b1de81fa8ddf5adf98a1a9c311b95e2e25e0fc93af2b1312a7ec93985adb1814

Analysis

max time kernel
128s
max time network
134s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
06-03-2024 22:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

crackme.rar
Size

48KB
MD5

dd367402c2cf3b19476ffc26887f392c
SHA1

ab99a5f15256e30f8fb43fec81d9f8d9e96993b4
SHA256

b1de81fa8ddf5adf98a1a9c311b95e2e25e0fc93af2b1312a7ec93985adb1814
SHA512

107c3d03781d1d7d1276ab9baba7dd170bce4680c0e29b6f41f8ba54a617a12868416c1127a28cf611b5a0773ab5ae313fe99f81674e8023a80cd150dba2ce3c
SSDEEP

1536:w91ozuNKJVvzWoZkXbKj1wDixfPrTSRdfG:k1ZSVx/Zmixnf+de

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1440	crackme.exe

Loads dropped DLL 1 IoCs

pid	Process
1440	crackme.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4676	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	4676	7zFM.exe
Token: 35	4676	7zFM.exe
Token: SeSecurityPrivilege	4676	7zFM.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4676	7zFM.exe
4676	7zFM.exe
4676	7zFM.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3996 wrote to memory of 4676	3996	cmd.exe	74
PID 3996 wrote to memory of 4676	3996	cmd.exe	74

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\crackme.rar
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\crackme.rar"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4676

C:\Users\Admin\Desktop\crackme.exe
"C:\Users\Admin\Desktop\crackme.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\crackme-stub.dll

Filesize
76KB

MD5
61ecd1aeb81875bb72a388fbbd9f5d81

SHA1
26b294c662d2a8c6ad46c22a4c0fbbed6f03218f

SHA256
183ed294777bb072440400d94f573639a2b7b7a62f9cd5c129aef69d30c99b69

SHA512
5698b91b474e5f2cf215939a54280677dd38d22577c2d72e5d7e0d67c6e773145f9b4e9fa7861d9d3fc45b3973494ff506698775b7fee7c4b5a56271dece6873

Download Submit
C:\Users\Admin\Desktop\crackme.exe

Filesize
64KB

MD5
c7a671d30c8e8dc1d99f0f3a9767afec

SHA1
43175d92e9b307a3c6d4ae9ab9fc40b01b84ecc1

SHA256
b15f98ba8ebfdf2df3f256bb185206ef55c5504c50c4943d266943da0e7dd7d2

SHA512
d7691650451a86353efb2ba2df95358a84c07f8459e557fc347ccdf716f2b750c9049c3dd96e12bf387b4d420172a0a2d7f94793329d1a881f99f33fe45df685

Download Submit