486b1ff53fb896c08eb98df156d8e36a1c88285ee109c7f27adc0c41ef0762ea

Resubmissions

19/11/2024, 13:13

19/11/2024, 13:11

max time kernel
53s
max time network
48s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 13:13

Target

CRIMSON.rar
Size

4.4MB
MD5

2b25769587217a2efbe211272f2865d3
SHA1

995f40036f7b4d9c6e67e955c0e6398ef0f77b44
SHA256

486b1ff53fb896c08eb98df156d8e36a1c88285ee109c7f27adc0c41ef0762ea
SHA512

a1fdcda646c6e7beb208d281830208a7b115de39fd665e5505921439c889a06ac97004fee60f6e4520de908832eeb6c13f02876fbbdbe1f6d7f80eca595964c0
SSDEEP

98304:RbhxBeuogXXlZFXlJuMeKMHB2KEc3CcFYhAvbioai3ldVy:beuow1ZFVJl2B2Yljvbioy

Score

7^/10

Executes dropped EXE 6 IoCs

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4384	7zFM.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Suspicious use of FindShellTrayWindow 9 IoCs

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 3292	4384	7zFM.exe	97
PID 4384 wrote to memory of 3292	4384	7zFM.exe	97
PID 4384 wrote to memory of 3700	4384	7zFM.exe	102
PID 4384 wrote to memory of 3700	4384	7zFM.exe	102
PID 4384 wrote to memory of 2956	4384	7zFM.exe	105
PID 4384 wrote to memory of 2956	4384	7zFM.exe	105
PID 4384 wrote to memory of 2912	4384	7zFM.exe	108
PID 4384 wrote to memory of 2912	4384	7zFM.exe	108
PID 4384 wrote to memory of 4304	4384	7zFM.exe	111
PID 4384 wrote to memory of 4304	4384	7zFM.exe	111
PID 4384 wrote to memory of 2392	4384	7zFM.exe	114
PID 4384 wrote to memory of 2392	4384	7zFM.exe	114

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\CRIMSON.rar"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Users\Admin\AppData\Local\Temp\7zO021E5778\Crimson Best.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO021E5778\Crimson Best.exe"
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Users\Admin\AppData\Local\Temp\7zO021B9E78\Crimson Best.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO021B9E78\Crimson Best.exe"
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Users\Admin\AppData\Local\Temp\7zO02154878\Crimson Best.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO02154878\Crimson Best.exe"
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Users\Admin\AppData\Local\Temp\7zO02197608\Crimson Best.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO02197608\Crimson Best.exe"
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Users\Admin\AppData\Local\Temp\7zO021A4408\Crimson Best.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO021A4408\Crimson Best.exe"
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Users\Admin\AppData\Local\Temp\7zO0212E208\Crimson Best.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO0212E208\Crimson Best.exe"
  2⤵
  - Executes dropped EXE
  PID:2392

C:\Users\Admin\AppData\Local\Temp\7zO021E5778\Crimson Best.exe

Filesize
133KB

MD5
f71cdf848c5ca76ad9e6e879a3cb20d2

SHA1
ecb7ccbdca1d33430af3bfa40237d93e74a0a6a4

SHA256
1bf439d985e2e046c34d469d83545d4b760ca21c1f25253e35c3d7000a0c7787

SHA512
47a66cd6c2a0eff0a3a79bf9cc1bb201032fd0913c35fab311c7c6e601a1e768656b47092294c552f9bc867cef1e28e8a945d1dca85494964f385f753daca811

Download Submit
memory/3292-12-0x00007FFA18FF3000-0x00007FFA18FF5000-memory.dmp

Filesize
8KB

Download
memory/3292-13-0x0000028CBE8B0000-0x0000028CBE8D6000-memory.dmp

Filesize
152KB

Download