Analysis
-
max time kernel
38s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
24-05-2024 13:53
Static task
static1
Behavioral task
behavioral1
Sample
cracutor1.0/cracutor (1)/ICSharpCode.AvalonEdit.dll
Resource
win11-20240508-en
Behavioral task
behavioral2
Sample
cracutor1.0/cracutor (1)/Neptune.exe
Resource
win11-20240426-en
Behavioral task
behavioral3
Sample
cracutor1.0/cracutor (1)/RuntimeBroker.bat
Resource
win11-20240426-en
Behavioral task
behavioral4
Sample
cracutor1.0/cracutor (1)/Scripts/Infinity.js
Resource
win11-20240508-en
Behavioral task
behavioral5
Sample
cracutor1.0/cracutor (1)/cracutor.bat
Resource
win11-20240508-en
General
-
Target
cracutor1.0/cracutor (1)/ICSharpCode.AvalonEdit.dll
-
Size
606KB
-
MD5
b017eb5c0f851971f9ebd816efac43cc
-
SHA1
ca1ade1b09f1667963242f49f2b97feaed76ce08
-
SHA256
bf15ddb6056e9654ad66641752f8e7cbabf6e0171ef3c671cd70d844855e9d62
-
SHA512
ed03fabe2701f5648d7cc767be059b0ffc3f2824475963c49b8ac68634f0b5cdde8dc15d3f02a39c61f85736d607598e2bab8e39c065a6476879ed4729e9c930
-
SSDEEP
6144:QxYTpmH0OfxomgEFQP2fEqnkCOx7G0h7vcThz52gkjNuY+535n+kUXjWUUK8tKNz:QKTpmH7CJxiaeN2gkUn5UNH/
Malware Config
Signatures
-
Modifies registry class 1 IoCs
Processes:
MiniSearchHost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings\MuiCache MiniSearchHost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
MiniSearchHost.exepid process 4100 MiniSearchHost.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\cracutor1.0\cracutor (1)\ICSharpCode.AvalonEdit.dll",#11⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.datFilesize
10KB
MD5a71ab244d565671f741686cb2c5ed11b
SHA1b6e766a85f1f878d512f752df2dd4873971755e2
SHA25606a5716962f3b50a8aa3acd30e33d6c75664465c3d795196ad6dce5e33a80faa
SHA5120826c8e52b0f5dbcbda745f06390fd59ce9eee8e0e845cdb007f4a97b19065f2544ca63226b34d361adf9e1cf26644672abfe5dcfd75651cd2aeb1ae27f16f84
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.datFilesize
10KB
MD544408d8bcd8c4ffe97a60ddf16281885
SHA1ab8773e27c92a24e12969dd4dc6bb8422f15d589
SHA256a6047cddc1126bc128da907db3550e725647640752e6a5c71ce9445735a9e83a
SHA512ff4e382bd3d00515f57bb735c6ffce35afd9f63a8def25ba18f722e618ac9f107e31e0ab44ff7758394e9ca7f52bc67b0ba70710c4dfd6afdb470a34093a35c6