Overview

overview

8

Static

static

3

CRIMSON.rar

windows11-21h2-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    CRIMSON.rar

  • Size

    4.8MB

  • Sample

    241117-rmlmhs1lds

  • MD5

    c621a656ac973e464050f3a5a57705ad

  • SHA1

    9d6f560c3d51ce652141798ebb6956d5b4515548

  • SHA256

    0c966a7beeb63c7bee76689648713ebb8ee7428f71d5f48959dcd45e940fef89

  • SHA512

    4583bc8f821d147aee46b3e8394b8aaa5a6e5b9f7d1270a8ad4c6d066c683a9b95186a938fa38b8ac486eb9cf592d97b342308c330829e96776ef02d16a6934a

  • SSDEEP

    98304:6ncLKHPZCXVBFzYb0Kkar7w5ka+YrAcycgYLHSCPedgNBQ2TwBgMke:6uKHPZClBFzwDM+xYNycg4IgU2AgMke

Score
8/10
microsoftdefense_evasiondiscoveryevasionpersistencephishingtrojan

Malware Config

Targets

    • Target

      CRIMSON.rar

    • Size

      4.8MB

    • MD5

      c621a656ac973e464050f3a5a57705ad

    • SHA1

      9d6f560c3d51ce652141798ebb6956d5b4515548

    • SHA256

      0c966a7beeb63c7bee76689648713ebb8ee7428f71d5f48959dcd45e940fef89

    • SHA512

      4583bc8f821d147aee46b3e8394b8aaa5a6e5b9f7d1270a8ad4c6d066c683a9b95186a938fa38b8ac486eb9cf592d97b342308c330829e96776ef02d16a6934a

    • SSDEEP

      98304:6ncLKHPZCXVBFzYb0Kkar7w5ka+YrAcycgYLHSCPedgNBQ2TwBgMke:6uKHPZClBFzwDM+xYNycg4IgU2AgMke

    Score
    8/10
    microsoftdefense_evasiondiscoveryevasionpersistencephishingtrojan

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Detected potential entity reuse from brand MICROSOFT.

      phishingmicrosoft
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks