Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    29/08/2024, 01:49

General

  • Target

    Crazy Error V2 Installer.exe

  • Size

    36.6MB

  • MD5

    88b35804fb768542a8020f370ee2bbf5

  • SHA1

    5410e4d9fd812e6dd2470bff060e88c65f5e8c4a

  • SHA256

    a3a264617e3ef583f7a8e9747ad08da7c5e831ee25eb597543512ae32ddf628c

  • SHA512

    0a95f3e6154b8421d83b1e09f39edc07ebacb651dcf07ce64418c72ef60fe0d77d5570daea959818059ce66f1783f304dc2f8f56b2a2fbf69d8e0745fa1cca75

  • SSDEEP

    786432:hTkzYE5THTYjifPkJhvxrbWEPV9ILkbF/4t7Zh9fUUMgOqvO+kT6B:hTkcQTzYNbvRWEt9PbQh9fUFqW+ko

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Crazy Error V2 Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\Crazy Error V2 Installer.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1648
  • C:\Program Files (x86)\Crazy Error V2\crazererrer.exe
    "C:\Program Files (x86)\Crazy Error V2\crazererrer.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:1552
  • C:\Program Files (x86)\Crazy Error V2\crazererrer.exe
    "C:\Program Files (x86)\Crazy Error V2\crazererrer.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:2204

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Crazy Error V2\VCRUNTIME140.dll

    Filesize

    84KB

    MD5

    ae96651cfbd18991d186a029cbecb30c

    SHA1

    18df8af1022b5cb188e3ee98ac5b4da24ac9c526

    SHA256

    1b372f064eacb455a0351863706e6326ca31b08e779a70de5de986b5be8069a1

    SHA512

    42a58c17f63cf0d404896d3b4bb16b2c9270cc2192aa4c9be265ed3970dfc2a4115e1db08f35c39e403b4c918be4ed7d19d2e2e015cb06b33d26a6c6521556e7

  • C:\Program Files (x86)\Crazy Error V2\_bz2.pyd

    Filesize

    72KB

    MD5

    7f8dc5e22155dfaeeee837bee907f960

    SHA1

    9d03bd1120fd67cb4a2a6e42707c3ecc95d56a31

    SHA256

    f2eaab5894a666556a6ec0f7b430deb30cdcdb534e822cda8c789435d3834535

    SHA512

    ac4ae9f88dbebdd6619be62252275260f476bec5765644de279dadf9f10437ebec526d833fbaae70686de1ef65fc574659191c2c8050df96b7ff7ff3fb51f80c

  • C:\Program Files (x86)\Crazy Error V2\_ctypes.pyd

    Filesize

    109KB

    MD5

    e7f1c92338eb9964ea5922de823abcb8

    SHA1

    ae5719b87f4f6b3cdaacd6e43f5bf101e492adc0

    SHA256

    497cf76470349d3cb601e1fe66c8e08f7570cfb0d25e15c3d94aae84280dba58

    SHA512

    0fe48e6c7596c226d031a1c2966270589b939b54a316e44856054a933be052d5084afc4c1a9d8314aa1cf0e15cc777747645741f3efea3016a41248c01d8fc14

  • C:\Program Files (x86)\Crazy Error V2\_decimal.pyd

    Filesize

    219KB

    MD5

    44ccf7ff70b92fdc6c843c68d1dd66e4

    SHA1

    82176fc8bb776ecaf0957f7051f789b02f196024

    SHA256

    d4554bdf86c188e97eaacae305223678262138c7569cfbb9837990efd6255e77

    SHA512

    75f50c42a46c47a67714807e8702d5b23db36b7445f44fb53aa75aa737331f988c6ddf088d4f8194e64f365473d52d54abb8c739280396e1f2501879a6a1bd27

  • C:\Program Files (x86)\Crazy Error V2\_lzma.pyd

    Filesize

    181KB

    MD5

    b1abe0da66ec97e4aff97f1bd5203434

    SHA1

    c3bd39814c4f01b57a442da50ed515e7dfd05a8a

    SHA256

    ee4f276ec7f0b34acd38361023173d6113d97a7de17d28a4fbbd286fe5ce2f28

    SHA512

    47556e4c65aa04853520c92fdb1f88bb03ab7f4478bfc60e15186f6109cf659e68d458a7b1090a063a0f771c6eb835582464a646456d9e7f82534854c74f83b0

  • C:\Program Files (x86)\Crazy Error V2\_socket.pyd

    Filesize

    67KB

    MD5

    6f71a76bb3c8da44c671f23b4b78f901

    SHA1

    444e2d7d167dbe387317a1f52396c9ccab40ee49

    SHA256

    9cb6bb684c2d475c60a94d3f789cae6e662901ea408e18ac4bc34cba0baffeed

    SHA512

    f1346f5f83717218d1d2517c022d69cb246ff01d88cbf72443b6b06545eef2fe1ff77859e2a87915fc55925847777d1721abc7085a0d81226b3356916b8871eb

  • C:\Program Files (x86)\Crazy Error V2\_tkinter.pyd

    Filesize

    58KB

    MD5

    f5fa0ed3dea125649c4c01326c41c617

    SHA1

    a8f734dd18c963ea24f655223230bf6d5a71a1f6

    SHA256

    1a2394e295252bcef3ebfe88d8633e833d172c9e4fbcc6657e16094c91d3a041

    SHA512

    016f2046437f3f1c35784b4960becfee9b15f03c79580fde159bc1a287b0e73adaae6de381550602f06f5557e9553a39da86adf236d2ad3bb4bc9e7d8bcb32ed

  • C:\Program Files (x86)\Crazy Error V2\api-ms-win-crt-conio-l1-1-0.dll

    Filesize

    21KB

    MD5

    75e626c3ebf160ebe75c59d3d6ac3739

    SHA1

    02a99199f160020b1086cec6c6a2983908641b65

    SHA256

    762ca8dd14f8ff603d06811ba904c973a684022202476bca45e9dc1345151ac4

    SHA512

    5ad205b90ac1658c5b07f6f212a82be8792999b68f9c9617a1298b04d83e7fcb9887ed307a9d31517bcba703b3ee6699ea93f67b06629355ea6519fed0a6d29a

  • C:\Program Files (x86)\Crazy Error V2\api-ms-win-crt-convert-l1-1-0.dll

    Filesize

    24KB

    MD5

    0485c463cd8d2ae1cbd42df6f0591246

    SHA1

    ea634140905078e8f687a031ae919cff23c27e6f

    SHA256

    983f4d4c7b7330e7f5f091080c1e81905575ebccd97e11dff8a064979ec8d9b8

    SHA512

    ddf947a1b86c3826859570a3e1d59e4ec4564cfcf25c84841383a4b5f5ad6c2fe618078416aed201fb744d5fbd6c39dab7c1e964dd5e148da018a825fcc0044a

  • C:\Program Files (x86)\Crazy Error V2\api-ms-win-crt-environment-l1-1-0.dll

    Filesize

    20KB

    MD5

    e48a1860000fd2bd61566e76093984f5

    SHA1

    aa3f233fb19c9e7c88d4307bade2a6eef6518a8a

    SHA256

    67bbb287b2e9057bf8b412ad2faa266321ac28c6e6ba5f22169e2517a3ead248

    SHA512

    46b384c45d2fe2b70a5ac8ee087ba55828a62ccab876a21a3abd531d4de5ec7be21ff34b2284e0231b6cf0869eba09599c3b403db84448f20bd0fff88c1956d5

  • C:\Program Files (x86)\Crazy Error V2\api-ms-win-crt-filesystem-l1-1-0.dll

    Filesize

    22KB

    MD5

    1193f810519fbc07beb3ffbad3247fc4

    SHA1

    db099628a19b2d34e89028c2e16bc89df28ed78f

    SHA256

    ab2158fe6b354fb429f57f374ca25105b44e97edcbdc1b752650d895dadd6fd1

    SHA512

    3222a10c3be5098aca0211015efe75cfbcd408fd28315acedd016d8f77513f81e207536b072001525965635da39c4aae8ef9f6ad367f5d695de67b1614179353

  • C:\Program Files (x86)\Crazy Error V2\api-ms-win-crt-heap-l1-1-0.dll

    Filesize

    21KB

    MD5

    a22f9a4cbd701209842b204895fedf37

    SHA1

    72fa50160baf1f2ea2adcff58f3f90a77a59d949

    SHA256

    2ee3d52640d84ac4f7f7ddfe748f51baa6fd0d492286c781251222420e85ca97

    SHA512

    903755d4fa6651669295a10e66be8ea223cd8d5ad60ebe06188d8b779fef7e964d0aa26dc5479f14aab655562d3c1ef76b86790fb97f991eaf52da0f70e40529

  • C:\Program Files (x86)\Crazy Error V2\api-ms-win-crt-locale-l1-1-0.dll

    Filesize

    20KB

    MD5

    ba17b278fff2c18e34e47562ddde8166

    SHA1

    bed762d11b98737fcf1d1713d77345ec4780a8c2

    SHA256

    c36f5c0ac5d91a8417866dd4d8c670c2192ba83364693e7438282fb8678c3d1e

    SHA512

    72516b81606ccf836549c053325368e93264fdebc7092e42e3df849a16ccefa81b7156ae5609e227faa7c9c1bf9d68b2ac349791a839f4575728f350dd048f27

  • C:\Program Files (x86)\Crazy Error V2\api-ms-win-crt-math-l1-1-0.dll

    Filesize

    28KB

    MD5

    c4cac2d609bb5e0da9017ebb535634ce

    SHA1

    51a264ce4545a2f0d9f2908771e01e001b4e763e

    SHA256

    7c3336c3a50bf3b4c5492c0d085519c040878243e9f7d3ea9f6a2e35c8f1f374

    SHA512

    3b55bdbc5132d05ab53852605afe6ed49f4b3decdde8b11f19a621a78a37d98c7aeaaa8c10bf4565b9b50162816305fa5192ee31950a96dc08ae46bfc6af4ffe

  • C:\Program Files (x86)\Crazy Error V2\api-ms-win-crt-process-l1-1-0.dll

    Filesize

    21KB

    MD5

    d8a5c1960281ec59fd4164c983516d7c

    SHA1

    29e6feff9fb16b9d8271b7da6925baf3c6339d06

    SHA256

    12bb3f480ec115d5f9447414525c5dcd236ed48356d5a70650541c9499bc4d19

    SHA512

    c97aa4029bcd8ffc490547dd78582ac81049dded2288102b800287a7fb623d9fde327702f8a24dfe2d2d67b2c9aaf97050756474faa4914ca4cb6038449c64bf

  • C:\Program Files (x86)\Crazy Error V2\api-ms-win-crt-runtime-l1-1-0.dll

    Filesize

    24KB

    MD5

    dbd23405e7baa8e1ac763fa506021122

    SHA1

    c50ae9cc82c842d50c4317034792d034ac7eb5be

    SHA256

    57fe2bab2acb1184a468e45cebe7609a2986d5220bb2d82592b9ca6e22384f89

    SHA512

    dafea32e44224b40dcc9ca96fd977a7c14128ca1dd0a6144844537d52ba25bcec83c2fa94a665a7497be9e079e7fc71298b950e3a8a0c03c4a5c8172f11063b9

  • C:\Program Files (x86)\Crazy Error V2\api-ms-win-crt-stdio-l1-1-0.dll

    Filesize

    26KB

    MD5

    5df2410c0afd30c9a11de50de4798089

    SHA1

    4112c5493009a1d01090ccae810500c765dc6d54

    SHA256

    e6a1ef1f7c1957c50a3d9c1d70c0f7b0d8badc7f279cd056eb179dc256bfefda

    SHA512

    8ecb79078d05d5b2a432f511953985b3253d5d43d87709a5795709ee8dbca63c5f1166ed94d8984c13f2ea06adfa7d6b82c6735c23c6e64f2f37a257066864e6

  • C:\Program Files (x86)\Crazy Error V2\api-ms-win-crt-string-l1-1-0.dll

    Filesize

    26KB

    MD5

    aacade02d7aaf6b5eff26a0e3a11c42d

    SHA1

    93b8077b535b38fdb0b7c020d24ba280adbe80c3

    SHA256

    e71d517e6b7039437e3fc449d8ad12eeeca0d5c8ed1c500555344fd90ddc3207

    SHA512

    e02fcbcb70100f67e65903d8b1a7e6314cabfb0b14797bd6e1c92b7bcb3994a54133e35d16da0a29576145b2783221330591526f856b79a25c0575fc923985a6

  • C:\Program Files (x86)\Crazy Error V2\api-ms-win-crt-time-l1-1-0.dll

    Filesize

    22KB

    MD5

    0d9afb006f46478008c180b9da5465ac

    SHA1

    3be2f543bbc8d9f1639d0ed798c5856359a9f29b

    SHA256

    c3a70153e1d0ecd1cbf95de033bfef5cfecabe7a8274cafe272cc2c14865cd8c

    SHA512

    4bd76efcb2432994d10884c302aee6cadbc2d594bbbd4e654c1e8547a1efd76fd92e4879b8120dfacb5e8a77826009f72faa5727b1aa559ed3fc86d0ce3ed029

  • C:\Program Files (x86)\Crazy Error V2\api-ms-win-crt-utility-l1-1-0.dll

    Filesize

    20KB

    MD5

    9b622ca5388b6400705c8f21550bae8e

    SHA1

    eb599555448bf98cdeabc2f8b10cfe9bd2181d9f

    SHA256

    af1e1b84f066ba05da20847bffd874d80a810b5407f8c6647b3ff9e8f7d37863

    SHA512

    9872f54ac744cf537826277f1c0a3fd00c5aa51f353692c1929be7bc2e3836e1a52cab2c467ba675d4052ac3116f5622755c3db8be389c179f7d460391105545

  • C:\Program Files (x86)\Crazy Error V2\libffi-7.dll

    Filesize

    28KB

    MD5

    bc20614744ebf4c2b8acd28d1fe54174

    SHA1

    665c0acc404e13a69800fae94efd69a41bdda901

    SHA256

    0c7ec6de19c246a23756b8550e6178ac2394b1093e96d0f43789124149486f57

    SHA512

    0c473e7070c72d85ae098d208b8d128b50574abebba874dda2a7408aea2aabc6c4b9018801416670af91548c471b7dd5a709a7b17e3358b053c37433665d3f6b

  • C:\Program Files (x86)\Crazy Error V2\libopenblas.SVHFG5YE3RK3Z27NVFUDAPL2O3W6IMXW.gfortran-win32.dll

    Filesize

    26.5MB

    MD5

    356c73b41d0eef7f9a2b0e2734a14dee

    SHA1

    e0a6c5bc3f4e9129c76f61132d8705974955db6c

    SHA256

    c785898392f5570ba6d8223c3e8db6a99160a5d2dd52bf89a1a53b0144e9a955

    SHA512

    105dd043d7a74b53af0b5a721a4ac64f58a4665d679b2e1d295f4880991660e0053a667d7feddb80c7ca2ede78ee46982850c18a8ff047c910ab9833eede46de

  • C:\Program Files (x86)\Crazy Error V2\library.zip

    Filesize

    9.7MB

    MD5

    9b82eb9a774780767f3b8e7ec7487f6f

    SHA1

    da9dca672632a01ba558066d6c7fe59f27d11ac1

    SHA256

    aa6e100ecae3bfb97178b7125a83add4032862efbbe1ab783cac3b5da6f8532c

    SHA512

    03386d846b8a843c62218558fbda362ae295c65be87edee1add7fd13c3ac4480d621fc70de49d6180c85a2d292f125dc8fbdd50e32d010a742a4ebb53ccb91cc

  • C:\Program Files (x86)\Crazy Error V2\numpy.core._multiarray_tests.pyd

    Filesize

    101KB

    MD5

    41e7188f5db2243d49f92a3f30b0953f

    SHA1

    b075f8b929988d7c543ef6048f4076bc97aafd9b

    SHA256

    1c55dc007e653ca772fc2fff55c50cd3e96ae1213089a0f908211e87dec18ac4

    SHA512

    4d41f95ec787ec861cc3747943af49ff3c16c9b05de31358f31c0714cf7f51b5ec0dbdf04fdb513a77f3e09342903267977f1c45a382f46eab67bf16148a90f6

  • C:\Program Files (x86)\Crazy Error V2\numpy.core._multiarray_umath.pyd

    Filesize

    2.1MB

    MD5

    a231bc6e45d2ac828e4652470d6ff0a6

    SHA1

    1107ffc3501df0260bf92a5bddf2aa1e0b8fb435

    SHA256

    d84a35ff9270fb144b0e9e015434db5e727b17cc831a1d3af90398c83d9bd21e

    SHA512

    8c76b2f4a9c4e6338227fa71ad7bdb026ea5c3eaad78497835d4a16847df2c42c3f5145b9c2fb2b510157191f35418eea66ea41d9548779bf199a2c3c1caa94e

  • C:\Program Files (x86)\Crazy Error V2\numpy.linalg._umath_linalg.pyd

    Filesize

    105KB

    MD5

    9b31a4ea8120789223330010123785cf

    SHA1

    fffc08c9b1801e9bb481e62b20fa1bfd4639a28f

    SHA256

    db218aa77c9e90fdb599fe747ffb20faa4d1bbfa0d47c9f4a19d17526f4bb623

    SHA512

    67b3a0da39cf768e79fb92a745bb5b26691c3337a975869970f1a41731eea81d7fc7c79fb3ace438b7ebc2a373162341884247eef5f8b046a9bf8dc92b6dab7c

  • C:\Program Files (x86)\Crazy Error V2\numpy.linalg.lapack_lite.pyd

    Filesize

    15KB

    MD5

    e31fb05024c9212862fc936bd8de0d08

    SHA1

    c26769d73100969d6baa188406870396b87e8a02

    SHA256

    ccd64b7c9a697aaeab5f82a2287a0eca17cb249e69b320653d59c845f81781a1

    SHA512

    b5024bf300e361e0b15294dd343ea70572d60c3711ffbb51ec79f7f5e2f2da1c1373ee430ba7d6457a4466e426ec5a0a0aa1b002040b93b5c53eaaacc1efcd6c

  • C:\Program Files (x86)\Crazy Error V2\python38.dll

    Filesize

    3.7MB

    MD5

    97d893cd2879f8e9a6bc8a35d203b2f4

    SHA1

    68ddf1e3a98e080c4ef2c9d241a31dee6aec240b

    SHA256

    6e7ed993131a5beb3b96736320bafb83a063d3043015bf2b14eea6601a414ab8

    SHA512

    30804c88389b54a6119c7c134af315330afb234d743b51acbb25f11d2aec3400c7498e918294f4497e49ebf7ddac557509847d785d58fe9cd381a3fbf8eb9378

  • C:\Program Files (x86)\Crazy Error V2\select.pyd

    Filesize

    23KB

    MD5

    e6969a95ca8b62725206ebef19af0371

    SHA1

    60bfcad0dd79267793c3b8ff109a98c4201ffc18

    SHA256

    3f177ee6d35f0dbeb0f0719f4e20404abe6a101c375ab6d27fcd28aa846def2c

    SHA512

    ae45e272f4b0207dc8720681932641b53379a8b4d1ee7c878ce7804cc475069812d8dcd8689dc6383911b51af272801dbce6b076aaf60f5287c2bacbce8d95e6

  • C:\Program Files (x86)\Crazy Error V2\tcl86t.dll

    Filesize

    1.3MB

    MD5

    30195aa599dd12ac2567de0815ade5e6

    SHA1

    aa2597d43c64554156ae7cdb362c284ec19668a7

    SHA256

    e79443e9413ba9a4442ca7db8ee91a920e61ac2fb55be10a6ab9a9c81f646dbb

    SHA512

    2373b31d15b39ba950c5dea4505c3eaa2952363d3a9bd7ae84e5ea38245320be8f862dba9e9ad32f6b5a1436b353b3fb07e684b7695724a01b30f5ac7ba56e99

  • C:\Program Files (x86)\Crazy Error V2\tk86t.dll

    Filesize

    1.1MB

    MD5

    6cadec733f5be72697d7112860a0905b

    SHA1

    6a6beeef3b1bb7c85c63f4a3410e673fce73f50d

    SHA256

    19f70dc79994e46d3e1ef6be352f5933866de5736d761faa8839204136916b3f

    SHA512

    e6b3e52968c79d4bd700652c1f2ebd0366b492fcda4e05fc8b198791d1169b20f89b85ec69cefa7e099d06a78bf77ff9c3274905667f0c94071f47bafad46d79

  • \Program Files (x86)\Crazy Error V2\crazererrer.exe

    Filesize

    71KB

    MD5

    5178838b2c8cc727b9fc4c378fbd1ba8

    SHA1

    ed8959ece54717f260ae30502341a30bc52caa26

    SHA256

    1b2255aed8e8b890ea0d42318c7367c9788ffe9764ea44ec640044c4e5d1bea4

    SHA512

    6469f293dffdcb9e1ccffbae9b912909ba903c3b7c3367029c1b1c72be6810f0ba2e8b0c15ce3f5a460244aaefbd2b6a44c688a6a2806bafcefe4407650bf7ca

  • memory/1552-1141-0x000000000E050000-0x000000000E54E000-memory.dmp

    Filesize

    5.0MB

  • memory/1552-1144-0x0000000061600000-0x0000000062CA9000-memory.dmp

    Filesize

    22.7MB

  • memory/1552-1137-0x000000000B100000-0x000000000B130000-memory.dmp

    Filesize

    192KB

  • memory/1552-1138-0x000000000B100000-0x000000000B130000-memory.dmp

    Filesize

    192KB

  • memory/1552-1139-0x000000000B170000-0x000000000B171000-memory.dmp

    Filesize

    4KB

  • memory/1552-1140-0x000000000DB50000-0x000000000E04E000-memory.dmp

    Filesize

    5.0MB

  • memory/1552-1135-0x000000000B040000-0x000000000B04A000-memory.dmp

    Filesize

    40KB

  • memory/1552-1142-0x000000000B2A0000-0x000000000B2A8000-memory.dmp

    Filesize

    32KB

  • memory/1552-1143-0x000000000B2F0000-0x000000000B2F8000-memory.dmp

    Filesize

    32KB

  • memory/1552-1136-0x00000000738F0000-0x00000000738FA000-memory.dmp

    Filesize

    40KB

  • memory/1552-1152-0x0000000061600000-0x0000000062CA9000-memory.dmp

    Filesize

    22.7MB

  • memory/2204-1156-0x000000000B310000-0x000000000B340000-memory.dmp

    Filesize

    192KB

  • memory/2204-1155-0x000000000B200000-0x000000000B230000-memory.dmp

    Filesize

    192KB

  • memory/2204-1154-0x0000000073900000-0x000000007390A000-memory.dmp

    Filesize

    40KB

  • memory/2204-1153-0x000000000B040000-0x000000000B04A000-memory.dmp

    Filesize

    40KB

  • memory/2204-1158-0x000000000DD50000-0x000000000E24E000-memory.dmp

    Filesize

    5.0MB

  • memory/2204-1159-0x000000000E250000-0x000000000E74E000-memory.dmp

    Filesize

    5.0MB

  • memory/2204-1160-0x000000000B390000-0x000000000B398000-memory.dmp

    Filesize

    32KB

  • memory/2204-1161-0x000000000B3A0000-0x000000000B3A8000-memory.dmp

    Filesize

    32KB

  • memory/2204-1162-0x0000000061600000-0x0000000062CA9000-memory.dmp

    Filesize

    22.7MB