f296f08aa0ad60e857270505d931392943d95cf7a2ecb2e0245ff785c157ca49

Analysis

max time kernel
142s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
04-09-2023 12:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CrustaceanInstaller.exe
Size

3.4MB
MD5

bd3a90f3b268ac71630666bc7ce92406
SHA1

cb6327b43c8209c1d30517b5be9a394bf73ec739
SHA256

f296f08aa0ad60e857270505d931392943d95cf7a2ecb2e0245ff785c157ca49
SHA512

11cc492ae8647376329965e610125aa956fe575d5bd3d3bedc9822f765b5ecf672b8ffa99685a004960b3ce7998670c6c67457660f352d42331750d0a20cf62e
SSDEEP

49152:SSrSrtUT0/n2mmNu+d8dVKFpHY/o1pPcFxHLC5j9ljJrS9bbroKJeq0Tl:BNukXiFxbKl

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1416	3544	WerFault.exe	84

Modifies registry class 7 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4078585466-1563564224-3678410669-1000_Classes\crustacean\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CrustaceanInstaller.exe \"%1\""	CrustaceanInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-4078585466-1563564224-3678410669-1000_Classes\crustacean	CrustaceanInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4078585466-1563564224-3678410669-1000_Classes\crustacean\ = "Installer"	CrustaceanInstaller.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4078585466-1563564224-3678410669-1000_Classes\crustacean\URL Protocol	CrustaceanInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-4078585466-1563564224-3678410669-1000_Classes\crustacean\shell\open\command	CrustaceanInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-4078585466-1563564224-3678410669-1000_Classes\crustacean\shell	CrustaceanInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-4078585466-1563564224-3678410669-1000_Classes\crustacean\shell\open	CrustaceanInstaller.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3544	CrustaceanInstaller.exe

C:\Users\Admin\AppData\Local\Temp\CrustaceanInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\CrustaceanInstaller.exe"
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:3544
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3544 -s 1348
  2⤵
  - Program crash
  PID:1416

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 448 -p 3544 -ip 3544
1⤵
PID:1668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3544-0-0x00007FF616440000-0x00007FF6167A4000-memory.dmp

Filesize
3.4MB

Download