Overview
overview
10Static
static
10cryptic to...tic.py
windows7-x64
3cryptic to...tic.py
windows10-2004-x64
3cryptic to...up.bat
windows7-x64
1cryptic to...up.bat
windows10-2004-x64
1cryptic to...ol.bat
windows7-x64
1cryptic to...ol.bat
windows10-2004-x64
1cryptic to...ler.py
windows7-x64
3cryptic to...ler.py
windows10-2004-x64
3cryptic to...ler.py
windows7-x64
3cryptic to...ler.py
windows10-2004-x64
3cryptic to...nfo.py
windows7-x64
3cryptic to...nfo.py
windows10-2004-x64
3cryptic to...gin.py
windows7-x64
3cryptic to...gin.py
windows10-2004-x64
3cryptic to...ker.py
windows7-x64
3cryptic to...ker.py
windows10-2004-x64
3cryptic to...rdm.py
windows7-x64
3cryptic to...rdm.py
windows10-2004-x64
3cryptic to...ger.py
windows7-x64
3cryptic to...ger.py
windows10-2004-x64
3cryptic to...kup.py
windows7-x64
3cryptic to...kup.py
windows10-2004-x64
3cryptic to...sdm.py
windows7-x64
3cryptic to...sdm.py
windows10-2004-x64
3cryptic to...mer.py
windows7-x64
3cryptic to...mer.py
windows10-2004-x64
3cryptic to...gen.py
windows7-x64
3cryptic to...gen.py
windows10-2004-x64
3cryptic to...pam.py
windows7-x64
3cryptic to...pam.py
windows10-2004-x64
3cryptic to...ver.py
windows7-x64
3cryptic to...ver.py
windows10-2004-x64
3Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
11-05-2024 13:37
Behavioral task
behavioral1
Sample
cryptic tool/cryptic.py
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cryptic tool/cryptic.py
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
cryptic tool/setup.bat
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
cryptic tool/setup.bat
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
cryptic tool/start_tool.bat
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
cryptic tool/start_tool.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
cryptic tool/util/10_AccountDisabler/accountdisabler.py
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
cryptic tool/util/10_AccountDisabler/accountdisabler.py
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
cryptic tool/util/12_SettingsCycler/settingscycler.py
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
cryptic tool/util/12_SettingsCycler/settingscycler.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
cryptic tool/util/13_TokenInfo/tokeninfo.py
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
cryptic tool/util/13_TokenInfo/tokeninfo.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
cryptic tool/util/14_AutoLogin/autologin.py
Resource
win7-20240419-en
Behavioral task
behavioral14
Sample
cryptic tool/util/14_AutoLogin/autologin.py
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
cryptic tool/util/15_TokensChecker/tokenschecker.py
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
cryptic tool/util/15_TokensChecker/tokenschecker.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
cryptic tool/util/16_ClearDM/cleardm.py
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
cryptic tool/util/16_ClearDM/cleardm.py
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
cryptic tool/util/17_HouseChanger/housechanger.py
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
cryptic tool/util/17_HouseChanger/housechanger.py
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
cryptic tool/util/18_ServerLookup/serverlookup.py
Resource
win7-20240220-en
Behavioral task
behavioral22
Sample
cryptic tool/util/18_ServerLookup/serverlookup.py
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
cryptic tool/util/19_MassDM/massdm.py
Resource
win7-20240508-en
Behavioral task
behavioral24
Sample
cryptic tool/util/19_MassDM/massdm.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
cryptic tool/util/20_GroupSpammer/groupspammer.py
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
cryptic tool/util/20_GroupSpammer/groupspammer.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
cryptic tool/util/21_NitroGen/nitrogen.py
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
cryptic tool/util/21_NitroGen/nitrogen.py
Resource
win10v2004-20240426-en
Behavioral task
behavioral29
Sample
cryptic tool/util/22_WebHSpam/webhspam.py
Resource
win7-20240419-en
Behavioral task
behavioral30
Sample
cryptic tool/util/22_WebHSpam/webhspam.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
cryptic tool/util/23_WebHRemover/webhremover.py
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
cryptic tool/util/23_WebHRemover/webhremover.py
Resource
win10v2004-20240508-en
General
-
Target
cryptic tool/util/13_TokenInfo/tokeninfo.py
-
Size
8KB
-
MD5
239349ed4be0ab3a032d630e7dfc6242
-
SHA1
1d12920f7ad422bebc54d304036cb4f949a69c17
-
SHA256
ebd313f2573b833756aa4f8a25c2086e8367ac2ca229739132e42417dbdd90c8
-
SHA512
644ae320e191c55781f4e00ca5f13521ef5afeb338e8f62ecc497edbdfe478b41c8b5fbef0a5392b1912643e902961243f22c164d60e24f25069ca71aa96c087
-
SSDEEP
96:SnNDDIRv/8s1kPHyLnOd9IpM5zRQi8LERPasZ4bn4GtL30sf2yrmoiqE:+yv/8c6d+pYVCA9aP32yrmdl
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_Classes\Local Settings rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1980 wrote to memory of 2328 1980 cmd.exe 29 PID 1980 wrote to memory of 2328 1980 cmd.exe 29 PID 1980 wrote to memory of 2328 1980 cmd.exe 29
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\cryptic tool\util\13_TokenInfo\tokeninfo.py"1⤵
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\cryptic tool\util\13_TokenInfo\tokeninfo.py2⤵
- Modifies registry class
PID:2328
-