Overview

overview

9

Static

static

3

Crypt.exe

windows7-x64

7

Crypt.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    138s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/10/2024, 12:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Crypt.exe
  • Size 19.8MB
  • Sample241019-pbfwsaxbpr
  • SHA256 4998131d9da04240464355e09181f10dc42234fc08f58d710b4d821ea89fc635
  • MD5 SHA1 SHA512 SSDEEP
Score
9/10
credential_accessdiscoverypersistenceransomwarespywarestealer

Malware Config

Signatures

  • Renames multiple (209) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Loads dropped DLL 30 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Crypt.exe
    "C:\Users\Admin\AppData\Local\Temp\Crypt.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2712
    • C:\Users\Admin\AppData\Local\Temp\Crypt.exe
      "C:\Users\Admin\AppData\Local\Temp\Crypt.exe"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Sets desktop wallpaper using registry
      • Suspicious use of WriteProcessMemory
      PID:4812
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
          PID:5000

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          _imaging.cp39-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27122\PIL\_imaging.cp39-win_amd64.pyd
          • Size 2.2MB
          • SHA256 d3ff732216cccef72316ab4e71f9d4aca2aa3a4a14b157a87caaa80369aec5d1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _imagingft.cp39-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27122\PIL\_imagingft.cp39-win_amd64.pyd
          • Size 1.7MB
          • SHA256 c2d3853d4299da383a2ccd842d7d4faa82746a924d9d5272e8d51e8880bcc509
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27122\VCRUNTIME140.dll
          • Size 94KB
          • SHA256 e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          VCRUNTIME140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27122\VCRUNTIME140_1.dll
          • Size 36KB
          • SHA256 04e7ccbdcad7cbaf0ed28692fb08eab832c38aad9071749037ee7a58f45e9d7d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27122\_bz2.pyd
          • Size 84KB
          • SHA256 9483c4853ca1da3c5b2310dbdd3b835a44df6066620278aa96b2e665c4b4e86b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _cffi_backend.cp39-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27122\_cffi_backend.cp39-win_amd64.pyd
          • Size 174KB
          • SHA256 fb759cb37c785bc286f8de4ca4679e887fb3981a74f458449553e0df6956cfa9
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27122\_ctypes.pyd
          • Size 123KB
          • SHA256 1548506345d220d68e9089b9a68b42a9d796141eb6236e600283951cb206eaa1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _decimal.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27122\_decimal.pyd
          • Size 267KB
          • SHA256 831e4ce99f469fa94567482444af492891b7bf327853e92dd4bb2ce092021e74
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _hashlib.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27122\_hashlib.pyd
          • Size 64KB
          • SHA256 7936413bc24307f01b90cac2d2cc19f38264d396c1ab8eda180abba2f77162eb
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27122\_lzma.pyd
          • Size 159KB
          • SHA256 4797aaf192eb56b32ca4febd1fad5be9e01a24e42bf6af2d04fcdf74c8d36fa5
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _multiprocessing.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27122\_multiprocessing.pyd
          • Size 29KB
          • SHA256 a55c37779772a36bfb5811cc349dcdc2429ef1fbab40fe4cfea9d7fcd23173ab
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _queue.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27122\_queue.pyd
          • Size 28KB
          • SHA256 b0bd6330c525b4c64d036d29a3733582928e089d99909500e8564ae139459c5f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27122\_socket.pyd
          • Size 78KB
          • SHA256 241db349093604ab25405402ba8c4212016657c7e6a10edd3110abeb1cc2e1ba
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _ssl.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27122\_ssl.pyd
          • Size 151KB
          • SHA256 31c95af04a76d3badbdd3970d9b4c6b9a72278e69d0d850a4710f1d9a01618d7
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cp1252.enc
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27122\_tcl_data\encoding\cp1252.enc
          • Size 1KB
          • SHA256 14df3ae30e81e7620be6bbb7a9e42083af1ae04d94cf1203565f8a3c0542ace0
          • MD5 SHA1 SHA512
          Submit Download

          _tkinter.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27122\_tkinter.pyd
          • Size 64KB
          • SHA256 cea57bb0f8c71c526e8bf799c3b53264b2405ed954122498f92e29735dde2901
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _uuid.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27122\_uuid.pyd
          • Size 23KB
          • SHA256 02e05c2dc07b699fb7e6178526d6f32127e8d9b7aed0720446d186824d4fd1db
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27122\base_library.zip
          • Size 828KB
          • SHA256 090e8bf3cfd95489dde8050a1944dcfd8a040df835ba84103431b286f0c32a69
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cacert.pem
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27122\certifi\cacert.pem
          • Size 292KB
          • SHA256 94edeb66e91774fcae93a05650914e29096259a5c7e871a1f65d461ab5201b47
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          md.cp39-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27122\charset_normalizer\md.cp39-win_amd64.pyd
          • Size 10KB
          • SHA256 89268be3cf07b1e3354ddb617cb4fe8d4a37b9a1b474b001db70165ba75cff23
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          md__mypyc.cp39-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27122\charset_normalizer\md__mypyc.cp39-win_amd64.pyd
          • Size 117KB
          • SHA256 969196cd7cade4fe63d17cf103b29f14e85246715b1f7558d86e18410db7bbc0
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libcrypto-1_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27122\libcrypto-1_1.dll
          • Size 3.3MB
          • SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libffi-7.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27122\libffi-7.dll
          • Size 32KB
          • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libssl-1_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27122\libssl-1_1.dll
          • Size 678KB
          • SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _sodium.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27122\nacl\_sodium.pyd
          • Size 340KB
          • SHA256 d733c23c6a4b21625a4ff07f6562ba882bcbdb0f50826269419d8de0574f88cd
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          pyexpat.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27122\pyexpat.pyd
          • Size 199KB
          • SHA256 ab0814b19fd6b10d2729a907cf449f8a858a42b3f1288fb1c93b62950059295d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          python3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27122\python3.dll
          • Size 58KB
          • SHA256 84cb29052734ec4ad5d0eac8a9156202a2077ee9bd43cabc68e44ee22a74910a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          python39.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27122\python39.dll
          • Size 4.3MB
          • SHA256 e456ef44b261f895a01efb52d26c7a0c7d7d465b647a7b5592708ebf693f12a3
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          pythoncom39.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27122\pywin32_system32\pythoncom39.dll
          • Size 654KB
          • SHA256 0789f9321abfa3a6403a483cb3ba684da5cfc39d26195fce8669a77c6367c413
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          pywintypes39.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27122\pywin32_system32\pywintypes39.dll
          • Size 131KB
          • SHA256 20bde8e50e42f7aabf59106eea238fcc0dece0c6e362c0a7feeb004ab981db8a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27122\select.pyd
          • Size 28KB
          • SHA256 5361da714a61f99136737630d50fa4e975d76f5de75e181af73c5a23a2b49012
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          tcl86t.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27122\tcl86t.dll
          • Size 1.6MB
          • SHA256 f650d6bc321bcda3fc3ac3dec3ac4e473fb0b7b68b6c948581bcfc54653e6768
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          tk86t.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27122\tk86t.dll
          • Size 1.4MB
          • SHA256 1a6d0871be2fa7153de22be008a20a5257b721657e6d4b24da8b1f940345d0d5
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          unicodedata.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27122\unicodedata.pyd
          • Size 1.1MB
          • SHA256 ba6606dcdf1db16a1f0ef94c87adf580bb816105d60cf08bc570b17312a849da
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          win32api.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27122\win32\win32api.pyd
          • Size 130KB
          • SHA256 a52f8bd28b5b9558cde10333ce452a7d6f338ce1005a2b8451755005868e4a98
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Ransom_Note.txt
          • Path C:\Users\Public\Desktop\Ransom_Note.txt
          • Size 638B
          • SHA256 d4e1e2b2a482ecddfb6cb80a4688f1a4b60b633ac42f9ce77515d9eb49823fce
          • MD5 SHA1 SHA512
          Submit Download