Analysis

  • max time kernel
    144s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-04-2024 12:24

General

  • Target

    CraxsRat 7.4 Cracked By @Hidden_Blaze/res/Lib/7z.exe

  • Size

    1.0MB

  • MD5

    c90af375bc40d0506c16b4ed75efccb6

  • SHA1

    cd29f79b128ba67bc30e44e7a0365c5ffd3be376

  • SHA256

    c6e3aa8b8b76b9e3b9df71b3f31d1b7a23f2a031099aceb68c39f38945b65dc0

  • SHA512

    f0f9e9f6d92ebf20a5303be38e41f66fd052141f04db14ad1d30c974a4e4e70abd51340fe92658563bdb6a7587d9117883241de5bdd123a6e259123869dbabaa

  • SSDEEP

    24576:xnsJ39LyjbJkQFMhmC+6GD9P377SqLk2JC5RzHl:xnsHyjtk2MYC5GDR77k2OHl

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CraxsRat 7.4 Cracked By @Hidden_Blaze\res\Lib\7z.exe
    "C:\Users\Admin\AppData\Local\Temp\CraxsRat 7.4 Cracked By @Hidden_Blaze\res\Lib\7z.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4544
    • C:\Users\Admin\AppData\Local\Temp\CraxsRat 7.4 Cracked By @Hidden_Blaze\res\Lib\._cache_7z.exe
      "C:\Users\Admin\AppData\Local\Temp\CraxsRat 7.4 Cracked By @Hidden_Blaze\res\Lib\._cache_7z.exe"
      2⤵
      • Executes dropped EXE
      PID:1692
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1168
      • C:\Users\Admin\AppData\Local\Temp\CraxsRat 7.4 Cracked By @Hidden_Blaze\res\Lib\._cache_Synaptics.exe
        "C:\Users\Admin\AppData\Local\Temp\CraxsRat 7.4 Cracked By @Hidden_Blaze\res\Lib\._cache_Synaptics.exe" InjUpdate
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3656

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Synaptics\Synaptics.exe

    Filesize

    1.0MB

    MD5

    c90af375bc40d0506c16b4ed75efccb6

    SHA1

    cd29f79b128ba67bc30e44e7a0365c5ffd3be376

    SHA256

    c6e3aa8b8b76b9e3b9df71b3f31d1b7a23f2a031099aceb68c39f38945b65dc0

    SHA512

    f0f9e9f6d92ebf20a5303be38e41f66fd052141f04db14ad1d30c974a4e4e70abd51340fe92658563bdb6a7587d9117883241de5bdd123a6e259123869dbabaa

  • C:\Users\Admin\AppData\Local\Temp\CraxsRat 7.4 Cracked By @Hidden_Blaze\res\Lib\._cache_7z.exe

    Filesize

    329KB

    MD5

    453821572a13cc6ea0736f9db6424e13

    SHA1

    5f994bde8db4b658781756eaaca9416909a3a420

    SHA256

    b8c3871a5d6a473a2e9d08684a481aea7467a97d0a433cf55b127323ef61218f

    SHA512

    22468064ae306037d2b241e8a985ad5b037b45f6873e364f46d8066018533993e66834288227ae86e94e23511386f0afcf52776060b17dad11dfba4bc333b07a

  • memory/1168-128-0x0000000002070000-0x0000000002071000-memory.dmp

    Filesize

    4KB

  • memory/1168-188-0x0000000000400000-0x0000000000513000-memory.dmp

    Filesize

    1.1MB

  • memory/1168-190-0x0000000002070000-0x0000000002071000-memory.dmp

    Filesize

    4KB

  • memory/1168-214-0x0000000000400000-0x0000000000513000-memory.dmp

    Filesize

    1.1MB

  • memory/4544-0-0x00000000023C0000-0x00000000023C1000-memory.dmp

    Filesize

    4KB

  • memory/4544-127-0x0000000000400000-0x0000000000513000-memory.dmp

    Filesize

    1.1MB