Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    29/08/2024, 01:49

General

  • Target

    Crazy Error V2 Installer.exe

  • Size

    36.6MB

  • MD5

    88b35804fb768542a8020f370ee2bbf5

  • SHA1

    5410e4d9fd812e6dd2470bff060e88c65f5e8c4a

  • SHA256

    a3a264617e3ef583f7a8e9747ad08da7c5e831ee25eb597543512ae32ddf628c

  • SHA512

    0a95f3e6154b8421d83b1e09f39edc07ebacb651dcf07ce64418c72ef60fe0d77d5570daea959818059ce66f1783f304dc2f8f56b2a2fbf69d8e0745fa1cca75

  • SSDEEP

    786432:hTkzYE5THTYjifPkJhvxrbWEPV9ILkbF/4t7Zh9fUUMgOqvO+kT6B:hTkcQTzYNbvRWEt9PbQh9fUFqW+ko

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Crazy Error V2 Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\Crazy Error V2 Installer.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1648
  • C:\Program Files (x86)\Crazy Error V2\crazererrer.exe
    "C:\Program Files (x86)\Crazy Error V2\crazererrer.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:1552
  • C:\Program Files (x86)\Crazy Error V2\crazererrer.exe
    "C:\Program Files (x86)\Crazy Error V2\crazererrer.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:2204

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Crazy Error V2\VCRUNTIME140.dll

          Filesize

          84KB

          MD5

          ae96651cfbd18991d186a029cbecb30c

          SHA1

          18df8af1022b5cb188e3ee98ac5b4da24ac9c526

          SHA256

          1b372f064eacb455a0351863706e6326ca31b08e779a70de5de986b5be8069a1

          SHA512

          42a58c17f63cf0d404896d3b4bb16b2c9270cc2192aa4c9be265ed3970dfc2a4115e1db08f35c39e403b4c918be4ed7d19d2e2e015cb06b33d26a6c6521556e7

        • C:\Program Files (x86)\Crazy Error V2\_bz2.pyd

          Filesize

          72KB

          MD5

          7f8dc5e22155dfaeeee837bee907f960

          SHA1

          9d03bd1120fd67cb4a2a6e42707c3ecc95d56a31

          SHA256

          f2eaab5894a666556a6ec0f7b430deb30cdcdb534e822cda8c789435d3834535

          SHA512

          ac4ae9f88dbebdd6619be62252275260f476bec5765644de279dadf9f10437ebec526d833fbaae70686de1ef65fc574659191c2c8050df96b7ff7ff3fb51f80c

        • C:\Program Files (x86)\Crazy Error V2\_ctypes.pyd

          Filesize

          109KB

          MD5

          e7f1c92338eb9964ea5922de823abcb8

          SHA1

          ae5719b87f4f6b3cdaacd6e43f5bf101e492adc0

          SHA256

          497cf76470349d3cb601e1fe66c8e08f7570cfb0d25e15c3d94aae84280dba58

          SHA512

          0fe48e6c7596c226d031a1c2966270589b939b54a316e44856054a933be052d5084afc4c1a9d8314aa1cf0e15cc777747645741f3efea3016a41248c01d8fc14

        • C:\Program Files (x86)\Crazy Error V2\_decimal.pyd

          Filesize

          219KB

          MD5

          44ccf7ff70b92fdc6c843c68d1dd66e4

          SHA1

          82176fc8bb776ecaf0957f7051f789b02f196024

          SHA256

          d4554bdf86c188e97eaacae305223678262138c7569cfbb9837990efd6255e77

          SHA512

          75f50c42a46c47a67714807e8702d5b23db36b7445f44fb53aa75aa737331f988c6ddf088d4f8194e64f365473d52d54abb8c739280396e1f2501879a6a1bd27

        • C:\Program Files (x86)\Crazy Error V2\_lzma.pyd

          Filesize

          181KB

          MD5

          b1abe0da66ec97e4aff97f1bd5203434

          SHA1

          c3bd39814c4f01b57a442da50ed515e7dfd05a8a

          SHA256

          ee4f276ec7f0b34acd38361023173d6113d97a7de17d28a4fbbd286fe5ce2f28

          SHA512

          47556e4c65aa04853520c92fdb1f88bb03ab7f4478bfc60e15186f6109cf659e68d458a7b1090a063a0f771c6eb835582464a646456d9e7f82534854c74f83b0

        • C:\Program Files (x86)\Crazy Error V2\_socket.pyd

          Filesize

          67KB

          MD5

          6f71a76bb3c8da44c671f23b4b78f901

          SHA1

          444e2d7d167dbe387317a1f52396c9ccab40ee49

          SHA256

          9cb6bb684c2d475c60a94d3f789cae6e662901ea408e18ac4bc34cba0baffeed

          SHA512

          f1346f5f83717218d1d2517c022d69cb246ff01d88cbf72443b6b06545eef2fe1ff77859e2a87915fc55925847777d1721abc7085a0d81226b3356916b8871eb

        • C:\Program Files (x86)\Crazy Error V2\_tkinter.pyd

          Filesize

          58KB

          MD5

          f5fa0ed3dea125649c4c01326c41c617

          SHA1

          a8f734dd18c963ea24f655223230bf6d5a71a1f6

          SHA256

          1a2394e295252bcef3ebfe88d8633e833d172c9e4fbcc6657e16094c91d3a041

          SHA512

          016f2046437f3f1c35784b4960becfee9b15f03c79580fde159bc1a287b0e73adaae6de381550602f06f5557e9553a39da86adf236d2ad3bb4bc9e7d8bcb32ed

        • C:\Program Files (x86)\Crazy Error V2\api-ms-win-crt-conio-l1-1-0.dll

          Filesize

          21KB

          MD5

          75e626c3ebf160ebe75c59d3d6ac3739

          SHA1

          02a99199f160020b1086cec6c6a2983908641b65

          SHA256

          762ca8dd14f8ff603d06811ba904c973a684022202476bca45e9dc1345151ac4

          SHA512

          5ad205b90ac1658c5b07f6f212a82be8792999b68f9c9617a1298b04d83e7fcb9887ed307a9d31517bcba703b3ee6699ea93f67b06629355ea6519fed0a6d29a

        • C:\Program Files (x86)\Crazy Error V2\api-ms-win-crt-convert-l1-1-0.dll

          Filesize

          24KB

          MD5

          0485c463cd8d2ae1cbd42df6f0591246

          SHA1

          ea634140905078e8f687a031ae919cff23c27e6f

          SHA256

          983f4d4c7b7330e7f5f091080c1e81905575ebccd97e11dff8a064979ec8d9b8

          SHA512

          ddf947a1b86c3826859570a3e1d59e4ec4564cfcf25c84841383a4b5f5ad6c2fe618078416aed201fb744d5fbd6c39dab7c1e964dd5e148da018a825fcc0044a

        • C:\Program Files (x86)\Crazy Error V2\api-ms-win-crt-environment-l1-1-0.dll

          Filesize

          20KB

          MD5

          e48a1860000fd2bd61566e76093984f5

          SHA1

          aa3f233fb19c9e7c88d4307bade2a6eef6518a8a

          SHA256

          67bbb287b2e9057bf8b412ad2faa266321ac28c6e6ba5f22169e2517a3ead248

          SHA512

          46b384c45d2fe2b70a5ac8ee087ba55828a62ccab876a21a3abd531d4de5ec7be21ff34b2284e0231b6cf0869eba09599c3b403db84448f20bd0fff88c1956d5

        • C:\Program Files (x86)\Crazy Error V2\api-ms-win-crt-filesystem-l1-1-0.dll

          Filesize

          22KB

          MD5

          1193f810519fbc07beb3ffbad3247fc4

          SHA1

          db099628a19b2d34e89028c2e16bc89df28ed78f

          SHA256

          ab2158fe6b354fb429f57f374ca25105b44e97edcbdc1b752650d895dadd6fd1

          SHA512

          3222a10c3be5098aca0211015efe75cfbcd408fd28315acedd016d8f77513f81e207536b072001525965635da39c4aae8ef9f6ad367f5d695de67b1614179353

        • C:\Program Files (x86)\Crazy Error V2\api-ms-win-crt-heap-l1-1-0.dll

          Filesize

          21KB

          MD5

          a22f9a4cbd701209842b204895fedf37

          SHA1

          72fa50160baf1f2ea2adcff58f3f90a77a59d949

          SHA256

          2ee3d52640d84ac4f7f7ddfe748f51baa6fd0d492286c781251222420e85ca97

          SHA512

          903755d4fa6651669295a10e66be8ea223cd8d5ad60ebe06188d8b779fef7e964d0aa26dc5479f14aab655562d3c1ef76b86790fb97f991eaf52da0f70e40529

        • C:\Program Files (x86)\Crazy Error V2\api-ms-win-crt-locale-l1-1-0.dll

          Filesize

          20KB

          MD5

          ba17b278fff2c18e34e47562ddde8166

          SHA1

          bed762d11b98737fcf1d1713d77345ec4780a8c2

          SHA256

          c36f5c0ac5d91a8417866dd4d8c670c2192ba83364693e7438282fb8678c3d1e

          SHA512

          72516b81606ccf836549c053325368e93264fdebc7092e42e3df849a16ccefa81b7156ae5609e227faa7c9c1bf9d68b2ac349791a839f4575728f350dd048f27

        • C:\Program Files (x86)\Crazy Error V2\api-ms-win-crt-math-l1-1-0.dll

          Filesize

          28KB

          MD5

          c4cac2d609bb5e0da9017ebb535634ce

          SHA1

          51a264ce4545a2f0d9f2908771e01e001b4e763e

          SHA256

          7c3336c3a50bf3b4c5492c0d085519c040878243e9f7d3ea9f6a2e35c8f1f374

          SHA512

          3b55bdbc5132d05ab53852605afe6ed49f4b3decdde8b11f19a621a78a37d98c7aeaaa8c10bf4565b9b50162816305fa5192ee31950a96dc08ae46bfc6af4ffe

        • C:\Program Files (x86)\Crazy Error V2\api-ms-win-crt-process-l1-1-0.dll

          Filesize

          21KB

          MD5

          d8a5c1960281ec59fd4164c983516d7c

          SHA1

          29e6feff9fb16b9d8271b7da6925baf3c6339d06

          SHA256

          12bb3f480ec115d5f9447414525c5dcd236ed48356d5a70650541c9499bc4d19

          SHA512

          c97aa4029bcd8ffc490547dd78582ac81049dded2288102b800287a7fb623d9fde327702f8a24dfe2d2d67b2c9aaf97050756474faa4914ca4cb6038449c64bf

        • C:\Program Files (x86)\Crazy Error V2\api-ms-win-crt-runtime-l1-1-0.dll

          Filesize

          24KB

          MD5

          dbd23405e7baa8e1ac763fa506021122

          SHA1

          c50ae9cc82c842d50c4317034792d034ac7eb5be

          SHA256

          57fe2bab2acb1184a468e45cebe7609a2986d5220bb2d82592b9ca6e22384f89

          SHA512

          dafea32e44224b40dcc9ca96fd977a7c14128ca1dd0a6144844537d52ba25bcec83c2fa94a665a7497be9e079e7fc71298b950e3a8a0c03c4a5c8172f11063b9

        • C:\Program Files (x86)\Crazy Error V2\api-ms-win-crt-stdio-l1-1-0.dll

          Filesize

          26KB

          MD5

          5df2410c0afd30c9a11de50de4798089

          SHA1

          4112c5493009a1d01090ccae810500c765dc6d54

          SHA256

          e6a1ef1f7c1957c50a3d9c1d70c0f7b0d8badc7f279cd056eb179dc256bfefda

          SHA512

          8ecb79078d05d5b2a432f511953985b3253d5d43d87709a5795709ee8dbca63c5f1166ed94d8984c13f2ea06adfa7d6b82c6735c23c6e64f2f37a257066864e6

        • C:\Program Files (x86)\Crazy Error V2\api-ms-win-crt-string-l1-1-0.dll

          Filesize

          26KB

          MD5

          aacade02d7aaf6b5eff26a0e3a11c42d

          SHA1

          93b8077b535b38fdb0b7c020d24ba280adbe80c3

          SHA256

          e71d517e6b7039437e3fc449d8ad12eeeca0d5c8ed1c500555344fd90ddc3207

          SHA512

          e02fcbcb70100f67e65903d8b1a7e6314cabfb0b14797bd6e1c92b7bcb3994a54133e35d16da0a29576145b2783221330591526f856b79a25c0575fc923985a6

        • C:\Program Files (x86)\Crazy Error V2\api-ms-win-crt-time-l1-1-0.dll

          Filesize

          22KB

          MD5

          0d9afb006f46478008c180b9da5465ac

          SHA1

          3be2f543bbc8d9f1639d0ed798c5856359a9f29b

          SHA256

          c3a70153e1d0ecd1cbf95de033bfef5cfecabe7a8274cafe272cc2c14865cd8c

          SHA512

          4bd76efcb2432994d10884c302aee6cadbc2d594bbbd4e654c1e8547a1efd76fd92e4879b8120dfacb5e8a77826009f72faa5727b1aa559ed3fc86d0ce3ed029

        • C:\Program Files (x86)\Crazy Error V2\api-ms-win-crt-utility-l1-1-0.dll

          Filesize

          20KB

          MD5

          9b622ca5388b6400705c8f21550bae8e

          SHA1

          eb599555448bf98cdeabc2f8b10cfe9bd2181d9f

          SHA256

          af1e1b84f066ba05da20847bffd874d80a810b5407f8c6647b3ff9e8f7d37863

          SHA512

          9872f54ac744cf537826277f1c0a3fd00c5aa51f353692c1929be7bc2e3836e1a52cab2c467ba675d4052ac3116f5622755c3db8be389c179f7d460391105545

        • C:\Program Files (x86)\Crazy Error V2\libffi-7.dll

          Filesize

          28KB

          MD5

          bc20614744ebf4c2b8acd28d1fe54174

          SHA1

          665c0acc404e13a69800fae94efd69a41bdda901

          SHA256

          0c7ec6de19c246a23756b8550e6178ac2394b1093e96d0f43789124149486f57

          SHA512

          0c473e7070c72d85ae098d208b8d128b50574abebba874dda2a7408aea2aabc6c4b9018801416670af91548c471b7dd5a709a7b17e3358b053c37433665d3f6b

        • C:\Program Files (x86)\Crazy Error V2\libopenblas.SVHFG5YE3RK3Z27NVFUDAPL2O3W6IMXW.gfortran-win32.dll

          Filesize

          26.5MB

          MD5

          356c73b41d0eef7f9a2b0e2734a14dee

          SHA1

          e0a6c5bc3f4e9129c76f61132d8705974955db6c

          SHA256

          c785898392f5570ba6d8223c3e8db6a99160a5d2dd52bf89a1a53b0144e9a955

          SHA512

          105dd043d7a74b53af0b5a721a4ac64f58a4665d679b2e1d295f4880991660e0053a667d7feddb80c7ca2ede78ee46982850c18a8ff047c910ab9833eede46de

        • C:\Program Files (x86)\Crazy Error V2\library.zip

          Filesize

          9.7MB

          MD5

          9b82eb9a774780767f3b8e7ec7487f6f

          SHA1

          da9dca672632a01ba558066d6c7fe59f27d11ac1

          SHA256

          aa6e100ecae3bfb97178b7125a83add4032862efbbe1ab783cac3b5da6f8532c

          SHA512

          03386d846b8a843c62218558fbda362ae295c65be87edee1add7fd13c3ac4480d621fc70de49d6180c85a2d292f125dc8fbdd50e32d010a742a4ebb53ccb91cc

        • C:\Program Files (x86)\Crazy Error V2\numpy.core._multiarray_tests.pyd

          Filesize

          101KB

          MD5

          41e7188f5db2243d49f92a3f30b0953f

          SHA1

          b075f8b929988d7c543ef6048f4076bc97aafd9b

          SHA256

          1c55dc007e653ca772fc2fff55c50cd3e96ae1213089a0f908211e87dec18ac4

          SHA512

          4d41f95ec787ec861cc3747943af49ff3c16c9b05de31358f31c0714cf7f51b5ec0dbdf04fdb513a77f3e09342903267977f1c45a382f46eab67bf16148a90f6

        • C:\Program Files (x86)\Crazy Error V2\numpy.core._multiarray_umath.pyd

          Filesize

          2.1MB

          MD5

          a231bc6e45d2ac828e4652470d6ff0a6

          SHA1

          1107ffc3501df0260bf92a5bddf2aa1e0b8fb435

          SHA256

          d84a35ff9270fb144b0e9e015434db5e727b17cc831a1d3af90398c83d9bd21e

          SHA512

          8c76b2f4a9c4e6338227fa71ad7bdb026ea5c3eaad78497835d4a16847df2c42c3f5145b9c2fb2b510157191f35418eea66ea41d9548779bf199a2c3c1caa94e

        • C:\Program Files (x86)\Crazy Error V2\numpy.linalg._umath_linalg.pyd

          Filesize

          105KB

          MD5

          9b31a4ea8120789223330010123785cf

          SHA1

          fffc08c9b1801e9bb481e62b20fa1bfd4639a28f

          SHA256

          db218aa77c9e90fdb599fe747ffb20faa4d1bbfa0d47c9f4a19d17526f4bb623

          SHA512

          67b3a0da39cf768e79fb92a745bb5b26691c3337a975869970f1a41731eea81d7fc7c79fb3ace438b7ebc2a373162341884247eef5f8b046a9bf8dc92b6dab7c

        • C:\Program Files (x86)\Crazy Error V2\numpy.linalg.lapack_lite.pyd

          Filesize

          15KB

          MD5

          e31fb05024c9212862fc936bd8de0d08

          SHA1

          c26769d73100969d6baa188406870396b87e8a02

          SHA256

          ccd64b7c9a697aaeab5f82a2287a0eca17cb249e69b320653d59c845f81781a1

          SHA512

          b5024bf300e361e0b15294dd343ea70572d60c3711ffbb51ec79f7f5e2f2da1c1373ee430ba7d6457a4466e426ec5a0a0aa1b002040b93b5c53eaaacc1efcd6c

        • C:\Program Files (x86)\Crazy Error V2\python38.dll

          Filesize

          3.7MB

          MD5

          97d893cd2879f8e9a6bc8a35d203b2f4

          SHA1

          68ddf1e3a98e080c4ef2c9d241a31dee6aec240b

          SHA256

          6e7ed993131a5beb3b96736320bafb83a063d3043015bf2b14eea6601a414ab8

          SHA512

          30804c88389b54a6119c7c134af315330afb234d743b51acbb25f11d2aec3400c7498e918294f4497e49ebf7ddac557509847d785d58fe9cd381a3fbf8eb9378

        • C:\Program Files (x86)\Crazy Error V2\select.pyd

          Filesize

          23KB

          MD5

          e6969a95ca8b62725206ebef19af0371

          SHA1

          60bfcad0dd79267793c3b8ff109a98c4201ffc18

          SHA256

          3f177ee6d35f0dbeb0f0719f4e20404abe6a101c375ab6d27fcd28aa846def2c

          SHA512

          ae45e272f4b0207dc8720681932641b53379a8b4d1ee7c878ce7804cc475069812d8dcd8689dc6383911b51af272801dbce6b076aaf60f5287c2bacbce8d95e6

        • C:\Program Files (x86)\Crazy Error V2\tcl86t.dll

          Filesize

          1.3MB

          MD5

          30195aa599dd12ac2567de0815ade5e6

          SHA1

          aa2597d43c64554156ae7cdb362c284ec19668a7

          SHA256

          e79443e9413ba9a4442ca7db8ee91a920e61ac2fb55be10a6ab9a9c81f646dbb

          SHA512

          2373b31d15b39ba950c5dea4505c3eaa2952363d3a9bd7ae84e5ea38245320be8f862dba9e9ad32f6b5a1436b353b3fb07e684b7695724a01b30f5ac7ba56e99

        • C:\Program Files (x86)\Crazy Error V2\tk86t.dll

          Filesize

          1.1MB

          MD5

          6cadec733f5be72697d7112860a0905b

          SHA1

          6a6beeef3b1bb7c85c63f4a3410e673fce73f50d

          SHA256

          19f70dc79994e46d3e1ef6be352f5933866de5736d761faa8839204136916b3f

          SHA512

          e6b3e52968c79d4bd700652c1f2ebd0366b492fcda4e05fc8b198791d1169b20f89b85ec69cefa7e099d06a78bf77ff9c3274905667f0c94071f47bafad46d79

        • \Program Files (x86)\Crazy Error V2\crazererrer.exe

          Filesize

          71KB

          MD5

          5178838b2c8cc727b9fc4c378fbd1ba8

          SHA1

          ed8959ece54717f260ae30502341a30bc52caa26

          SHA256

          1b2255aed8e8b890ea0d42318c7367c9788ffe9764ea44ec640044c4e5d1bea4

          SHA512

          6469f293dffdcb9e1ccffbae9b912909ba903c3b7c3367029c1b1c72be6810f0ba2e8b0c15ce3f5a460244aaefbd2b6a44c688a6a2806bafcefe4407650bf7ca

        • memory/1552-1141-0x000000000E050000-0x000000000E54E000-memory.dmp

          Filesize

          5.0MB

        • memory/1552-1144-0x0000000061600000-0x0000000062CA9000-memory.dmp

          Filesize

          22.7MB

        • memory/1552-1137-0x000000000B100000-0x000000000B130000-memory.dmp

          Filesize

          192KB

        • memory/1552-1138-0x000000000B100000-0x000000000B130000-memory.dmp

          Filesize

          192KB

        • memory/1552-1139-0x000000000B170000-0x000000000B171000-memory.dmp

          Filesize

          4KB

        • memory/1552-1140-0x000000000DB50000-0x000000000E04E000-memory.dmp

          Filesize

          5.0MB

        • memory/1552-1135-0x000000000B040000-0x000000000B04A000-memory.dmp

          Filesize

          40KB

        • memory/1552-1142-0x000000000B2A0000-0x000000000B2A8000-memory.dmp

          Filesize

          32KB

        • memory/1552-1143-0x000000000B2F0000-0x000000000B2F8000-memory.dmp

          Filesize

          32KB

        • memory/1552-1136-0x00000000738F0000-0x00000000738FA000-memory.dmp

          Filesize

          40KB

        • memory/1552-1152-0x0000000061600000-0x0000000062CA9000-memory.dmp

          Filesize

          22.7MB

        • memory/2204-1156-0x000000000B310000-0x000000000B340000-memory.dmp

          Filesize

          192KB

        • memory/2204-1155-0x000000000B200000-0x000000000B230000-memory.dmp

          Filesize

          192KB

        • memory/2204-1154-0x0000000073900000-0x000000007390A000-memory.dmp

          Filesize

          40KB

        • memory/2204-1153-0x000000000B040000-0x000000000B04A000-memory.dmp

          Filesize

          40KB

        • memory/2204-1158-0x000000000DD50000-0x000000000E24E000-memory.dmp

          Filesize

          5.0MB

        • memory/2204-1159-0x000000000E250000-0x000000000E74E000-memory.dmp

          Filesize

          5.0MB

        • memory/2204-1160-0x000000000B390000-0x000000000B398000-memory.dmp

          Filesize

          32KB

        • memory/2204-1161-0x000000000B3A0000-0x000000000B3A8000-memory.dmp

          Filesize

          32KB

        • memory/2204-1162-0x0000000061600000-0x0000000062CA9000-memory.dmp

          Filesize

          22.7MB