Analysis
-
max time kernel
27s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
19/11/2024, 13:11
General
-
Target
CRIMSON/Crimson Best.exe
-
Size
133KB
-
MD5
f71cdf848c5ca76ad9e6e879a3cb20d2
-
SHA1
ecb7ccbdca1d33430af3bfa40237d93e74a0a6a4
-
SHA256
1bf439d985e2e046c34d469d83545d4b760ca21c1f25253e35c3d7000a0c7787
-
SHA512
47a66cd6c2a0eff0a3a79bf9cc1bb201032fd0913c35fab311c7c6e601a1e768656b47092294c552f9bc867cef1e28e8a945d1dca85494964f385f753daca811
-
SSDEEP
3072:D46omPF4ZWeDwYW5CuQkj54kmqshAcmhcn:DahhUMunn7InQ
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies Internet Explorer settings 1 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CRIMSON\Crimson Best.exe"C:\Users\Admin\AppData\Local\Temp\CRIMSON\Crimson Best.exe"1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5124a9e7b6976f7570134b7034ee28d2b
SHA1e889bfc2a2e57491016b05db966fc6297a174f55
SHA2565f95eff2bcaaea82d0ae34a007de3595c0d830ac4810ea4854e6526e261108e9
SHA512ea1b3cc56bd41fc534aac00f186180345cb2c06705b57c88c8a6953e6ce8b9a2e3809ddb01daac66fa9c424d517d2d14fa45fbef9d74fef8a809b71550c7c145
-
Filesize
3KB
MD516aa7c3bebf9c1b84c9ee07666e3207f
SHA1bf0afa2f8066eb7ee98216d70a160a6b58ec4aa1
SHA2567990e703ae060c241eba6257d963af2ecf9c6f3fbdb57264c1d48dda8171e754
SHA512245559f757bab9f3d63fb664ab8f2d51b9369e2b671cf785a6c9fb4723f014f5ec0d60f1f8555d870855cf9eb49f3951d98c62cbdf9e0dc1d28544966d4e70f1
-
Filesize
1KB
MD5b9bec45642ff7a2588dc6cb4131ea833
SHA14d150a53276c9b72457ae35320187a3c45f2f021
SHA256b0abe318200dcde42e2125df1f0239ae1efa648c742dbf9a5b0d3397b903c21d
SHA512c119f5625f1fc2bcdb20ee87e51fc73b31f130094947ac728636451c46dced7b30954a059b24fef99e1db434581fd9e830abceb30d013404aac4a7bb1186ad3a
-
Filesize
4KB
-
Filesize
7.6MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
2.1MB
-
Filesize
32KB
-
Filesize
152KB