8571fa43dbcece0d9eb72067409f75f805697ec166129fdb4a9bfc6317926765

Analysis

max time kernel
1483s
max time network
1499s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
25-05-2024 12:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CraxsRat-V3.7.1 Cracked.rar
Size

197.8MB
MD5

f1769f29bf5c820b1092e0c7b19bdf0a
SHA1

8d6e2877752f75f3e4e5c94c4a9c69aafbbabc4f
SHA256

8571fa43dbcece0d9eb72067409f75f805697ec166129fdb4a9bfc6317926765
SHA512

d8038004169e62ddbcbae4f5419ce2ec09d6779b0a9e1cd31467e515fafe5c1e7de75907385859ba814673f3da9438b10cf039e1cf643ef8291eccf17e8d50fb
SSDEEP

3145728:4y0PfiZVYuvnuJNiC0r89zqLXlglmWsSnuZT25OH5kN4NQ908t24lZT25OZbU3I5:4BiEau30r0Gxgkv5ykkRm0yP8SkR

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

5068 OpenWith.exe

pid	process
5068	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\CraxsRat-V3.7.1 Cracked.rar"
1⤵
- Modifies registry class
PID:4344

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5068

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads