25aaebe9ac1e88e00709534a7a3847fddd4b5519b6a711ea3c3f42969546bf38

Analysis

user interaction
yes
max time kernel
149s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 23:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
crime.cc v1.6.3 (1).rar
Size 5.0MB
Sample260815-3hcplavgpf
SHA256 25aaebe9ac1e88e00709534a7a3847fddd4b5519b6a711ea3c3f42969546bf38
MD5 2acdf5a892745822fb8016ea7e08b5ee
SHA1 4df11c7e8334d1cb0c8231c98d504a31ca00acee
SHA512 1b33cb9f79e1e0b6864bc07aba33db9b31ae4f953aa6964c98ff108a6b97b059031720212eca5335d2527579bd7139c4ae018a90c9ad94c4675c11acc60328be
SSDEEP 98304:c2FxdvkA1xmILpbkKx4rbqNI9N1HKXkOvLUFDzHl:c2Ffvt1xFpbkfWINHOTUVzF
TLSH
T12836336A46B968578783363AC4EECE4B85F9879CF95EF183522C927DE004742BC7CD81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2516	crime.cc v1.6.3.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3744	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4608	7zFM.exe
2516	crime.cc v1.6.3.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	4608	7zFM.exe
Token: 35	4608	7zFM.exe
Token: SeSecurityPrivilege	4608	7zFM.exe
Token: 33	4580	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4580	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4608	7zFM.exe
4608	7zFM.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4608	7zFM.exe
2516	crime.cc v1.6.3.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 2516	4608	7zFM.exe	90
PID 2516 wrote to memory of 3744	2516	crime.cc v1.6.3.exe	92
PID 3744 wrote to memory of 1228	3744	cmd.exe	94
PID 3744 wrote to memory of 2108	3744	cmd.exe	95
PID 3744 wrote to memory of 5876	3744	cmd.exe	96

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\crime.cc v1.6.3 (1).rar"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Users\Admin\AppData\Local\Temp\7zO00274ADA\crime.cc v1.6.3.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO00274ADA\crime.cc v1.6.3.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\7zO00274ADA\crime.cc v1.6.3.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3744
  - - C:\Windows\system32\certutil.exe
      certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\7zO00274ADA\crime.cc v1.6.3.exe" MD5
      4⤵
      PID:1228
  - - C:\Windows\system32\find.exe
      find /i /v "md5"
      4⤵
      PID:2108
  - - C:\Windows\system32\find.exe
      find /i /v "certutil"
      4⤵
      PID:5876

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004D4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crime.cc v1.6.3.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO00274ADA\crime.cc v1.6.3.exe
Size 15.7MB
SHA256 548a789f3609e76a143c08dac5219fd286363f5237142b3c60e06a347cd125d8
MD5 5c225afdf369f379642427cf0a2bb0c8
SHA1 cc91a18c7f369ff4aa3c162f66c502137d44a195
SHA512 3080021e8b51ff4e6535c7e2d6aecef3b2d70465b0e1d212e89dfbcfdca15c5e8bff98ef7125d5d14682db3d18c755bfab35340da2529b9727ea5c499d13fe3e
SSDEEP 196608:+792NJbFu38qLZb07cyvGig7PAmkrFqg7PAmkyyZqL1lFJ:RNJbFu38qLZb07cZPAmkZ7PAmky1L1V
TLSH
T18BF6BE42F7808A66C1568739C5639766D332BC09AF1357D7329CBE263FA32D05F6A381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download