09b469569a1e2874c69017d6e3ba5063230783257cab06cfbef09cd475a9bed5

Analysis

max time kernel
14s
max time network
21s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
14-05-2024 11:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Crypto Factory.exe
Size

10.2MB
MD5

ffafcc536cb266ee1e8c8bf7189dcabb
SHA1

cd8869d803b438615963cc923eb8dd4097535752
SHA256

09b469569a1e2874c69017d6e3ba5063230783257cab06cfbef09cd475a9bed5
SHA512

0fbc89743ba729daf88c1dd6a684a2aa3661c2ab93e9a5a282a3527882a8fc553310d837856ee57955b9ac136380de82f4fa973faa23b3fa9a0f42aac7ca7d10
SSDEEP

196608:MRatAusbeILr7PnILLZWdoCOiV9onJ5hrZERryiU8AdZYJERfSEIrToBf5fnqgnH:axlLr7M5liV9c5hlERjAdZYyAHrMd5vq

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4160	powershell.exe
676	powershell.exe

Loads dropped DLL 20 IoCs

pid	Process
3676	Crypto Factory.exe
3676	Crypto Factory.exe
3676	Crypto Factory.exe
3676	Crypto Factory.exe
3676	Crypto Factory.exe
3676	Crypto Factory.exe
3676	Crypto Factory.exe
3676	Crypto Factory.exe
3676	Crypto Factory.exe
3676	Crypto Factory.exe
3676	Crypto Factory.exe
3676	Crypto Factory.exe
3676	Crypto Factory.exe
3676	Crypto Factory.exe
3676	Crypto Factory.exe
3676	Crypto Factory.exe
3676	Crypto Factory.exe
3676	Crypto Factory.exe
3676	Crypto Factory.exe
3676	Crypto Factory.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4160	powershell.exe
4160	powershell.exe
4160	powershell.exe
676	powershell.exe
676	powershell.exe
676	powershell.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	4160	powershell.exe
Token: SeIncreaseQuotaPrivilege	4160	powershell.exe
Token: SeSecurityPrivilege	4160	powershell.exe
Token: SeTakeOwnershipPrivilege	4160	powershell.exe
Token: SeLoadDriverPrivilege	4160	powershell.exe
Token: SeSystemProfilePrivilege	4160	powershell.exe
Token: SeSystemtimePrivilege	4160	powershell.exe
Token: SeProfSingleProcessPrivilege	4160	powershell.exe
Token: SeIncBasePriorityPrivilege	4160	powershell.exe
Token: SeCreatePagefilePrivilege	4160	powershell.exe
Token: SeBackupPrivilege	4160	powershell.exe
Token: SeRestorePrivilege	4160	powershell.exe
Token: SeShutdownPrivilege	4160	powershell.exe
Token: SeDebugPrivilege	4160	powershell.exe
Token: SeSystemEnvironmentPrivilege	4160	powershell.exe
Token: SeRemoteShutdownPrivilege	4160	powershell.exe
Token: SeUndockPrivilege	4160	powershell.exe
Token: SeManageVolumePrivilege	4160	powershell.exe
Token: 33	4160	powershell.exe
Token: 34	4160	powershell.exe
Token: 35	4160	powershell.exe
Token: 36	4160	powershell.exe
Token: SeDebugPrivilege	676	powershell.exe
Token: SeIncreaseQuotaPrivilege	676	powershell.exe
Token: SeSecurityPrivilege	676	powershell.exe
Token: SeTakeOwnershipPrivilege	676	powershell.exe
Token: SeLoadDriverPrivilege	676	powershell.exe
Token: SeSystemProfilePrivilege	676	powershell.exe
Token: SeSystemtimePrivilege	676	powershell.exe
Token: SeProfSingleProcessPrivilege	676	powershell.exe
Token: SeIncBasePriorityPrivilege	676	powershell.exe
Token: SeCreatePagefilePrivilege	676	powershell.exe
Token: SeBackupPrivilege	676	powershell.exe
Token: SeRestorePrivilege	676	powershell.exe
Token: SeShutdownPrivilege	676	powershell.exe
Token: SeDebugPrivilege	676	powershell.exe
Token: SeSystemEnvironmentPrivilege	676	powershell.exe
Token: SeRemoteShutdownPrivilege	676	powershell.exe
Token: SeUndockPrivilege	676	powershell.exe
Token: SeManageVolumePrivilege	676	powershell.exe
Token: 33	676	powershell.exe
Token: 34	676	powershell.exe
Token: 35	676	powershell.exe
Token: 36	676	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 3676	4948	Crypto Factory.exe	72
PID 4948 wrote to memory of 3676	4948	Crypto Factory.exe	72
PID 3676 wrote to memory of 3352	3676	Crypto Factory.exe	73
PID 3676 wrote to memory of 3352	3676	Crypto Factory.exe	73
PID 3352 wrote to memory of 4160	3352	cmd.exe	75
PID 3352 wrote to memory of 4160	3352	cmd.exe	75
PID 3676 wrote to memory of 4488	3676	Crypto Factory.exe	77
PID 3676 wrote to memory of 4488	3676	Crypto Factory.exe	77
PID 4488 wrote to memory of 676	4488	cmd.exe	79
PID 4488 wrote to memory of 676	4488	cmd.exe	79

C:\Users\Admin\AppData\Local\Temp\Crypto Factory.exe
"C:\Users\Admin\AppData\Local\Temp\Crypto Factory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Users\Admin\AppData\Local\Temp\Crypto Factory.exe
  "C:\Users\Admin\AppData\Local\Temp\Crypto Factory.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\Crypto Factory.exe\"""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3352
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\Crypto Factory.exe\""
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\"""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4488
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\""
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
8592ba100a78835a6b94d5949e13dfc1

SHA1
63e901200ab9a57c7dd4c078d7f75dcd3b357020

SHA256
fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

SHA512
87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
a0c68e75173f393ab988f617cc666af0

SHA1
842915caf0c71f67049d93b00feaa2ba5065de28

SHA256
0215274c772d56263d0250db57230cb376eb3396ed47903f8e08187760d4e64f

SHA512
48d9020ef4a82f0a9630dcb1dae0817dfa9ff72224fbe6779be40e7e9111a66dfca9a4139ef370617b75411736adcdf0f40cc51f6a624a42ed55d08be9c3ba88

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49482\MSVCP140.dll

Filesize
559KB

MD5
c3d497b0afef4bd7e09c7559e1c75b05

SHA1
295998a6455cc230da9517408f59569ea4ed7b02

SHA256
1e57a6df9e3742e31a1c6d9bff81ebeeae8a7de3b45a26e5079d5e1cce54cd98

SHA512
d5c62fdac7c5ee6b2f84b9bc446d5b10ad1a019e29c653cfdea4d13d01072fdf8da6005ad4817044a86bc664d1644b98a86f31c151a3418be53eb47c1cfae386

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49482\VCRUNTIME140.dll

Filesize
99KB

MD5
8697c106593e93c11adc34faa483c4a0

SHA1
cd080c51a97aa288ce6394d6c029c06ccb783790

SHA256
ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833

SHA512
724bbed7ce6f7506e5d0b43399fb3861dda6457a2ad2fafe734f8921c9a4393b480cdd8a435dbdbd188b90236cb98583d5d005e24fa80b5a0622a6322e6f3987

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49482\_ctypes.pyd

Filesize
122KB

MD5
29da9b022c16da461392795951ce32d9

SHA1
0e514a8f88395b50e797d481cbbed2b4ae490c19

SHA256
3b4012343ef7a266db0b077bbb239833779192840d1e2c43dfcbc48ffd4c5372

SHA512
5c7d83823f1922734625cf69a481928a5c47b6a3bceb7f24c9197175665b2e06bd1cfd745c55d1c5fe1572f2d8da2a1dcc1c1f5de0903477bb927aca22ecb26a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49482\_queue.pyd

Filesize
27KB

MD5
4ab2ceb88276eba7e41628387eacb41e

SHA1
58f7963ba11e1d3942414ef6dab3300a33c8a2bd

SHA256
d82ab111224c54bab3eefdcfeb3ba406d74d2884518c5a2e9174e5c6101bd839

SHA512
b0d131e356ce35e603acf0168e540c89f600ba2ab2099ccf212e0b295c609702ac4a7b0a7dbc79f46eda50e7ea2cf09917832345dd8562d916d118aba2fa3888

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49482\base_library.zip

Filesize
1006KB

MD5
e8b8760bc8ef065b6a36773856cf3a77

SHA1
d51b4dea8709f23ef4aeb69d3fd51b224e3f5f10

SHA256
6cd3556f5e9f1ac7f915c0e6db083ada51f53cc69d89689d358b195b3d45d71d

SHA512
068abdaf309c793fcf1117e241f845ba629bfe576e0379cdd5f5339429c068f25c703fd3ec26d5814cef1d4806205b76a1bf47b085e482c5a2be6075a67befba

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49482\libcrypto-1_1.dll

Filesize
3.2MB

MD5
cc4cbf715966cdcad95a1e6c95592b3d

SHA1
d5873fea9c084bcc753d1c93b2d0716257bea7c3

SHA256
594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1

SHA512
3b5af9fbbc915d172648c2b0b513b5d2151f940ccf54c23148cd303e6660395f180981b148202bef76f5209acc53b8953b1cb067546f90389a6aa300c1fbe477

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49482\libssl-1_1.dll

Filesize
673KB

MD5
bc778f33480148efa5d62b2ec85aaa7d

SHA1
b1ec87cbd8bc4398c6ebb26549961c8aab53d855

SHA256
9d4cf1c03629f92662fc8d7e3f1094a7fc93cb41634994464b853df8036af843

SHA512
80c1dd9d0179e6cc5f33eb62d05576a350af78b5170bfdf2ecda16f1d8c3c2d0e991a5534a113361ae62079fb165fff2344efd1b43031f1a7bfda696552ee173

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49482\python39.dll

Filesize
4.3MB

MD5
11c051f93c922d6b6b4829772f27a5be

SHA1
42fbdf3403a4bc3d46d348ca37a9f835e073d440

SHA256
0eabf135bb9492e561bbbc5602a933623c9e461aceaf6eb1ceced635e363cd5c

SHA512
1cdec23486cffcb91098a8b2c3f1262d6703946acf52aa2fe701964fb228d1411d9b6683bd54527860e10affc0e3d3de92a6ecf2c6c8465e9c8b9a7304e2a4a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49482\select.pyd

Filesize
26KB

MD5
7a442bbcc4b7aa02c762321f39487ba9

SHA1
0fcb5bbdd0c3d3c5943e557cc2a5b43e20655b83

SHA256
1dd7bba480e65802657c31e6d20b1346d11bca2192575b45eb9760a4feb468ad

SHA512
3433c46c7603ae0a73aa9a863b2aecd810f8c0cc6c2cd96c71ef6bde64c275e0fceb4ea138e46a5c9bf72f66dcdea3e9551cf2103188a1e98a92d8140879b34c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49482\ucrtbase.dll

Filesize
992KB

MD5
0e0bac3d1dcc1833eae4e3e4cf83c4ef

SHA1
4189f4459c54e69c6d3155a82524bda7549a75a6

SHA256
8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae

SHA512
a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49482\unicodedata.pyd

Filesize
1.1MB

MD5
8320c54418d77eba5d4553a5d6ec27f9

SHA1
e5123cf166229aebb076b469459856a56fb16d7f

SHA256
7e719ba47919b668acc62008079c586133966ed8b39fec18e312a773cb89edae

SHA512
b9e6cdcb37d26ff9c573381bda30fa4cf1730361025cd502b67288c55744962bdd0a99790cedd4a48feef3139e3903265ab112ec545cb1154eaa2a91201f6b34

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hgiqgqfn.2e0.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI49482\VCRUNTIME140_1.dll

Filesize
43KB

MD5
21ae0d0cfe9ab13f266ad7cd683296be

SHA1
f13878738f2932c56e07aa3c6325e4e19d64ae9f

SHA256
7b8f70dd3bdae110e61823d1ca6fd8955a5617119f5405cdd6b14cad3656dfc7

SHA512
6b2c7ce0fe32faffb68510bf8ae1b61af79b2d8a2d1b633ceba3a8e6a668a4f5179bb836c550ecac495b0fc413df5fe706cd6f42e93eb082a6c68e770339a77c

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI49482\_brotli.cp39-win_amd64.pyd

Filesize
861KB

MD5
2c7528407abfd7c6ef08f7bcf2e88e21

SHA1
ee855c0cde407f9a26a9720419bf91d7f1f283a7

SHA256
093ab305d9780373c3c7d04d19244f5e48c48e71958963ceca6211d5017a4441

SHA512
93e7c12a6038778fcda30734d933b869f93e3b041bb6940852404641a599fe9c8ee1168a2e99dcfb624f84c306aff99757d17570febabc259908c8f6cda4dbea

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI49482\_bz2.pyd

Filesize
83KB

MD5
6c7565c1efffe44cb0616f5b34faa628

SHA1
88dd24807da6b6918945201c74467ca75e155b99

SHA256
fe63361f6c439c6aa26fd795af3fd805ff5b60b3b14f9b8c60c50a8f3449060a

SHA512
822445c52bb71c884461230bb163ec5dee0ad2c46d42d01cf012447f2c158865653f86a933b52afdf583043b3bf8ba7011cc782f14197220d0325e409aa16e22

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI49482\_hashlib.pyd

Filesize
63KB

MD5
f377a418addeeb02f223f45f6f168fe6

SHA1
5d8d42dec5d08111e020614600bbf45091c06c0b

SHA256
9551431425e9680660c6baf7b67a262040fd2efceb241e4c9430560c3c1fafac

SHA512
6f60bfac34ed55ff5d6ae10c6ec5511906c983e0650e5d47dac7b8a97a2e0739266cae009449cced8dff59037e2dbfc92065fbbdfde2636d13679e1629650280

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI49482\_lzma.pyd

Filesize
157KB

MD5
b5355dd319fb3c122bb7bf4598ad7570

SHA1
d7688576eceadc584388a179eed3155716c26ef5

SHA256
b9bc7f1d8aa8498cb8b5dc75bb0dbb6e721b48953a3f295870938b27267fb5f5

SHA512
0e228aa84b37b4ba587f6d498cef85aa1ffec470a5c683101a23d13955a8110e1c0c614d3e74fb0aa2a181b852bceeec0461546d0de8bcbd3c58cf9dc0fb26f5

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI49482\_socket.pyd

Filesize
77KB

MD5
f5dd9c5922a362321978c197d3713046

SHA1
4fbc2d3e15f8bb21ecc1bf492f451475204426cd

SHA256
4494992665305fc9401ed327398ee40064fe26342fe44df11d89d2ac1cc6f626

SHA512
ce818113bb87c6e38fa85156548c6f207aaab01db311a6d8c63c6d900d607d7beff73e64d717f08388ece4b88bf8b95b71911109082cf4b0c0a9b0663b9a8e99

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI49482\_ssl.pyd

Filesize
149KB

MD5
ef4755195cc9b2ff134ea61acde20637

SHA1
d5ba42c97488da1910cf3f83a52f7971385642c2

SHA256
8a86957b3496c8b679fcf22c287006108bfe0bb0aaffea17121c761a0744b470

SHA512
63ad2601fb629e74cf60d980cec292b6e8349615996651b7c7f68991cdae5f89b28c11adb77720d7dbbd7700e55fdd5330a84b4a146386cf0c0418a8d61a8a71

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI49482\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI49482\python3.dll

Filesize
57KB

MD5
3c88de1ebd52e9fcb46dc44d8a123579

SHA1
7d48519d2a19cac871277d9b63a3ea094fbbb3d9

SHA256
2b22b6d576118c5ae98f13b75b4ace47ab0c1f4cd3ff098c6aee23a8a99b9a8c

SHA512
1e55c9f7ac5acf3f7262fa2f3c509ee0875520bb05d65cd68b90671ac70e8c99bce99433b02055c07825285004d4c5915744f17eccfac9b25e0f7cd1bee9e6d3

Download Submit
memory/4160-116-0x00007FFA62563000-0x00007FFA62564000-memory.dmp

Filesize
4KB

Download
memory/4160-119-0x000001D1EE420000-0x000001D1EE442000-memory.dmp

Filesize
136KB

Download
memory/4160-123-0x00007FFA62560000-0x00007FFA62F4C000-memory.dmp

Filesize
9.9MB

Download
memory/4160-122-0x000001D1EE5D0000-0x000001D1EE646000-memory.dmp

Filesize
472KB

Download
memory/4160-124-0x00007FFA62560000-0x00007FFA62F4C000-memory.dmp

Filesize
9.9MB

Download
memory/4160-161-0x00007FFA62560000-0x00007FFA62F4C000-memory.dmp

Filesize
9.9MB

Download