Analysis
- user interaction
yes - max time kernel
18s - max time network
61s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
03/07/2026, 01:39
General
- Target CrimsonClientInstaller.exe
- Size 68.8MB
- Sample260703-b2ymmaex2p
- SHA256 13036080ca494b53e35d1c9fa2c1a71e96929e74256ec019ba76e91d3164b426
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies registry class 40 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 54 IoCs
- Suspicious use of SendNotifyMessage 49 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CrimsonClientInstaller.exe"C:\Users\Admin\AppData\Local\Temp\CrimsonClientInstaller.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-HHTGU9790F.tmp\CrimsonClientInstaller.tmp"C:\Users\Admin\AppData\Local\Temp\is-HHTGU9790F.tmp\CrimsonClientInstaller.tmp" /SL5="$502C2,70896494,913920,C:\Users\Admin\AppData\Local\Temp\CrimsonClientInstaller.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\Crimson Client\CrimsonClient.exe"C:\Users\Admin\AppData\Local\Programs\Crimson Client\CrimsonClient.exe"3⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=CrimsonClient.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\.msal\webview2\data\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=6124.3180.2187662622264300707 /pfhostedapp:fee215f08c578fefc94513ec2f7216ae510572454⤵
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\.msal\webview2\data\EBWebView /prefetch:4 /pfhostedapp:fee215f08c578fefc94513ec2f7216ae51057245 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\.msal\webview2\data\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffd27885fd8,0x7ffd27885fe4,0x7ffd27885ff05⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\.msal\webview2\data\EBWebView" --webview-exe-name=CrimsonClient.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1776 --field-trial-handle=1780,i,15777355388928383126,606915268506188459,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:fee215f08c578fefc94513ec2f7216ae510572455⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\.msal\webview2\data\EBWebView" --webview-exe-name=CrimsonClient.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2292 --field-trial-handle=1780,i,15777355388928383126,606915268506188459,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:fee215f08c578fefc94513ec2f7216ae510572455⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\.msal\webview2\data\EBWebView" --webview-exe-name=CrimsonClient.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2320 --field-trial-handle=1780,i,15777355388928383126,606915268506188459,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:fee215f08c578fefc94513ec2f7216ae510572455⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\.msal\webview2\data\EBWebView" --webview-exe-name=CrimsonClient.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3348 --field-trial-handle=1780,i,15777355388928383126,606915268506188459,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:fee215f08c578fefc94513ec2f7216ae51057245 /prefetch:15⤵
-
-
-
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
settings.dat
settings.dat
throttle_store.dat
SCT Auditing Pending Reports
CURRENT
MANIFEST-000001
data_0
data_2
data_3
data_1
Local State
Local State
Local State
Local State~RFe5a36e0.TMP
prep_Activatable Class_Hermes_perf.cache
D3DCompiler_47_cor3.dll
PresentationNative_cor3.dll
WebView2Loader.dll
vcruntime140_cor3.dll
wpfgfx_cor3.dll
CrimsonClientInstaller.tmp
settings.json
Crimson Client.lnk
Uninstall Crimson Client.lnk
memory/3712-13-0x0000000000550000-0x0000000000999000-memory.dmp
memory/3712-16-0x00000000019D0000-0x00000000019D1000-memory.dmp
memory/3712-6-0x00000000019D0000-0x00000000019D1000-memory.dmp
memory/3712-198-0x0000000000550000-0x0000000000999000-memory.dmp
memory/4028-26-0x00000178801E0000-0x00000178802E0000-memory.dmp
memory/4028-24-0x00000178801E0000-0x00000178802E0000-memory.dmp
memory/4028-29-0x0000017882A20000-0x0000017882A40000-memory.dmp
memory/4028-30-0x0000017882E40000-0x0000017882F40000-memory.dmp
memory/4028-44-0x0000017884690000-0x00000178846B0000-memory.dmp
memory/4028-37-0x0000017882C80000-0x0000017882CA0000-memory.dmp
memory/4948-205-0x0000000000260000-0x000000000034E000-memory.dmp
memory/4948-0-0x0000000000260000-0x000000000034E000-memory.dmp
memory/4948-12-0x0000000000260000-0x000000000034E000-memory.dmp
memory/5492-522-0x00007FFD4BF50000-0x00007FFD4BF51000-memory.dmp
memory/5684-532-0x00007FFD4BF50000-0x00007FFD4BF51000-memory.dmp
memory/6008-336-0x000000000F470000-0x00000000102ED000-memory.dmp
memory/6008-335-0x0000000007440000-0x000000000769F000-memory.dmp
memory/6124-293-0x00000279082C0000-0x0000027908350000-memory.dmp
memory/6124-428-0x0000027916390000-0x0000027916510000-memory.dmp
memory/6124-305-0x00000279081E0000-0x0000027908200000-memory.dmp
memory/6124-327-0x0000027909AB0000-0x0000027909AF0000-memory.dmp
memory/6124-324-0x0000027909A10000-0x0000027909A70000-memory.dmp
memory/6124-309-0x00000279083A0000-0x00000279083B0000-memory.dmp
memory/6124-313-0x0000027909930000-0x0000027909980000-memory.dmp
memory/6124-331-0x0000027900460000-0x0000027900470000-memory.dmp
memory/6124-338-0x000002790A9F0000-0x000002790AA40000-memory.dmp
memory/6124-317-0x00000279083B0000-0x00000279083D0000-memory.dmp
memory/6124-297-0x0000027908350000-0x0000027908380000-memory.dmp
memory/6124-349-0x000002790ACD0000-0x000002790AD40000-memory.dmp
memory/6124-357-0x000002790B190000-0x000002790B200000-memory.dmp
memory/6124-361-0x000002790B310000-0x000002790B3C0000-memory.dmp
memory/6124-365-0x000002790B6B0000-0x000002790B8B0000-memory.dmp
memory/6124-369-0x000002790BA20000-0x000002790BB90000-memory.dmp
memory/6124-373-0x000002790AD70000-0x000002790AD90000-memory.dmp
memory/6124-353-0x000002790AFE0000-0x000002790B190000-memory.dmp
memory/6124-391-0x000002790E890000-0x000002790E8A0000-memory.dmp
memory/6124-395-0x000002790F580000-0x000002790F590000-memory.dmp
memory/6124-285-0x0000027908C80000-0x0000027909420000-memory.dmp
memory/6124-399-0x0000027912DB0000-0x0000027912F10000-memory.dmp
memory/6124-289-0x00000279081B0000-0x00000279081E0000-memory.dmp
memory/6124-412-0x000002790B400000-0x000002790B410000-memory.dmp
memory/6124-432-0x00000279140F0000-0x0000027914100000-memory.dmp
memory/6124-301-0x0000027909820000-0x00000279098E0000-memory.dmp
memory/6124-416-0x0000027915240000-0x0000027915F30000-memory.dmp
memory/6124-424-0x0000027914000000-0x0000027914020000-memory.dmp
memory/6124-420-0x0000027915F30000-0x0000027916210000-memory.dmp
memory/6124-436-0x0000027914100000-0x0000027914120000-memory.dmp
memory/6124-278-0x0000027907FF0000-0x0000027908100000-memory.dmp
memory/6124-281-0x0000027907E60000-0x0000027907EB0000-memory.dmp
memory/6124-242-0x0000027902AA0000-0x0000027902AB0000-memory.dmp
memory/6124-246-0x0000027904E00000-0x0000027904E20000-memory.dmp
memory/6124-230-0x0000027905730000-0x0000027905F60000-memory.dmp
memory/6124-254-0x0000027904EA0000-0x0000027904EC0000-memory.dmp
memory/6124-258-0x0000027907D80000-0x0000027907DC0000-memory.dmp
memory/6124-262-0x0000027904EE0000-0x0000027904F00000-memory.dmp
memory/6124-266-0x0000027907E10000-0x0000027907E40000-memory.dmp
memory/6124-270-0x0000027907E40000-0x0000027907E60000-memory.dmp
memory/6124-250-0x0000027904E80000-0x0000027904EA0000-memory.dmp
memory/6124-234-0x0000027904D80000-0x0000027904E00000-memory.dmp
memory/6124-238-0x0000027900440000-0x0000027900460000-memory.dmp
memory/6124-210-0x0000027903AC0000-0x0000027904A20000-memory.dmp
memory/6124-214-0x00000279026B0000-0x00000279028E0000-memory.dmp
memory/6124-222-0x00000279004D0000-0x0000027900520000-memory.dmp
memory/6124-226-0x0000027902A40000-0x0000027902A80000-memory.dmp
memory/6124-218-0x0000027904A20000-0x0000027904B80000-memory.dmp
memory/6124-207-0x0000027901200000-0x0000027901E90000-memory.dmp