Analysis
- user interaction
yes - max time kernel
18s - max time network
23s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
25/09/2026, 10:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
AdvancedMechanics crock/AdvancedMechanics/AMCRACK.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
4 signatures
900 seconds
Behavioral task
behavioral2
Sample
AdvancedMechanics crock/AdvancedMechanics/AdvancedMechanics.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
1 signatures
900 seconds
General
- Target AdvancedMechanics crock/AdvancedMechanics/AMCRACK.exe
- Size 10KB
- Sample260925-mcaeaatfkd
- SHA256 93770202bd151660c9e6277c863f3e89cd797852d809514532315907d12efcf8
- MD5 2b1dde15530d58da02fb35c6168b5de7
- SHA1 a51421684aec930088424f6cf5d0ee2d1c8d3087
- SHA512 58d8f5948d9cc8289c93044ba14f2f7ea1809f83d5d3947fd0f076b8e8fd5eaf0b1cda83bffd29b7c066a2e2f1452527dd1fbc5ecfe5eae6956a0a87f6ddc131
- SSDEEP 192:NMKJBrMuj/wSUwlFDZQSNQFva8HrvUsZaQa8aeamwwRXXfobAPB0:Jv8sCFvzMskNhDmwwRXXfobu
- TLSH T18122B45AABE88904F4FF5B34E8724B01AA71B82B4E7AC74E04C504FD0E617E489D37A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs
pid Process 4792 AdvancedMechanics.exe 4792 AdvancedMechanics.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe 2356 AMCRACK.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2356 AMCRACK.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2356 wrote to memory of 4792 2356 AMCRACK.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\AdvancedMechanics crock\AdvancedMechanics\AMCRACK.exe"C:\Users\Admin\AppData\Local\Temp\AdvancedMechanics crock\AdvancedMechanics\AMCRACK.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\AdvancedMechanics crock\AdvancedMechanics\AdvancedMechanics.exe"C:\Users\Admin\AppData\Local\Temp\AdvancedMechanics crock\AdvancedMechanics\AdvancedMechanics.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4792
-