Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
3CryptMP La...L].rar
windows10-2004-x64
3CryptMP La...L].rar
windows11-21h2-x64
3CryptMP La...ls.dll
windows10-2004-x64
1CryptMP La...ls.dll
windows11-21h2-x64
1CryptMP La...pf.dll
windows10-2004-x64
1CryptMP La...pf.dll
windows11-21h2-x64
1CryptMP La...ct.dll
windows10-2004-x64
1CryptMP La...ct.dll
windows11-21h2-x64
1CryptMP La...s.json
windows10-2004-x64
3CryptMP La...s.json
windows11-21h2-x64
3CryptMP La...yp.exe
windows10-2004-x64
1CryptMP La...yp.exe
windows11-21h2-x64
1CryptMP La...config
windows10-2004-x64
3CryptMP La...config
windows11-21h2-x64
3CryptMP La...yp.exe
windows10-2004-x64
1CryptMP La...yp.exe
windows11-21h2-x64
1CryptMP La...g.json
windows10-2004-x64
3CryptMP La...g.json
windows11-21h2-x64
3Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
25/08/2024, 09:07
Static task
static1
Behavioral task
behavioral1
Sample
CryptMP Launcher [STARFALL DLL].rar
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
CryptMP Launcher [STARFALL DLL].rar
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
CryptMP Launcher [STARFALL DLL]/ModernWpf.Controls.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
CryptMP Launcher [STARFALL DLL]/ModernWpf.Controls.dll
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
CryptMP Launcher [STARFALL DLL]/ModernWpf.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral6
Sample
CryptMP Launcher [STARFALL DLL]/ModernWpf.dll
Resource
win11-20240802-en
Behavioral task
behavioral7
Sample
CryptMP Launcher [STARFALL DLL]/Redirect.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral8
Sample
CryptMP Launcher [STARFALL DLL]/Redirect.dll
Resource
win11-20240802-en
Behavioral task
behavioral9
Sample
CryptMP Launcher [STARFALL DLL]/cryp.deps.json
Resource
win10v2004-20240802-en
Behavioral task
behavioral10
Sample
CryptMP Launcher [STARFALL DLL]/cryp.deps.json
Resource
win11-20240802-en
Behavioral task
behavioral11
Sample
CryptMP Launcher [STARFALL DLL]/cryp.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral12
Sample
CryptMP Launcher [STARFALL DLL]/cryp.exe
Resource
win11-20240802-en
Behavioral task
behavioral13
Sample
CryptMP Launcher [STARFALL DLL]/cryp.dll.config
Resource
win10v2004-20240802-en
Behavioral task
behavioral14
Sample
CryptMP Launcher [STARFALL DLL]/cryp.dll.config
Resource
win11-20240802-en
Behavioral task
behavioral15
Sample
CryptMP Launcher [STARFALL DLL]/cryp.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral16
Sample
CryptMP Launcher [STARFALL DLL]/cryp.exe
Resource
win11-20240802-en
Behavioral task
behavioral17
Sample
CryptMP Launcher [STARFALL DLL]/cryp.runtimeconfig.json
Resource
win10v2004-20240802-en
Behavioral task
behavioral18
Sample
CryptMP Launcher [STARFALL DLL]/cryp.runtimeconfig.json
Resource
win11-20240802-en
General
-
Target
CryptMP Launcher [STARFALL DLL].rar
-
Size
603KB
-
MD5
32b0b29021f1b5d391e51b6bd33bf2c3
-
SHA1
ecc8877b71abfa1924da746c450934ca4fcf85a6
-
SHA256
347a37180aff88da754c58afd5f956f7b353524029fa11090ccc45f926260444
-
SHA512
5d0c1d561096365c1f1af50df199752e6281044c29ab547a52b6a900ae13b87e8380fa7cf95e31302b6f50ff3a0c18551057e7f98274ee17d19bbefb10ab9c12
-
SSDEEP
12288:B2V5mnxIhVu+pSzVpbbbQpxUWDMBrYPiIRG+57SEiw84Bo97A0GYe9lM+vc2:8V0x1+pSzbGUWAU1L5ti89jv5
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3140 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\CryptMP Launcher [STARFALL DLL].rar"1⤵
- Modifies registry class
PID:2648
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3140