Analysis
-
max time kernel
591s -
max time network
439s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
27-09-2024 06:47
Static task
static1
Behavioral task
behavioral1
Sample
ophcrack-3.8.0-bin.zip
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
x64/ophcrack.exe
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
x64/ophcrack_nogui.exe
Resource
win11-20240802-en
Behavioral task
behavioral4
Sample
x86/ophcrack.exe
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
x86/ophcrack_nogui.exe
Resource
win11-20240802-en
General
-
Target
x86/ophcrack.exe
-
Size
14.7MB
-
MD5
d8d03eebaed1a346d9a1033612f354cc
-
SHA1
2f58c3f85abe7eccb5076ecf50498b279ab3d5f5
-
SHA256
873c6cafc53f1a461bb948aadd6d03a0c48709180aef356445024154bf4111c0
-
SHA512
028e6244634753261986b52c2aeaf20325ec63ed8919ad8306e8c68d94afe66d9a8672ab8417dc13456e26f32257ae1ce39cce4ec06acdb06b7ccd4455d6094e
-
SSDEEP
393216:jxQx3roSiRvUP8BaM/viJsv6tWKFdu9C:+x0RA8n
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
ophcrack.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ophcrack.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
ophcrack.exepid process 4072 ophcrack.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
ophcrack.exepid process 4072 ophcrack.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ophcrack.exepid process 4072 ophcrack.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\x86\ophcrack.exe"C:\Users\Admin\AppData\Local\Temp\x86\ophcrack.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4072