7f13bb7a4b4fdab3ee99aa40599314fb2ab48f17c02736e06894c2578b3c0a36

Resubmissions

02/08/2023, 02:43

230802-c7zmjsdd7t 7

02/08/2023, 02:35

230802-c26hxacc95 7

02/08/2023, 02:28

230802-cybt5acc84 7

Analysis

max time kernel
160s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2023, 02:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CrystalLauncherN (1).exe
Size

1.5MB
MD5

71ce62ad6a1da34bcc3a0bca71f1e2df
SHA1

c5080fcb7b9ca8a8a267e217a4df2170eafc2bb2
SHA256

7f13bb7a4b4fdab3ee99aa40599314fb2ab48f17c02736e06894c2578b3c0a36
SHA512

f519cae4b8a71700bda63672219e1a9cf15e5a94cc2d7f1b96799144f91bd2d1e6782d637b935051ba2d08d59bf84d363921420b624fcaed21518f19b1fc1d8b
SSDEEP

12288:qXlhhEayVkv/JBdBS4msNUCe65frHMnz2R9aty+v54BgC:qXlhhUQ/bdo4mz1U8z22y+vLC

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1348	CrystalLauncherN (1).exe

C:\Users\Admin\AppData\Local\Temp\CrystalLauncherN (1).exe
"C:\Users\Admin\AppData\Local\Temp\CrystalLauncherN (1).exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\CrystalLauncherInstallerNX\crystalRuntimeBranch

Filesize
8B

MD5
c00f0c4675b91fb8b918e4079a0b1bac

SHA1
f410e0466ae4b065bfa4d9010ad6056864ed4e50

SHA256
fe6d3468cf5c74d8ec2a95b40f2e05338c37a4202f8fad692d2b64a9cf9b468a

SHA512
ab1a941f8f3b436262bad2fa7b5eb3d025fe25f54b137129fd733efd5c86b1ce97b587bcfa4986ada5530e25015d9001c819b71786e91ef4e4a33aee953b591f

Download Submit
C:\Users\Admin\AppData\Local\CrystalLauncherInstallerNX\launchlog.txt

Filesize
1KB

MD5
8b4c3273a8599091fc0899978d07090e

SHA1
0c94fbd5526552b5e972e4bf50934e4c0a385fbb

SHA256
daf128ef95e8089e139f5fbd7f3afc477e2438c337041c014ead03dc642da0c3

SHA512
3d11b80c9abfbb5e3b9a972b2c55f7a1cbc38d5c2d0a9876cad7d1e42f91fb88e17ada1086d1e3cc3c0af98a84b2147b6d5d4acc9204217fab81b614edc10edc

Download Submit
C:\Users\Admin\AppData\Local\CrystalLauncherInstallerNX\launchlog.txt

Filesize
3KB

MD5
7eee80b958c6db81de2c7df46ac22628

SHA1
eac95787ead2574484a5ffc4e8374d3e39249c59

SHA256
197d05567f1e43425d2a9e768cd4087cb17892eb2c112e9cbc476780b412df0b

SHA512
429d19701670c303edd2ccb0aa23c9c9e46673afe1b1562a7dd965eafb24a5a5b9b437d39d6f8b13da3d1b7d1e8e5706a154e43543fabdf549a5b4e05e7ba234

Download Submit
C:\Users\Admin\AppData\Local\CrystalLauncherInstallerNX\launchlog.txt

Filesize
4KB

MD5
6be0c5a4238f1884be5761b71f8b4d7b

SHA1
4a96af221b81372d47411aec8c8ea674d0e35223

SHA256
12bf15805f8e24c43896170d1f125359bbd633d019145f6887214551b9889eff

SHA512
589b63848a7fe4ea07eb9f5d4330be5d715c0fb5fda7676a88c77a4e7b28d35e2003f42fb6a55f114037651a967c5d036c6be4481476e1e09adbdb504eabf7bf

Download Submit
C:\Users\Admin\AppData\Roaming\.crystalinst

Filesize
47B

MD5
2749fa9b45b9755eefafbf5517c74614

SHA1
fb0b300aa4bb371f71b4fb0e7092d1911a1f976b

SHA256
f7b96d33e37ab4efee43ea4a9d4c872a2194d288954553c6e3bb7926e2a7287c

SHA512
ad1ea746af6e8ef14edd20ecc17304fae591d3696a0f0fdab264b7a039e600f50add376356c68813c72376160c6c89ec1af2e33a9a7cc185a896b85d8d7e0180

Download Submit
memory/1348-167-0x000001B1DBC40000-0x000001B1DBC50000-memory.dmp

Filesize
64KB

Download
memory/1348-136-0x00007FF8FFB30000-0x00007FF9005F1000-memory.dmp

Filesize
10.8MB

Download
memory/1348-154-0x000001B1DBC40000-0x000001B1DBC50000-memory.dmp

Filesize
64KB

Download
memory/1348-155-0x000001B1DBC40000-0x000001B1DBC50000-memory.dmp

Filesize
64KB

Download
memory/1348-156-0x000001B1DBF50000-0x000001B1DC0F9000-memory.dmp

Filesize
1.7MB

Download
memory/1348-133-0x000001B1C1460000-0x000001B1C15F0000-memory.dmp

Filesize
1.6MB

Download
memory/1348-152-0x00007FF8FFB30000-0x00007FF9005F1000-memory.dmp

Filesize
10.8MB

Download
memory/1348-150-0x000001B1DBC40000-0x000001B1DBC50000-memory.dmp

Filesize
64KB

Download
memory/1348-146-0x000001B1DBC40000-0x000001B1DBC50000-memory.dmp

Filesize
64KB

Download
memory/1348-153-0x000001B1DBF50000-0x000001B1DC0F9000-memory.dmp

Filesize
1.7MB

Download
memory/1348-224-0x000001B1DBF50000-0x000001B1DC0F9000-memory.dmp

Filesize
1.7MB

Download
memory/1348-225-0x000001B1DBC40000-0x000001B1DBC50000-memory.dmp

Filesize
64KB

Download
memory/1348-226-0x000001B1DBC40000-0x000001B1DBC50000-memory.dmp

Filesize
64KB

Download
memory/1348-227-0x000001B1DBF50000-0x000001B1DC0F9000-memory.dmp

Filesize
1.7MB

Download
memory/1348-228-0x000001B1DBF50000-0x000001B1DC0F9000-memory.dmp

Filesize
1.7MB

Download
memory/1348-229-0x000001B1DBF50000-0x000001B1DC0F9000-memory.dmp

Filesize
1.7MB

Download
memory/1348-230-0x000001B1DBF50000-0x000001B1DC0F9000-memory.dmp

Filesize
1.7MB

Download
memory/1348-231-0x000001B1DBF50000-0x000001B1DC0F9000-memory.dmp

Filesize
1.7MB

Download