87e356aa759113795978e7d3314d314b6fcefae841491a7d106ee6a7532a6e04

Analysis

max time kernel
1484s
max time network
1500s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
25-05-2024 12:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Craxsrat V4.5.3 Cleaned.rar
Size

191.1MB
MD5

5fc4493dbca85f10fe0cdfb23c312e96
SHA1

0c09b142dd32c8a7566b415ee278547b9f8b08c9
SHA256

87e356aa759113795978e7d3314d314b6fcefae841491a7d106ee6a7532a6e04
SHA512

e5aba4ee7ea7929f82820b014d98a01efe9ca40fa04a28816b406d5c0728cf3fc2f0e3fe7b7bd2eab81001315ea50dd9d5a2f7363919c09878dfe53c1f97ac1a
SSDEEP

3145728:mF63dqucV0a/V0S3WsSRfZT25OH5kN4NQ908t24lZT25OZbU3Io8Sk7:L1cVaQvSykkRm0yP8Sk7

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

896 OpenWith.exe

pid	process
896	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Craxsrat V4.5.3 Cleaned.rar"
1⤵
- Modifies registry class
PID:4100

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:896

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads