Analysis
-
max time kernel
73s -
max time network
72s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
14/02/2024, 13:12
General
-
Target
f175fcc7b1277b9c2d58256c3aca1fe0810b1937/CrystalUS.exe
-
Size
809KB
-
MD5
4516f5182bcaefb6a8dd7f53ce0c429f
-
SHA1
eca27762ec651c3072213262cea7cef198e827e3
-
SHA256
577403a4c07eaf6bade5f5ac6165b0ee87a4fcfd2d8e3894a3defdd5e33e9e5a
-
SHA512
44646348c6fe6080a8319738eb7a324b3f6a076abf1b38797b52b554121d752c00145d417ad3c0a5246b5e52c7f8e6a0aa99c04a8f946d40908372e01f49d361
-
SSDEEP
12288:ilsUCeelhOBEmUeRHyhubiMLnN6fMZTjeVzvEKlT/tZmG:nUYlhkRchubiMbNI1M+/tZmG
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f175fcc7b1277b9c2d58256c3aca1fe0810b1937\CrystalUS.exe"C:\Users\Admin\AppData\Local\Temp\f175fcc7b1277b9c2d58256c3aca1fe0810b1937\CrystalUS.exe"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
187B
MD5a390634f40ab90285f10bee6539ef730
SHA1ffaedc682db7266fca927bd4753a2c5c3b6e85d6
SHA256f99763c7d58e0234a30f2e88ca23a337b218ffc87280958b82bbc5f5baaf31c3
SHA512c73aa423243888c15ad7b9698591ff42acb5c7b1254f3cc253ae2564b306d9cfd69a99d45cf24ea5c88e6b49ebd02b05176238b6bc9fa976c1216e588ba3f391
-
Filesize
136KB
-
Filesize
64KB
-
Filesize
48KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
832KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB