c2032894c83b4edcd96e5cdd9afac76c5d2042a8cfbe2673c80b338dc390a6fa

Analysis

max time kernel
35s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
22-01-2025 20:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Black Crypt 2022.rar
Size

12.2MB
MD5

6efc9fcb4a4644a34d53c4879c10f97b
SHA1

0462644ae850d6badf55b6fae392ba650abbbda3
SHA256

c2032894c83b4edcd96e5cdd9afac76c5d2042a8cfbe2673c80b338dc390a6fa
SHA512

7b3c11f6e1e5d459cc049e2277606a3958ad31ed47c9e2df75fd47309c7a460b856ea14466621b763f5d6c5bad253d0cd6abbb66a3a206ac0d45b0f66465a6b4
SSDEEP

393216:voJzQAKrVcEyYaGZDteyCuw4a6KdBjCYTFd9ole:voJznCuTGNteduw4dKdlb9og

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3984	Black Crypt by Sudo 2022.exe
4836	stub.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x001a00000002aaa5-12.dat	upx
behavioral1/memory/4836-15-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral1/memory/4836-17-0x0000000000400000-0x0000000000467000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2192	4836	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Black Crypt by Sudo 2022.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stub.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4728	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	4728	7zFM.exe
Token: 35	4728	7zFM.exe
Token: SeSecurityPrivilege	4728	7zFM.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4728	7zFM.exe
4728	7zFM.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3984	Black Crypt by Sudo 2022.exe
1520	MiniSearchHost.exe
4836	stub.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Black Crypt 2022.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4728

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1648

C:\Users\Admin\Desktop\Black Crypt 2022\Black Crypt by Sudo 2022.exe
"C:\Users\Admin\Desktop\Black Crypt 2022\Black Crypt by Sudo 2022.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3984

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1520

C:\Users\Admin\Desktop\Black Crypt 2022\stub.exe
"C:\Users\Admin\Desktop\Black Crypt 2022\stub.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 584
  2⤵
  - Program crash
  PID:2192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4836 -ip 4836
1⤵
PID:1908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\Black Crypt 2022\Black Crypt by Sudo 2022.exe

Filesize
1.5MB

MD5
950899c9af069a739fa0a1fece3330fc

SHA1
c476682ec267357d31870c08ca4652fee19f2835

SHA256
f9c77e9dbba9d87a50b712805b6dbf52658d9c60a4b3aa638d3ab1dafa8c7feb

SHA512
d4c5b548508c8b835eaa727fb985ec07b4f94ef40675422dbf54406de6e0149f5d544d367e8c2e5bac995b2394900165ee8c828d60a47654a0fe87a5df03c7a5

Download Submit
C:\Users\Admin\Desktop\Black Crypt 2022\stub.exe

Filesize
235KB

MD5
1b0dc2b9c0952492feca5c84c6934da0

SHA1
9a9ca03f81cc38429ca1c38283a8c8385ff830cf

SHA256
42a485bc0295d1136858db0959cc03042a9fd1b1ebb9d5cf34e6f21bc07778b9

SHA512
3ca805b1865d7bc47a20b6597b0ca6174567e8a3a0ba7fd8697b5a123f8bcb9eb899303ada0035d9cb13e81b50977529fc244dbb3e5252cf56b33851e6468a1a

Download Submit
memory/4836-15-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4836-17-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download