87e356aa759113795978e7d3314d314b6fcefae841491a7d106ee6a7532a6e04

Analysis

max time kernel
1774s
max time network
1800s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 12:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Craxsrat V4.5.3 Cleaned.rar
Size

191.1MB
MD5

5fc4493dbca85f10fe0cdfb23c312e96
SHA1

0c09b142dd32c8a7566b415ee278547b9f8b08c9
SHA256

87e356aa759113795978e7d3314d314b6fcefae841491a7d106ee6a7532a6e04
SHA512

e5aba4ee7ea7929f82820b014d98a01efe9ca40fa04a28816b406d5c0728cf3fc2f0e3fe7b7bd2eab81001315ea50dd9d5a2f7363919c09878dfe53c1f97ac1a
SSDEEP

3145728:mF63dqucV0a/V0S3WsSRfZT25OH5kN4NQ908t24lZT25OZbU3Io8Sk7:L1cVaQvSykkRm0yP8Sk7

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

cmd.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings cmd.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

7zFM.exe

description pid process

Token: SeRestorePrivilege 4576 7zFM.exe
Token: 35 4576 7zFM.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7zFM.exe

pid process

4576 7zFM.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cmd.exe

description pid process target process

PID 3984 wrote to memory of 4576 3984 cmd.exe 7zFM.exe
PID 3984 wrote to memory of 4576 3984 cmd.exe 7zFM.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	cmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	cmd.exe

description	pid	process
Token: SeRestorePrivilege	4576	7zFM.exe
Token: 35	4576	7zFM.exe

pid	process
4576	7zFM.exe

description	pid	process	target process
PID 3984 wrote to memory of 4576	3984	cmd.exe	7zFM.exe
PID 3984 wrote to memory of 4576	3984	cmd.exe	7zFM.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Craxsrat V4.5.3 Cleaned.rar"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3984

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Craxsrat V4.5.3 Cleaned.rar"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5072 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:4972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4128 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:4320

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads