232d68366f96ec9c3e3d9c61902c4ec5fbb2f8c229359aaad7330941f96ed62f

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 05:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

E-crack 1.0/E-crack 1.0.exe
Size

5.6MB
MD5

05cb8b823fe94e72cc70d9821e0365ec
SHA1

e28587df4f0da1fd75854e056edf1a7b47434a02
SHA256

9818a8a442d59b4b05a3b5c37d23966529fa5efe174fec3b9158d3cdd318aa4b
SHA512

4e734f9a56df90c54a3a78cde5092855b252ed0b87499cffd286b7e4aa8a26a61381efefa7e5019461cc5ec963ba61a7ca8e299367f9e1dc54c56b823e63650d
SSDEEP

98304:KYTrow2W6PeCD4aasyEsZBFZiiQKNPk/bYnfIaM0TrwhFQSJjJKmVfUyU7:lTropmU4zsyEk/ogMzYfIazyjjJ1+

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
1304	E-crack 1.0.exe
1304	E-crack 1.0.exe
1304	E-crack 1.0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1304	E-crack 1.0.exe
1304	E-crack 1.0.exe
1304	E-crack 1.0.exe

C:\Users\Admin\AppData\Local\Temp\E-crack 1.0\E-crack 1.0.exe
"C:\Users\Admin\AppData\Local\Temp\E-crack 1.0\E-crack 1.0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\A2828762\c1065726.dll

Filesize
813KB

MD5
b787efbc0389f2a8033c41d654c75845

SHA1
0d97d900074be5ccb4f76dd1932222ae150a7ea5

SHA256
ef97684e458566ebfa77d539d92d30d37024e3eb948378b1826eff9e322ac9a4

SHA512
ef856b149a85ec01ff3db5cf82c2e7fd6e34721c4a897b82e45096bdc355d9f05dc0618f5e3b64b46fdfffec89ee291c0e25132c141e302bf8ec11d8c363c9a4

Download Submit
\Users\Admin\AppData\Local\Temp\nst1334.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nst1334.tmp\nsDialogs.dll

Filesize
444KB

MD5
27534b58d3cd055fc432c68111122b55

SHA1
cdef825f32189efacf8e6ec1a1988aff12496ba4

SHA256
7509bf801677bf528bb70a38a024891374f38d18bfdff77e1db69cb63c3fb5f1

SHA512
eb28bef00f1744254809b4020649db0cf3b5d237ed69da84a850acec2d76f13e35a83f16ef6a187d866becda653bfa14a864313ef6b8452fa75c06374413014f

Download Submit
memory/1304-47-0x0000000000A80000-0x0000000000AF4000-memory.dmp

Filesize
464KB

Download
memory/1304-52-0x0000000002A20000-0x0000000002AF1000-memory.dmp

Filesize
836KB

Download
memory/1304-66-0x0000000000B00000-0x0000000000B01000-memory.dmp

Filesize
4KB

Download
memory/1304-80-0x0000000000A80000-0x0000000000AF4000-memory.dmp

Filesize
464KB

Download
memory/1304-81-0x0000000002A20000-0x0000000002AF1000-memory.dmp

Filesize
836KB

Download