Analysis
- max time kernel
149s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
28/06/2026, 04:29
General
- Target Crown.exe
- Size 10.6MB
- Sample260628-e4ejbafs4p
- SHA256 ca2afe9078613f5360d865ed19811710c09b3c97a10597b7693feb5205d14c90
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Themida packer 2 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Crown.exe"C:\Users\Admin\AppData\Local\Temp\Crown.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2856-0-0x0000000000400000-0x00000000017FC000-memory.dmp
memory/2856-2-0x00007FFA00000000-0x00007FFA00002000-memory.dmp
memory/2856-1-0x00007FFA00030000-0x00007FFA00031000-memory.dmp
memory/2856-4-0x00007FFA2BA2F000-0x00007FFA2BA30000-memory.dmp
memory/2856-5-0x00007FFA2B8A0000-0x00007FFA2C244000-memory.dmp
memory/2856-6-0x0000000000400000-0x00000000017FC000-memory.dmp
memory/2856-7-0x0000000000400000-0x00000000017FC000-memory.dmp
memory/2856-8-0x0000000003A80000-0x0000000003A90000-memory.dmp
memory/2856-9-0x00007FFA2B8A0000-0x00007FFA2C244000-memory.dmp
memory/2856-10-0x00007FFA2B8A0000-0x00007FFA2C244000-memory.dmp
memory/2856-11-0x00007FFA2B8A0000-0x00007FFA2C244000-memory.dmp
memory/2856-12-0x00007FFA2B8A0000-0x00007FFA2C244000-memory.dmp
memory/2856-13-0x000000001D0B0000-0x000000001D0B8000-memory.dmp
memory/2856-15-0x000000001D110000-0x000000001D11E000-memory.dmp
memory/2856-14-0x000000001D150000-0x000000001D18E000-memory.dmp
memory/2856-16-0x00007FFA2B8A0000-0x00007FFA2C244000-memory.dmp
memory/2856-18-0x0000000024A10000-0x0000000024AC2000-memory.dmp
memory/2856-19-0x0000000024F40000-0x0000000024FB6000-memory.dmp
memory/2856-17-0x00000000249C0000-0x0000000024A10000-memory.dmp
memory/2856-20-0x00007FFA2B8A0000-0x00007FFA2C244000-memory.dmp
memory/2856-21-0x00007FFA2B8A0000-0x00007FFA2C244000-memory.dmp
memory/2856-22-0x00000000248E0000-0x00000000248FE000-memory.dmp
memory/2856-23-0x0000000000400000-0x00000000017FC000-memory.dmp
memory/2856-25-0x00007FFA2B8A0000-0x00007FFA2C244000-memory.dmp
memory/2856-26-0x00007FFA2B8A0000-0x00007FFA2C244000-memory.dmp
memory/2856-27-0x00007FFA2B8A0000-0x00007FFA2C244000-memory.dmp
memory/2856-28-0x00007FFA2B8A0000-0x00007FFA2C244000-memory.dmp
memory/2856-29-0x00007FFA2B8A0000-0x00007FFA2C244000-memory.dmp
memory/2856-30-0x00007FFA2B8A0000-0x00007FFA2C244000-memory.dmp
memory/2856-32-0x00007FFA2B8A0000-0x00007FFA2C244000-memory.dmp