1d4cd57394cec1ab32f5fe4f35174a7a8e4157309eb2fde285daa928b9ca6409

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ElfCrack.exe
Size 1.8MB
Sample260819-pgwt7aeh52
SHA256 1d4cd57394cec1ab32f5fe4f35174a7a8e4157309eb2fde285daa928b9ca6409
MD5 d041c9f6298132d34df325fefea27b93
SHA1 a42b53d7a2daf356969d5961aa7d0533bdf0fdc9
SHA512 5736e1d3bea991b4c335dd9286259955837883e5da2939f3c0ed8f89567afb626dc1c07c4c18d9672394b45e223c137b846fe9e208afe506d857983b15846854
SSDEEP 24576:1ClhDaf4WHyRM4nswElwMyRpMpm+SZYKnY1kHNdwkn04qWszNusakE2b:1shWHqMeMHyRfHNd+cszNus22b
TLSH
T10585ADD2BBC0459AC6713777806B0BA78495D612ABDC94CBB9F52C131F228C05672BEF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit defense_evasion discovery persistence

Malware Config

Signatures

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Wine	ElfCrack.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	ElfCrack.exe

Program crash 25 IoCs

pid	pid_target	Process	procid_target
4384	4364	WerFault.exe	87
2008	4364	WerFault.exe	87
3568	4364	WerFault.exe	87
2596	4364	WerFault.exe	87
4556	4364	WerFault.exe	87
1484	4364	WerFault.exe	87
936	4364	WerFault.exe	87
2836	4364	WerFault.exe	87
5028	4364	WerFault.exe	87
1188	4364	WerFault.exe	87
2932	4364	WerFault.exe	87
5280	4364	WerFault.exe	87
4388	4364	WerFault.exe	87
2028	4364	WerFault.exe	87
4552	4364	WerFault.exe	87
5932	4364	WerFault.exe	87
4756	4364	WerFault.exe	87
5592	4364	WerFault.exe	87
3064	4364	WerFault.exe	87
4748	4364	WerFault.exe	87
5800	4364	WerFault.exe	87
5384	4364	WerFault.exe	87
3912	4364	WerFault.exe	87
3356	4364	WerFault.exe	87
4348	4364	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ElfCrack.exe

C:\Users\Admin\AppData\Local\Temp\ElfCrack.exe
"C:\Users\Admin\AppData\Local\Temp\ElfCrack.exe"
1⤵
- Identifies Wine through registry keys
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:4364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 312
  2⤵
  - Program crash
  PID:4384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 372
  2⤵
  - Program crash
  PID:2008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 540
  2⤵
  - Program crash
  PID:3568
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 548
  2⤵
  - Program crash
  PID:2596
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 392
  2⤵
  - Program crash
  PID:4556
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 564
  2⤵
  - Program crash
  PID:1484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 584
  2⤵
  - Program crash
  PID:936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 572
  2⤵
  - Program crash
  PID:2836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 552
  2⤵
  - Program crash
  PID:5028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 564
  2⤵
  - Program crash
  PID:1188
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 392
  2⤵
  - Program crash
  PID:2932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 548
  2⤵
  - Program crash
  PID:5280
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 564
  2⤵
  - Program crash
  PID:4388
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 544
  2⤵
  - Program crash
  PID:2028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 556
  2⤵
  - Program crash
  PID:4552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 392
  2⤵
  - Program crash
  PID:5932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 372
  2⤵
  - Program crash
  PID:4756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 580
  2⤵
  - Program crash
  PID:5592
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 564
  2⤵
  - Program crash
  PID:3064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 588
  2⤵
  - Program crash
  PID:4748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 560
  2⤵
  - Program crash
  PID:5800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 576
  2⤵
  - Program crash
  PID:5384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 392
  2⤵
  - Program crash
  PID:3912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 592
  2⤵
  - Program crash
  PID:3356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 588
  2⤵
  - Program crash
  PID:4348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4364 -ip 4364
1⤵
PID:4116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4364 -ip 4364
1⤵
PID:4336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4364 -ip 4364
1⤵
PID:5356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4364 -ip 4364
1⤵
PID:5292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4364 -ip 4364
1⤵
PID:4328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4364 -ip 4364
1⤵
PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4364 -ip 4364
1⤵
PID:800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4364 -ip 4364
1⤵
PID:3488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4364 -ip 4364
1⤵
PID:1068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4364 -ip 4364
1⤵
PID:4072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4364 -ip 4364
1⤵
PID:2688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4364 -ip 4364
1⤵
PID:6000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4364 -ip 4364
1⤵
PID:5228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4364 -ip 4364
1⤵
PID:252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4364 -ip 4364
1⤵
PID:3080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4364 -ip 4364
1⤵
PID:4580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4364 -ip 4364
1⤵
PID:2640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4364 -ip 4364
1⤵
PID:5060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4364 -ip 4364
1⤵
PID:4676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4364 -ip 4364
1⤵
PID:5468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4364 -ip 4364
1⤵
PID:3816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4364 -ip 4364
1⤵
PID:2096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4364 -ip 4364
1⤵
PID:4928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4364 -ip 4364
1⤵
PID:5036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4364 -ip 4364
1⤵
PID:5596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4364-0-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

memory/4364-1-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

memory/4364-2-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

memory/4364-3-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

memory/4364-4-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

memory/4364-5-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

memory/4364-6-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

memory/4364-7-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

memory/4364-8-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

memory/4364-9-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

memory/4364-10-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

memory/4364-11-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

memory/4364-12-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

memory/4364-13-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

memory/4364-14-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

memory/4364-15-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads