Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19/11/2024, 13:13
General
-
Target
CRIMSON.rar
-
Size
4.4MB
-
MD5
2b25769587217a2efbe211272f2865d3
-
SHA1
995f40036f7b4d9c6e67e955c0e6398ef0f77b44
-
SHA256
486b1ff53fb896c08eb98df156d8e36a1c88285ee109c7f27adc0c41ef0762ea
-
SHA512
a1fdcda646c6e7beb208d281830208a7b115de39fd665e5505921439c889a06ac97004fee60f6e4520de908832eeb6c13f02876fbbdbe1f6d7f80eca595964c0
-
SSDEEP
98304:RbhxBeuogXXlZFXlJuMeKMHB2KEc3CcFYhAvbioai3ldVy:beuow1ZFVJl2B2Yljvbioy
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\CRIMSON.rar"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zO0D8B36A6\Crimson Best.exe"C:\Users\Admin\AppData\Local\Temp\7zO0D8B36A6\Crimson Best.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2812 -s 5283⤵
- Loads dropped DLL
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
133KB
MD5f71cdf848c5ca76ad9e6e879a3cb20d2
SHA1ecb7ccbdca1d33430af3bfa40237d93e74a0a6a4
SHA2561bf439d985e2e046c34d469d83545d4b760ca21c1f25253e35c3d7000a0c7787
SHA51247a66cd6c2a0eff0a3a79bf9cc1bb201032fd0913c35fab311c7c6e601a1e768656b47092294c552f9bc867cef1e28e8a945d1dca85494964f385f753daca811
-
Filesize
152KB