1d4cd57394cec1ab32f5fe4f35174a7a8e4157309eb2fde285daa928b9ca6409

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ElfCrack.exe
Size 1.8MB
Sample260819-pgwt7aeh52
SHA256 1d4cd57394cec1ab32f5fe4f35174a7a8e4157309eb2fde285daa928b9ca6409
MD5 d041c9f6298132d34df325fefea27b93
SHA1 a42b53d7a2daf356969d5961aa7d0533bdf0fdc9
SHA512 5736e1d3bea991b4c335dd9286259955837883e5da2939f3c0ed8f89567afb626dc1c07c4c18d9672394b45e223c137b846fe9e208afe506d857983b15846854
SSDEEP 24576:1ClhDaf4WHyRM4nswElwMyRpMpm+SZYKnY1kHNdwkn04qWszNusakE2b:1shWHqMeMHyRfHNd+cszNus22b
TLSH
T10585ADD2BBC0459AC6713777806B0BA78495D612ABDC94CBB9F52C131F228C05672BEF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit defense_evasion discovery persistence

Malware Config

Signatures

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Wine	ElfCrack.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	ElfCrack.exe

Program crash 25 IoCs

pid	pid_target	Process	procid_target
3952	1536	WerFault.exe	86
1232	1536	WerFault.exe	86
2356	1536	WerFault.exe	86
2756	1536	WerFault.exe	86
1700	1536	WerFault.exe	86
692	1536	WerFault.exe	86
3792	1536	WerFault.exe	86
448	1536	WerFault.exe	86
116	1536	WerFault.exe	86
3632	1536	WerFault.exe	86
3552	1536	WerFault.exe	86
4736	1536	WerFault.exe	86
3332	1536	WerFault.exe	86
4704	1536	WerFault.exe	86
4000	1536	WerFault.exe	86
4528	1536	WerFault.exe	86
4624	1536	WerFault.exe	86
3788	1536	WerFault.exe	86
4452	1536	WerFault.exe	86
3740	1536	WerFault.exe	86
4136	1536	WerFault.exe	86
3812	1536	WerFault.exe	86
1992	1536	WerFault.exe	86
4428	1536	WerFault.exe	86
3288	1536	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ElfCrack.exe

C:\Users\Admin\AppData\Local\Temp\ElfCrack.exe
"C:\Users\Admin\AppData\Local\Temp\ElfCrack.exe"
1⤵
- Identifies Wine through registry keys
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:1536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 256
  2⤵
  - Program crash
  PID:3952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 332
  2⤵
  - Program crash
  PID:1232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 340
  2⤵
  - Program crash
  PID:2356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 488
  2⤵
  - Program crash
  PID:2756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 496
  2⤵
  - Program crash
  PID:1700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 524
  2⤵
  - Program crash
  PID:692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 528
  2⤵
  - Program crash
  PID:3792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 548
  2⤵
  - Program crash
  PID:448
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 556
  2⤵
  - Program crash
  PID:116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 492
  2⤵
  - Program crash
  PID:3632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 540
  2⤵
  - Program crash
  PID:3552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 524
  2⤵
  - Program crash
  PID:4736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 548
  2⤵
  - Program crash
  PID:3332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 516
  2⤵
  - Program crash
  PID:4704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 532
  2⤵
  - Program crash
  PID:4000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 328
  2⤵
  - Program crash
  PID:4528
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 504
  2⤵
  - Program crash
  PID:4624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 496
  2⤵
  - Program crash
  PID:3788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 544
  2⤵
  - Program crash
  PID:4452
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 340
  2⤵
  - Program crash
  PID:3740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 544
  2⤵
  - Program crash
  PID:4136
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 548
  2⤵
  - Program crash
  PID:3812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 336
  2⤵
  - Program crash
  PID:1992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 540
  2⤵
  - Program crash
  PID:4428
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 488
  2⤵
  - Program crash
  PID:3288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1536 -ip 1536
1⤵
PID:3544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1536 -ip 1536
1⤵
PID:2152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1536 -ip 1536
1⤵
PID:3360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1536 -ip 1536
1⤵
PID:2600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1536 -ip 1536
1⤵
PID:452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1536 -ip 1536
1⤵
PID:3232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1536 -ip 1536
1⤵
PID:2304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 1536 -ip 1536
1⤵
PID:1108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 1536 -ip 1536
1⤵
PID:3836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 1536 -ip 1536
1⤵
PID:4784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1536 -ip 1536
1⤵
PID:3832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 1536 -ip 1536
1⤵
PID:856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1536 -ip 1536
1⤵
PID:372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 1536 -ip 1536
1⤵
PID:3176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 1536 -ip 1536
1⤵
PID:4832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 1536 -ip 1536
1⤵
PID:2448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 1536 -ip 1536
1⤵
PID:4024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 1536 -ip 1536
1⤵
PID:900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 1536 -ip 1536
1⤵
PID:2748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 1536 -ip 1536
1⤵
PID:3096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 1536 -ip 1536
1⤵
PID:1824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 1536 -ip 1536
1⤵
PID:4824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 1536 -ip 1536
1⤵
PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 1536 -ip 1536
1⤵
PID:2164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 1536 -ip 1536
1⤵
PID:5032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1536-0-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

memory/1536-1-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

memory/1536-2-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

memory/1536-3-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

memory/1536-4-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

memory/1536-5-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

memory/1536-6-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

memory/1536-7-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

memory/1536-8-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

memory/1536-9-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

memory/1536-10-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

memory/1536-11-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

memory/1536-12-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

memory/1536-13-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

memory/1536-14-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

memory/1536-15-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads