Analysis
- user interaction
yes - max time kernel
157s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
14/07/2026, 01:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
travelers_cracked.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
travelers_cracked.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target travelers_cracked.exe
- Size 2.7MB
- Sample260714-b2cedsct2r
- SHA256 0d77e69db97dc7d4e80762cdc020e8c415e3dc4c80b72b7058203915fed672a6
- MD5 ef8a50fc4788953f2f69a604ae28e41e
- SHA1 ebc5c6eb8d2900eeaee67e53b8ac6b0a4addc49f
- SHA512 ebb9237fac321e83cce9f39c287e4df41a40fb4ea74b1b29b98522f37c610a02a3374de4bbb301fc8a40dabba5041f5a8b525dd4446363b6e57aa07d31fe9620
- SSDEEP 49152:1b1GMRApj3Z/aNcJhm26iCUndQGnZhuB5fVmsD+:GXRZ/aNr2r3
- TLSH T102D57DE69BF841E8F16ED074C4165217E36238242B30DEEB1BA44D119F7FAD6C7B5A80
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\Windows Details\dummy.obj travelers_cracked.exe File created C:\Program Files\Windows Details\dummy.mtl travelers_cracked.exe File created C:\Program Files\Windows Details\Rig1_diff.png travelers_cracked.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4908 travelers_cracked.exe 3932 travelers_cracked.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\travelers_cracked.exe"C:\Users\Admin\AppData\Local\Temp\travelers_cracked.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:4908
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:516
-
C:\Users\Admin\AppData\Local\Temp\travelers_cracked.exe"C:\Users\Admin\AppData\Local\Temp\travelers_cracked.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:3932
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Windows Details\Rig1_diff.png
- Size 9KB
- SHA256 860cd70b5959df839ba48516bf6a3c959b7f4183caebc44ac1a55d131debe28b
- MD5 35bd1e6fa7087416b4a7ddf11beb32a4
- SHA1 22b5b7f5f7a96c21440c0a09cce2e2b7d0ab905b
- SHA512 2c64268ce4d866d0133734792a5c442fabbdcef368b49483c1b5645bbc90eb4853b0fd5952c4fe2697ac4339deab890efd59ecc8e71fc2a9a81d87c7cd3b09fb
- SSDEEP 192:xRHgQFPRhRMoAR2YvH9cS1UpDOrbOGRij04Utmd:MQF+oArqDOrqGRi9m0
- TLSH T16A12D38F40C9F2FCD42AA8D1211C65B7E82E7F068B99BE115E1FEFDC50C14702A99D06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Details\dummy.mtl
- Size 213B
- SHA256 fc8e1fe338adbcc4b6b45b28d9286869a17f13d445ce7c3900125731eb797b71
- MD5 01f33e33ea45d152457689658158d2d9
- SHA1 71e1e4dd83b952d40bfc5bc74924359f92282a04
- SHA512 4d924f8a7c90f210f3e75879327eab2d962dd6fe66d64eda6ef9d8bc0cfb6d96d7149668ae2c946ecbd736db5b75202cee2bc4ebb87eafecb3487206826050c8
- TLSH T140D05EE8468E2845E215EA410E8F0204CE311F1EEE34940CD391A502BAE111501B82CE
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Windows Details\dummy.obj
- Size 602KB
- SHA256 cda891d8d46685ab3049effaf91e980421e84e061c3034ebf9a1bb7d91e351ea
- MD5 c179b8104e834af9fa7bb6140d3ae71f
- SHA1 0ba9c93a0eead8b5cef493357ef94a23efda6efc
- SHA512 18088ec98066d59cb52a202ff67f9fb73dff3abd555838a12221d7229273a3e72ed84f537aeda60edbf68d60edb8d981f21d9a62ded3884c551d67ce248072f6
- SSDEEP 3072:3VV19vXdUiuLu29eDqlrD0Xjuimu5ocV01S3DzMEnJ2Y0n9399dxWnpsBfMeMJTo:m
- TLSH T1BDD4C6F14FF851A4B57EE1B4C425435BE3473A352BA2ED6C0A748E319A3D98BC3949C8
- MD5 SHA1 SHA512 SSDEEP TLSH