNpHWuZkYZ+RYkwhtzLjxI8LbX154Kx3bvQQz5RrlD1ZNyWO1MO9U:v3W
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies Windows Defender notification settings 3 TTPs 2 IoCs

evasion trojan

Windows Service

T1543.003

Modify Registry

T1112

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	reg.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
4804	attrib.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4944	sc.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1292	crazyCore.exe
4676	powershell.exe
4676	powershell.exe
3904	powershell.exe
3904	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1292	crazyCore.exe
Token: SeDebugPrivilege	4676	powershell.exe
Token: SeDebugPrivilege	3904	powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 2764	1292	crazyCore.exe	81
PID 1292 wrote to memory of 2764	1292	crazyCore.exe	81
PID 2764 wrote to memory of 4676	2764	cmd.exe	83
PID 2764 wrote to memory of 4676	2764	cmd.exe	83
PID 4676 wrote to memory of 3568	4676	powershell.exe	84
PID 4676 wrote to memory of 3568	4676	powershell.exe	84
PID 1292 wrote to memory of 4812	1292	crazyCore.exe	85
PID 1292 wrote to memory of 4812	1292	crazyCore.exe	85
PID 4812 wrote to memory of 4804	4812	cmd.exe	87
PID 4812 wrote to memory of 4804	4812	cmd.exe	87
PID 4812 wrote to memory of 3904	4812	cmd.exe	88
PID 4812 wrote to memory of 3904	4812	cmd.exe	88
PID 1292 wrote to memory of 940	1292	crazyCore.exe	89
PID 1292 wrote to memory of 940	1292	crazyCore.exe	89
PID 940 wrote to memory of 4944	940	cmd.exe	91
PID 940 wrote to memory of 4944	940	cmd.exe	91

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4804	attrib.exe

C:\Users\Admin\AppData\Local\Temp\crazyCore.exe
"C:\Users\Admin\AppData\Local\Temp\crazyCore.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c powershell -Command reg add 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications' /v DisableNotifications /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command reg add 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications' /v DisableNotifications /t REG_DWORD /d 1 /f
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4676
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications" /v DisableNotifications /t REG_DWORD /d 1 /f
      4⤵
      Modifies Windows Defender notification settings
      PID:3568
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c mkdir \\.\C:\ProgramData\Nul & attrib +r +h +s \\.\C:\ProgramData\Nul & powershell -Command Add-MpPreference -ExclusionPath @('C:\ProgramData', 'C:\Windows\system32\svchost.exe') -ExclusionExtension '.exe'
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Windows\system32\attrib.exe
    attrib +r +h +s \\.\C:\ProgramData\Nul
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:4804
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath @('C:\ProgramData', 'C:\Windows\system32\svchost.exe') -ExclusionExtension '.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3904
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c sc create "nulhost" binpath="C:\ProgramData\Nul\nulhost.exe" start="auto"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Windows\system32\sc.exe
    sc create "nulhost" binpath="C:\ProgramData\Nul\nulhost.exe" start="auto"
    3⤵
    - Launches sc.exe
    PID:4944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 926d265531396c478cdb53e539836d82d77876b8b1492248140e898899b6c6d2
MD5 ad2985bb662a55ea3924ca7407965bfc
SHA1 5a95e6cacd0cbb976179370a87a85de272f2bff1
SHA512 6450119c1aa249e0e60271006c44ed3efe5094378550ed73b70d4b9d87c4f95acaf9b5086711ebbb337bd32907f1e54b187ff81937ca9428a61c49687fff342f
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_zzpgwase.bsn.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zzpgwase.bsn.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/1292-8-0x00000292FC3E0000-0x00000292FC3F0000-memory.dmp

Download

memory/1292-49-0x00007FFB3A4F0000-0x00007FFB3AFB2000-memory.dmp

Download

memory/1292-5-0x00000292FA290000-0x00000292FA29A000-memory.dmp

Download

memory/1292-6-0x00000292FC630000-0x00000292FC668000-memory.dmp

Download

memory/1292-7-0x00000292FBBC0000-0x00000292FBBCE000-memory.dmp

Download

memory/1292-29-0x00000292FC3E0000-0x00000292FC3F0000-memory.dmp

Download

memory/1292-9-0x00000292FC3E0000-0x00000292FC3F0000-memory.dmp

Download

memory/1292-4-0x00000292FBBA0000-0x00000292FBBA8000-memory.dmp

Download

memory/1292-41-0x00000292FC3E0000-0x00000292FC3F0000-memory.dmp

Download

memory/1292-40-0x00000292FC3E0000-0x00000292FC3F0000-memory.dmp

Download

memory/1292-3-0x00000292FC5F0000-0x00000292FC630000-memory.dmp

Download

memory/1292-2-0x00000292FC3E0000-0x00000292FC3F0000-memory.dmp

Download

memory/1292-22-0x00007FFB3A4F0000-0x00007FFB3AFB2000-memory.dmp

Download

memory/1292-0-0x00007FFB3A4F0000-0x00007FFB3AFB2000-memory.dmp

Download

memory/1292-26-0x00000292FC3E0000-0x00000292FC3F0000-memory.dmp

Download

memory/1292-1-0x00000292F8E70000-0x00000292F9D72000-memory.dmp

Download

memory/3904-28-0x00007FFB3A4F0000-0x00007FFB3AFB2000-memory.dmp

Download

memory/3904-30-0x000002BD79620000-0x000002BD79630000-memory.dmp

Download

memory/3904-42-0x000002BD79620000-0x000002BD79630000-memory.dmp

Download

memory/3904-43-0x000002BD79620000-0x000002BD79630000-memory.dmp

Download

memory/3904-45-0x00007FFB3A4F0000-0x00007FFB3AFB2000-memory.dmp

Download

memory/4676-25-0x00007FFB3A4F0000-0x00007FFB3AFB2000-memory.dmp

Download

memory/4676-21-0x000001DD73B00000-0x000001DD73B10000-memory.dmp

Download

memory/4676-19-0x00007FFB3A4F0000-0x00007FFB3AFB2000-memory.dmp

Download

memory/4676-20-0x000001DD73B00000-0x000001DD73B10000-memory.dmp

Download

memory/4676-18-0x000001DD73A70000-0x000001DD73A92000-memory.dmp

Download