a6c11f14de0f3b87910785f97ae9618adda0d3b4a7616395d2b741c70881dc51

Analysis

max time kernel
1371s
max time network
1172s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
21-05-2024 15:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CraxsRat 7.4/res/Plugins/Android/gen-3.pl
Size

5KB
MD5

a03b010aaedc90001f105b4858a4e8d1
SHA1

44191d7dfea55cf37b6b14193801c90741ebb8cf
SHA256

42c8d417fcc509864d08d42ef61a4926a17010abce6c1f06187acd931a9eeaab
SHA512

8769d8329172a6d95b99056bd0b05ccab41c9b4b9b7efe16f2fb22a3f8acbab98d273a3c6bf2e845934ed58e95a08229f0fe27f78f057ca2c3f2ad547f863145
SSDEEP

96:2Pm571ukquJN67N72vNx+y/NeFyocWiBhpWKvgnJyC5a4h7Ybt:2OauuhI9/8/X+pRvgnJR5a4h0p

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

2324 OpenWith.exe

pid	process
2324	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\CraxsRat 7.4\res\Plugins\Android\gen-3.pl"
1⤵
- Modifies registry class
PID:3912

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads