Malwagon
file icon
Crystal Snoser.exe File Analysis · first seen Oct 22, 2026 14:26 · 15.0 MB
113proc 108files 4reg 4drops 7IOCs
Suspicious46 Completed Public
Get sample Report Sign in

Crystal Snoser.exePE analysis report - Suspicious

Run integrity

sample ran

The guest staged the sample and launched it, so what follows describes this file rather than an empty desktop.

32.3sto launch
248telemetry events
230observed
58agent notes

Suspicious

46/100

11 points past the suspicious line at 35, 24 short of malicious at 70.

Clean0-34 Suspicious35-69 Malicious70-100

Why this verdict

+30
Static analysis
  • 1 high-risk capability(ies): sandbox evasion
  • 4 supporting capabilities in one unsigned binary: file discovery, obfuscation, process discovery, system information
  • Weak exploit-mitigation posture (no ASLR/DEP/CFG) and unsigned
  • Local ML score 99.0
+16
Runtime behavior
  • Dropped an executable to disk
  • 1 Sigma rule match(es): Uncommon Child Process Of Conhost.EXE
+0
Model review
  • findings review (advisory, not scored): malicious - recursive self-spawn, dropped executables, anti-vm queries, xor encoding

Model reading

Measured SUSPICIOUS46 of 100

Evidence ledger above, row by row. Published verdict rests on this column and on nothing to its right.

Model reads it asadvisory, no points NOT ASSESSEDnot shown on this page

Reads this report's derived findings, never the sample itself.

A model reading exists for this scan and is shown to the submitter and to staff only. It is a second opinion about evidence the score already priced, it is worth no points, and on a public page it would stand beside the verdict with no grounding a stranger could check.

Analysis layers

Static ran moved the score
Dynamic ran moved the score
Threat intel local feeds only no points
AI not included

Sample

TypeFile
MIMEapplication/vnd.microsoft.portable-executable

Run conditions

Sandbox OSWindows 10
EnvironmentWorkgroup
InternetIsolated
Execution165s
Guest hardware2 vCPU4095 MB RAM

Detection signatures

12 detected · 5 withheld as common
Severity Detection Evidence Layer
MED
Dropped an executable to disk
MITRE T1105
file C:\Users\user\AppData\Local\Temp\7zSC47E8624\run.bat dropped
file C:\Users\user\AppData\Local\Temp\7zSC47E8624\Crystal Snoser TG.exe dropped
file C:\Users\user\AppData\Local\Temp\7zSC47E8624\soft.exe dropped
file C:\Users\user\AppData\Local\Temp\_MEI23322\VCRUNTIME140.dll dropped
dynamic
MED
Executes external code / commands
MITRE T1059
confirmed at runtime, seen in 30% of benign software statically
capability createprocessw capability: execution
capability shellexecuteexw capability: execution
static
MED
High file entropy (encrypted/compressed payload)
MITRE T1027
entropy 8.00 threshold 7.20, maximum 8.00
static
MED
Weak exploit mitigations and unsigned
MITRE T1027
mitigation posture: weak
signature unsigned
static
LOW
Deletes files/backups (WriteFile + DeleteFile recursion)
MITRE T1485
seen in 14% of benign software
import kernel32.dll!DeleteFileW requires deletefile
import kernel32.dll!FindNextFileW requires findnextfile
static
LOW
Drops + executes from temp (GetTempPath + CreateProcess)
MITRE T1204
seen in 7% of benign software
import kernel32.dll!GetTempPathW requires gettemppath
import kernel32.dll!CreateProcessW requires createprocess
static
LOW
Executes via ShellExecute
MITRE T1204
seen in 12% of benign software
import shell32.dll!ShellExecuteExW
static
LOW
Hides its window (ShowWindow SW_HIDE pattern)
MITRE T1564.003
seen in 13% of benign software
import user32.dll!ShowWindow
static
LOW
Marks files hidden/system (SetFileAttributes)
MITRE T1564.001
seen in 10% of benign software
import kernel32.dll!SetFileAttributesW
static
LOW
Spawns child processes
MITRE T1106
seen in 16% of benign software
import kernel32.dll!CreateProcessW
static
LOW
Timestomping (SetFileTime)
MITRE T1070.006
seen in 6% of benign software
import kernel32.dll!SetFileTime
static
INFO
Stages in the temp directory (GetTempPath)
MITRE T1074
seen in 15% of benign software
import kernel32.dll!GetTempPathW
static
Withheld: 5 rules fired and were not reported above

These rules matched this sample, and they also match this much of known-clean software (measured over 1145 signed Windows and third-party binaries). A rule that fires on most clean files cannot move a verdict, so it is held back unless the detonation confirms the behaviour. They are listed because a count that shrinks without saying so is not a count an analyst can check.

Dynamic API resolution (obfuscation) fires on 65% of benign software
Resolves APIs dynamically (LoadLibrary + GetProcAddress) fires on 49% of benign software
Reads its own startup info (parent/desktop check) fires on 36% of benign software
Queries system information (host recon) fires on 25% of benign software
Enumerates files recursively (staging/collection) fires on 21% of benign software

What the tests returned

5 tests

Each test this run performed and what it returned. A test that was not performed says so rather than reading as a negative result.

TestResult
Persistence mechanismsnone established at runtime
Cross-process injectionnone observed
Network connectionsthe capture came up and attributed no outbound connection; this run had no route out, so none could have succeeded in any case
Known-malicious hash (reputation sources)no source reported this file
Local anti-virus enginereported no detection

Absence of an observation is not proof of absence - see Coverage for what this run could and could not test.

Arguing against malice

  • The local anti-virus engine reported no detection.
  • No reputation source reported this file as malicious.

How much weight this carries

Confirmed. Independent external evidence, or the same behaviour seen by more than one analysis layer. The one fact that decided it: several independent runtime observations.

Instrument coverage

0 of 4 measured

What this run was able to observe, as the run itself recorded it. A layer that did not run makes an empty result a fact about the sandbox rather than about the sample.

LayerRanWhat that means
Runtime anti-analysis watch not measured Not measured. No in-process monitor reported in on this run, so the runtime anti-debug and anti-VM calls were never watched and an empty list is not a finding about the sample.
API call sequence not measured Not measured. No anti-analysis hook armed on this run, so this sequence carries interpreter spawns only and an empty one does not mean the sample called no APIs.
Explicit module loads not measured Not measured. No in-process monitor reported in on this run, so no module load could be recorded and an empty list does not mean the sample loaded nothing.
Network capture not on this plan Not included on this scan's plan.
Live kernel introspection not measured Not measured. This run did not ask for the memory-dump option, which is what starts the introspection loop.

This lists the layers this run recorded for itself. A layer that is not listed was not recorded either way, so its absence here is not a result.

Structure

What the file is made of: headers, imports, how it was built and whether it was signed.

Signature
7-Zip
Not packed Unsigned
CompilerMicrosoft Visual C/C++(19.36.35226)[C]
LinkerMicrosoft Linker(6.00.8047)
Installer7-Zip
Identity
File
typeexecutable
size15.0 MB
file arch32-bit (x86)
subsystemGUI
entropy7.9994
date2026-04-27 09:00:00 UTC
version26.01
description7z Setup SFX
product7-Zip
original name7zS.sfx.exe
languageEN, NEU

Antivirus engine

no signature matched signature set 28160 - 3.6M signatures

Nothing in the signature set below matched this file. That is one engine's negative answer against one signature set on one day, and it is not a verdict. A signature engine only recognises what has already been named and published, so a file nobody has named yet scans exactly like a file that is harmless. What this file does when it runs is the stronger evidence; read the behaviour sections for that.

Signature setValue
Set version28160
Signatures in the set3,642,883
Set published21 Oct 2026 06:25 +0000
Age when this file was scannedsame day

A negative answer is only as good as the signature set that gave it, so the set is recorded with the result and the result can be reproduced against it.

Local ML assessment

99.0 of 100 8 strongest of 2568 features

A gradient-boosted model running entirely on this host scored this file 99.0 of 100 on structure alone: its headers, sections, imports, strings and signature. The file was not executed and nothing about it left this machine.

Read this as corroboration and not as a verdict. Measured across this corpus the model separates signed software from unsigned software more sharply than malicious from benign, so it is charged at most 15 of 100 verdict points and only on top of evidence this report measured for itself. The eight features below are the ones that moved it furthest.

Structural featureWhat it meansPushesWeight
image flag dll Image flag: a library rather than a program towards malicious +0.6885
parser warning: Suspicious flags set for section... Header defect reported by the parse: Suspicious flags set for section... (0) towards benign -0.5362
section entropy .rsrc Byte randomness of section .rsrc towards malicious +0.4350
coff.timestamp Build timestamp recorded in the header (1777280384) towards malicious +0.4290
feature column 2478 When a timestamp authority countersigned the signature towards malicious +0.3833
resource directory size Size of the resource table (190880) towards benign -0.3173
security directory size Size of the security table (0) towards malicious +0.3100
feature column 993 Byte randomness of the data appended after the last section towards benign -0.2736

A weight is a log-odds nudge away from the model's own baseline, not a percentage point. Where a feature names a section, an import or a build id, the number beside it is the model's own hashed cell for that name rather than a measurement of the file: two names can share one cell and the sign comes from the hash, so no number is shown for those rows.

Packing
Not packed
This file's code is readable on disk - nothing is compressed or encrypted around it.
12/100
packer confidence
Static analysis reads this file directly Nothing is hiding the code from a static pass, so what the file contains is what the report shows.
Indicators weighed 4 signals
  • High-entropy overlay (8.0, 15376810 bytes)
  • High-entropy resource (possible packed payload)
  • High-entropy resource (possible packed payload)
  • High-entropy resource (possible packed payload)

Family configuration search

Incomplete

1 of this platform's 69 family parsers could not decode this file, and none produced a configuration. A parser that carries no signature of its own is handed every file, and every parser that has ever failed here is one of those, so a failure is usually a decoder meeting a family it was not written for rather than a reading about this sample. Where the two numbers below differ, a signature did match and its decoder then returned nothing. The absence of a configuration is not evidence that none is present.

Parsers available69
Returned a result1
Failed to decode1

Capabilities

5 behaviour buckets
SeverityCapabilityMITREAPIs
med Code execution
Creates processes / runs commands or shellcode
 T1106, T1203 createprocessw, shellexecuteexw
med Ransomware behaviour
Enumerates + encrypts files, deletes backups
 T1083 findfirstfilew, findnextfilew
med Evasion / stalling
Sleeps, times, or otherwise stalls analysis
 T1497.003 gettickcount, sleep
med Dynamic API resolution
Resolves APIs at runtime (obfuscation)
 T1129 getprocaddress
low Discovery
Enumerates the host, users, processes or network
 T1082 getsysteminfo

Security mitigations

weak posture
OFF ASLR (DynamicBase)
OFF High-entropy ASLR (64-bit)
ON DEP / NX (NxCompat)
OFF Control Flow Guard
? SafeSEH
? Stack cookies (GS)
OFF Force Integrity
OFF AppContainer isolation
OFF Authenticode signed

Atypical for a benign modern build - common in packed/repacked malware.

Rich header (toolchain)

richhash 5c5223dd1b0955e6
ToolBuildUses
prodid_1180473
prodid_1472998
prodid_10804711
Linker 5.10 (OMF)80472
Linker 7.1021901
Import (linker)0143
C++ (VS2003)21799
prodid_11978268
Cvtres 14.10352261
prodid_1097822
Utc1700_C4021912
Utc1900 (VS2017)293361
CVTRes17351
Linker mismatch - possible tampering

Sections

5 sections · the file's memory layout
SectionVirtual addrRaw sizeVirtual sizeAccessEntropy
.textEP
Executable code
 0x1000
105.0 KB
104.9 KB
EXECUTEREAD
6.6311
.rdata
Read-only data
 0x1c000
15.0 KB
15.0 KB
READ
4.5149
.data
Initialised data
 0x20000
512.0 B
13.1 KB
expands
READWRITE
2.9292
.sxdata
Safe exception handlers
 0x24000
512.0 B
4.0 B
READWRITE
0.0204
.rsrc
Resources
 0x25000
186.5 KB
186.4 KB
READ
7.986
code data imports/exports resources metadata packer non-standard Entropy above 7.0 means compressed or encrypted content.

Imports

103 funcs / 5 DLLs · 6 suspicious
▸OLEAUT32.dll3 funcs
NameFile RVAIs undocumentedMITRE (tactic - technique)
SysAllocStringLen 0x0001c154 - -
SysStringLen 0x0001c158 - -
VariantClear 0x0001c15c - -
▸USER32.dll16 funcs
NameFile RVAIs undocumentedMITRE (tactic - technique)
DialogBoxParamW 0x0001c16c - -
SetWindowLongW 0x0001c170 - -
GetWindowLongW 0x0001c174 - -
GetDlgItem 0x0001c178 - -
SetTimer 0x0001c17c - -
LoadStringW 0x0001c180 - -
CharUpperW 0x0001c184 - -
DestroyWindow 0x0001c188 - -
EndDialog 0x0001c18c - -
PostMessageW 0x0001c190 - -
SetWindowTextW 0x0001c194 - -
ShowWindow 0x0001c198 - -
MessageBoxW 0x0001c19c - -
LoadIconW 0x0001c1a0 - -
KillTimer 0x0001c1a4 - -
SendMessageW 0x0001c1a8 - -
▸SHELL32.dll1 func
NameFile RVAIs undocumentedMITRE (tactic - technique)
ShellExecuteExW 0x0001c164 - -
▸MSVCRT.dll27 funcs
NameFile RVAIs undocumentedMITRE (tactic - technique)
_controlfp 0x0001c0e4 - -
__set_app_type 0x0001c0e8 - -
__p__fmode 0x0001c0ec - -
__p__commode 0x0001c0f0 - -
_adjust_fdiv 0x0001c0f4 - -
__setusermatherr 0x0001c0f8 - -
_initterm 0x0001c0fc - -
__getmainargs 0x0001c100 - -
_acmdln 0x0001c104 - -
exit 0x0001c108 - -
_XcptFilter 0x0001c10c - -
_exit 0x0001c110 - -
?terminate@@YAXXZ 0x0001c114 - -
??1type_info@@UAE@XZ 0x0001c118 - -
_except_handler3 0x0001c11c - -
_beginthreadex 0x0001c120 - -
memset 0x0001c124 - -
wcsstr 0x0001c128 - -
free 0x0001c12c - -
malloc 0x0001c130 - -
memcpy 0x0001c134 - -
_CxxThrowException 0x0001c138 - -
_purecall 0x0001c13c - -
memmove 0x0001c140 - -
memcmp 0x0001c144 - -
wcscmp 0x0001c148 - -
__CxxFrameHandler 0x0001c14c - -
▸KERNEL32.dll56 funcs 6 suspicious
NameFile RVAIs undocumentedMITRE (tactic - technique)
CreateProcessW 0x0001c000 - T1106
GetStartupInfoA 0x0001c004 - -
InitializeCriticalSection 0x0001c008 - -
ReleaseSemaphore 0x0001c00c - -
CreateSemaphoreW 0x0001c010 - -
ResetEvent 0x0001c014 - -
SetEvent 0x0001c018 - -
CreateEventW 0x0001c01c - -
GetModuleHandleW 0x0001c020 - -
GetVersion 0x0001c024 - -
VirtualFree 0x0001c028 - -
VirtualAlloc 0x0001c02c - T1055
Sleep 0x0001c030 - -
GlobalMemoryStatus 0x0001c034 - -
GetSystemInfo 0x0001c038 - -
GetCurrentProcess 0x0001c03c - -
GetProcessAffinityMask 0x0001c040 - -
SetEndOfFile 0x0001c044 - -
WriteFile 0x0001c048 - -
ReadFile 0x0001c04c - -
SetFilePointer 0x0001c050 - -
GetFileSize 0x0001c054 - -
GetFileAttributesW 0x0001c058 - -
GetModuleHandleA 0x0001c05c - -
GetProcAddress 0x0001c060 - T1129
FindNextFileW 0x0001c064 - T1083
FindFirstFileW 0x0001c068 - T1083
FindClose 0x0001c06c - -
GetStdHandle 0x0001c070 - -
GetFileInformationByHandle 0x0001c074 - -
GetCurrentThreadId 0x0001c078 - -
GetTickCount 0x0001c07c - T1497
GetCurrentProcessId 0x0001c080 - -
GetTempPathW 0x0001c084 - -
GetCurrentDirectoryW 0x0001c088 - -
SetCurrentDirectoryW 0x0001c08c - -
SetLastError 0x0001c090 - -
DeleteFileW 0x0001c094 - -
CreateDirectoryW 0x0001c098 - -
RemoveDirectoryW 0x0001c09c - -
SetFileAttributesW 0x0001c0a0 - -
CreateFileW 0x0001c0a4 - -
SetFileTime 0x0001c0a8 - -
GetSystemDirectoryW 0x0001c0ac - -
FormatMessageW 0x0001c0b0 - -
LocalFree 0x0001c0b4 - -
GetModuleFileNameW 0x0001c0b8 - -
LoadLibraryExW 0x0001c0bc - -
DeleteCriticalSection 0x0001c0c0 - -
EnterCriticalSection 0x0001c0c4 - -
LeaveCriticalSection 0x0001c0c8 - -
GetLastError 0x0001c0cc - -
GetVersionExW 0x0001c0d0 - -
WaitForSingleObject 0x0001c0d4 - -
CloseHandle 0x0001c0d8 - -
GetCommandLineW 0x0001c0dc - -

Binary metadata

what the headers declare about this build
Resource langsENNEU
Debug infono
TLS callbacksno

Code signing

Unsigned

This binary carries no Authenticode signature. Unsigned executables are a weak suspicious signal - most legitimate vendor software is signed.

Capability detection

33 capabilities
CapabilityNamespace
create process on Windows host-interaction/process/create
create or open file -
link function at runtime on Windows linking/runtime-linking
delay execution -
hide graphical window host-interaction/gui/window/hide
PEB access -
access PEB ldr_data linking/runtime-linking
get ntdll base address linking/runtime-linking
set file attributes host-interaction/file-system/meta
get file attributes host-interaction/file-system/meta
get kernel32 base address linking/runtime-linking
get process heap force flags host-interaction/process
allocate memory -
allocate or change RW memory -
create thread host-interaction/thread/create
encode data using XOR data-manipulation/encoding/xor
accept command line arguments host-interaction/cli
get OS version -
contain loop -
create directory host-interaction/file-system/create
delete file host-interaction/file-system/delete
get common file path host-interaction/file-system
check if file exists host-interaction/file-system/exists
get file size host-interaction/file-system/meta
read file on Windows host-interaction/file-system/read
write file on Windows host-interaction/file-system/write
clear file content host-interaction/file-system/write
get system information on Windows host-interaction/os/info
get memory capacity host-interaction/hardware/memory
resolve function by parsing PE exports load-code/pe
check OS version host-interaction/os/version
reference analysis tools strings anti-analysis
reference anti-VM strings targeting Xen anti-analysis/anti-vm/vm-detection
ATT&CK techniques
Defense Evasion::File and Directory Permissions Modification [T1222]Defense Evasion::Hide Artifacts::Hidden Window [T1564.003]Defense Evasion::Obfuscated Files or Information [T1027]Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]Discovery::File and Directory Discovery [T1083]Discovery::Process Discovery [T1057]Discovery::System Information Discovery [T1082]Execution::Command and Scripting Interpreter [T1059]Execution::Shared Modules [T1129]
Malware Behavior Catalog
Anti-Behavioral Analysis::Debugger Detection::Process Environment BlockAnti-Behavioral Analysis::Dynamic Analysis Evasion::Delayed ExecutionAnti-Behavioral Analysis::Virtual Machine DetectionData::Encode Data::XORDefense Evasion::Obfuscated Files or Information::Encoding-Standard AlgorithmDiscovery::Analysis Tool Discovery::Process detectionDiscovery::File and Directory DiscoveryDiscovery::System Information DiscoveryExecution::Command and Scripting InterpreterFile System::Create DirectoryFile System::Create FileFile System::Delete FileFile System::Get File AttributesFile System::Read FileFile System::Set File AttributesFile System::Writes FileMemory::Allocate MemoryProcess::Create ProcessProcess::Create Thread

Signature matches

0 findings · 5 file properties · 0 scored
File properties
IsPE32IsWindowsGUIIsPackedHasOverlayHasRichSignature

These say what the file IS or holds - bitness, subsystem, an overlay, an embedded macro stream, which compiler built it. Ordinary files match several, and none of them carry weight in the score.

No signature rule identified a threat in this file.

Extracted strings

showing 200 of 358
  • !This program cannot be run in DOS mode.
  • Rich
  • .text
  • `.rdata
  • @.data
  • .sxdata
  • .rsrc
  • PSSSSSS
  • FFOu
  • AAOu
  • SSWPV
  • AANu
  • A0SUV
  • u)9n@t/9nDt*
  • T>PGE
  • T$htu;
  • XPVSS
  • ,!@InstallEnd@!
  • setup.exe
  • ExecuteParameters
  • ExecuteFile
  • RunProgram
  • Directory
  • Progress
  • BeginPrompt
  • Title
  • Unsupported Method
  • Cannot open output file
  • Cannot delete output file
  • Cannot open the file as archive
  • Cannot find archive file
  • Default
  • 0123456789ABCDEF0123456789abcdef
  • Error #
  • .tmp
  • FindNextStreamW
  • FindFirstStreamW
  • kernel32.dll
  • :$DATA
  • \\?\
  • out of memory
  • GetActiveProcessorCount
  • GetActiveProcessorGroupCount
  • GlobalMemoryStatusEx
  • Split
  • .exe
  • RISCV
  • SPARC
  • ARMT
  • Copy
  • Delta
  • LZMA2
  • LZMA
  • userenv
  • setupapi
  • apphelp
  • propsys
  • cryptbase
  • oleacc
  • clbcatq
  • version
  • uxtheme
  • SetDefaultDllDirectories
  • OLEAUT32.dll
  • MessageBoxW
  • ShowWindow
  • SetWindowTextW
  • PostMessageW
  • EndDialog
  • DestroyWindow
  • CharUpperW
  • LoadStringW
  • GetDlgItem
  • GetWindowLongW
  • SetWindowLongW
  • DialogBoxParamW
  • SetTimer
  • SendMessageW
  • LoadIconW
  • KillTimer
  • USER32.dll
  • ShellExecuteExW
  • SHELL32.dll
  • __CxxFrameHandler
  • memmove
  • _purecall
  • _CxxThrowException
  • malloc
  • free
  • wcsstr
  • memset
  • _beginthreadex
  • _except_handler3
  • MSVCRT.dll
  • ??1type_info@@UAE@XZ
  • ?terminate@@YAXXZ
  • _exit
  • exit
  • __getmainargs
  • _initterm
  • __setusermatherr
  • _adjust_fdiv
  • __p__commode
  • __set_app_type
  • _controlfp
  • WaitForSingleObject
  • CloseHandle
  • CreateProcessW
  • GetCommandLineW
  • GetVersionExW
  • GetLastError
  • LeaveCriticalSection
  • EnterCriticalSection
  • DeleteCriticalSection
  • LoadLibraryExW
  • GetModuleFileNameW
  • LocalFree
  • FormatMessageW
  • GetSystemDirectoryW
  • SetFileTime
  • CreateFileW
  • SetFileAttributesW
  • RemoveDirectoryW
  • CreateDirectoryW
  • DeleteFileW
  • SetLastError
  • SetCurrentDirectoryW
  • GetCurrentDirectoryW
  • GetTempPathW
  • GetCurrentProcessId
  • GetTickCount
  • GetCurrentThreadId
  • GetFileInformationByHandle
  • GetStdHandle
  • FindClose
  • FindFirstFileW
  • FindNextFileW
  • GetProcAddress
  • GetModuleHandleA
  • GetFileAttributesW
  • GetFileSize
  • SetFilePointer
  • ReadFile
  • WriteFile
  • SetEndOfFile
  • GetProcessAffinityMask
  • GetCurrentProcess
  • GetSystemInfo
  • GlobalMemoryStatus
  • Sleep
  • VirtualAlloc
  • GetVersion
  • GetModuleHandleW
  • CreateEventW
  • SetEvent
  • ResetEvent
  • CreateSemaphoreW
  • ReleaseSemaphore
  • InitializeCriticalSection
  • GetStartupInfoA
  • KERNEL32.dll
  • .?AVCNewException@@
  • .PAX
  • .PAD
  • .?AVCInArchiveException@N7z@NArchive@@
  • .?AVCUnsupportedFeatureException@N7z@NArchive@@
  • .?AVtype_info@@
  • IDATx
  • IEND
  • \B)EWf
  • ECUT4E
  • .xpP
  • <opEA
  • s%lpU
  • NINs
  • @%p%l|
  • PFOFlb1
  • UFO~W
  • .NFv-
  • jgtr
  • lIDATx
  • [ndsj7;
  • 6bxAS
  • %sLW
  • Rexc
  • UEAZ
  • J"Qim6q
  • .gtx
  • {vP.Wp
  • uERB
  • ,jdr{cE
  • knTC
  • xteg
  • iF//@x
  • zqNO
  • SJAR
  • Ribu
  • b.Gj
  • Wnaz|
  • shmo

Stack and decoded strings were not recovered: this file format is not eligible for string emulation. Only literal strings present in the file are listed above.

Disassembly

entry point · x86 · 60 insns (listing capped)
AddressBytesMnemonicOperands
0x419f1c55pushebp
0x419f1d8becmovebp, esp
0x419f1f6affpush-1
0x419f2168d8d44100push0x41d4d8
0x419f2668169f4100push0x419f16
0x419f2b64a100000000moveax, dword ptr fs:[0]
0x419f3150pusheax
0x419f3264892500000000movdword ptr fs:[0], esp
0x419f3983ec68subesp, 0x68
0x419f3c53pushebx
0x419f3d56pushesi
0x419f3e57pushedi
0x419f3f8965e8movdword ptr [ebp - 0x18], esp
0x419f4233dbxorebx, ebx
0x419f44895dfcmovdword ptr [ebp - 4], ebx
0x419f476a02push2
0x419f49ff15e8c04100calldword ptr [0x41c0e8]
0x419f4f59popecx
0x419f50830d50344200ffordword ptr [0x423450], 0xffffffff
0x419f57830d54344200ffordword ptr [0x423454], 0xffffffff
0x419f5eff15ecc04100calldword ptr [0x41c0ec]
0x419f648b0d4c344200movecx, dword ptr [0x42344c]
0x419f6a8908movdword ptr [eax], ecx
0x419f6cff15f0c04100calldword ptr [0x41c0f0]
0x419f728b0d48344200movecx, dword ptr [0x423448]
0x419f788908movdword ptr [eax], ecx
0x419f7aa1f4c04100moveax, dword ptr [0x41c0f4]
0x419f7f8b00moveax, dword ptr [eax]
0x419f81a358344200movdword ptr [0x423458], eax
0x419f86e8541cffffcall0x40bbdf
0x419f8b391d20014200cmpdword ptr [0x420120], ebx
0x419f91750cjne0x419f9f
0x419f9368a4a04100push0x41a0a4
0x419f98ff15f8c04100calldword ptr [0x41c0f8]
0x419f9e59popecx
0x419f9fe8ee000000call0x41a092
0x419fa4683c004200push0x42003c
0x419fa96838004200push0x420038
0x419faee8d9000000call0x41a08c
0x419fb3a144344200moveax, dword ptr [0x423444]
0x419fb8894594movdword ptr [ebp - 0x6c], eax
0x419fbb8d4594leaeax, [ebp - 0x6c]
0x419fbe50pusheax
0x419fbfff3540344200pushdword ptr [0x423440]
0x419fc58d459cleaeax, [ebp - 0x64]
0x419fc850pusheax
0x419fc98d4590leaeax, [ebp - 0x70]
0x419fcc50pusheax
0x419fcd8d45a0leaeax, [ebp - 0x60]
0x419fd050pusheax
0x419fd1ff1500c14100calldword ptr [0x41c100]
0x419fd76834004200push0x420034
0x419fdc6800004200push0x420000
0x419fe1e8a6000000call0x41a08c
0x419fe683c424addesp, 0x24
0x419fe9a104c14100moveax, dword ptr [0x41c104]
0x419fee8b30movesi, dword ptr [eax]
0x419ff089758cmovdword ptr [ebp - 0x74], esi
0x419ff3803e22cmpbyte ptr [esi], 0x22
0x419ff6753ajne0x41a032
callbranchretstackarithregisterimmediatememory

Installer package analysis

runs run.bat
PackageSelf-extracting archive (7zip script, config block before the archive)
Runs after unpackrun.bat
Unpacks tonot stated
Visible to the userno, the script suppresses the extractor's window
Overwrites existing filesnot stated
The script, as the file carries it (3)

Clear text inside the file at offset 315904. Nothing was unpacked and nothing was run to read it.

CommandValue
Title Gater SFX Launcher
RunProgram run.bat
GUIMode 2

Import fingerprint

no related sample
Fingerprint48:o/+6UyokRyjS/Svn6gAkK/gSYIHx02GIeXGSqIYaieF4yOL9Bfc36:o/e4LRGIeXGSqIYaieF4yO/fcK
Imports read103 functions from 5 libraries (103 distinct)
Comparableyes
Compared against87 stored samples
Samples built on the same import table

No stored sample you can see shares this import table.

Screen recording

63 frames · screen recording · 166s
Screen recording frame
1 / 63
0:00 · 1/63
Download this recording Download video (.mp4) Download GIF (.gif) Building the file runs an encode on this platform, so it is kept to signed-in accounts. Signing in brings you back to this report.

Behavior summary

ran 165s

113 process(es) observed; malicious behavior: dropped_executable; 4 dropped executable(s)

LaunchedC:\Users\user\Desktop\Crystal_Snoser.exe
Privilegestandard
Uncommon Child Process Of Conhost.EXE [T1202]
dropped_executable
Telemetry sources: Kernel ETW (0 events) agent poll: 1Process audit: 129

Evasion / anti-analysis checks

9 checks
HIGH
VM-detection query: Win32_ComputerSystem dynamic-query
MITRE T1497.001 · wmi
HIGH
VM-detection query: Win32_BIOS dynamic-query
MITRE T1497.001 · wmi
HIGH
VM-detection query: Win32_PNPEntity dynamic-query
MITRE T1497.001 · wmi
MED
System Checks Capability analysis
MITRE T1497
MED
Reference analysis tools strings Capability rule
MITRE T1497 · Anti-analysis
MED
Reference anti-VM strings targeting Xen Capability rule
MITRE T1497.001 · Virtual-machine detection
MED
Debugger Detection::Process Environment Block Capability taxonomy
MITRE T1497 · Anti-Behavioral Analysis
MED
Dynamic Analysis Evasion::Delayed Execution Capability taxonomy
MITRE T1497 · Anti-Behavioral Analysis
MED
Virtual Machine Detection Capability taxonomy
MITRE T1497 · Anti-Behavioral Analysis

Statically visible checks (RDTSC/CPUID/red-pill instructions, anti-debug APIs) plus runtime evasion signals. Instruction-level interception at runtime requires hypervisor introspection (VMI).

WMI activity

3 classes

WMI classes the sample queried, captured from the WMI-Activity trace and attributed to the sample process tree. Hardware/identity classes also surface as VM-detection checks above.

Win32_ComputerSystemWin32_BIOSWin32_PNPEntity

WMI method invocations

1 call

Methods the sample invoked through WMI, with their arguments. A process created this way is spawned by the WMI provider host, so the operating system records no parent link back to the sample - the caller is named by the WMI-Activity trace and the argument is captured in the calling process itself.

Connect pid 5924

Command lines, unwrapped

5 read

5 captured texts were read and unwrapped locally. No address was recovered from any of them, and none of them was hiding its own contents behind an encoding or a format string. This is a result, not a gap.

Network activity

The network section is a paid-plan layer: the DNS the sample resolved, the connections it opened, the TLS it negotiated, and the rule engine's reading of the capture.

This run was captured, and what it captured is on a paid plan rather than absent. An internet-connected detonation is the same plan, so a paid run also shows what the sample reached rather than only what it tried.

See plans Create an account

Process tree

What ran during the detonation, and what each process did. Select a node to see the activity attributed to it.

113processes
108file operations
4registry operations
4dropped files

Crystal Snoser.exe

113 processes
113 processes

Tree depth limit reached. 15 further processes under this one are not drawn.

Tree depth limit reached. 3 further processes under this one are not drawn.

Tree depth limit reached. 12 further processes under this one are not drawn.

Attributed activity

0Mechanisms found
90Methods checked
0ATT&CK techniques
NONEHighest severity

Persistence mechanisms

clean

No persistence established

None of the 90 auto-start methods below were established during this run.

Detection coverage

0 / 90

Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean, and one the sample only names in its own strings reads "named" rather than "detected".

Logon & Startup 22 clean
  • Active Setup Installed Component T1547.014 clean
  • Explorer Delay-Load Object T1547.001 clean
  • Explorer Run Key T1547.001 clean
  • Explorer SharedTaskScheduler T1547.001 clean
  • Group Policy Extension DLL T1547.004 clean
  • Group Policy Run Key T1547.001 clean
  • Logon Script T1037.001 clean
  • RDP WDS Startup Program T1547.001 clean
  • Registry Run Key T1547.001 clean
  • Registry RunEx Key T1547.001 clean
  • Registry RunOnce Key T1547.001 clean
  • Registry RunOnceEx Key T1547.001 clean
  • Registry RunServices Key T1547.001 clean
  • Startup Folder Item T1547.001 clean
  • Startup Folder Redirection T1547.001 clean
  • Terminal Services Initial Program T1547.001 clean
  • Winlogon GINA DLL T1547.004 clean
  • Winlogon MPNotify Value T1547.004 clean
  • Winlogon Notify Package T1547.004 clean
  • Winlogon Shell Value T1547.004 clean
  • Winlogon Taskman Value T1547.004 clean
  • Winlogon Userinit Value T1547.004 clean
Services & Tasks 9 clean
  • BITS Job T1197 clean
  • Print Monitor DLL T1547.010 clean
  • Print Processor DLL T1547.012 clean
  • Scheduled Task T1053.005 clean
  • Scheduled Task Registry Implant T1053.005 clean
  • Service Control Manager Security Descriptor T1574.011 clean
  • Service DLL Hijack T1543.003 clean
  • Time Provider DLL T1547.003 clean
  • Windows Service Creation T1543.003 clean
Execution Hijack 17 clean
  • .NET Managed Debugger T1546.012 clean
  • Accessibility Tool Hijack T1546.008 clean
  • AeDebug Postmortem Debugger T1546.012 clean
  • App Paths Hijack T1546.012 clean
  • Application Shim Database T1546.011 clean
  • Boot Verification Program T1547.002 clean
  • Command Processor AutoRun T1546.011 clean
  • Explorer Load Value T1547.001 clean
  • Explorer MyComputer Tool Hijack T1546.001 clean
  • Registry Image File Execution Options T1546.012 clean
  • Screensaver Hijack T1546.002 clean
  • Setup ErrorHandler Script T1546 clean
  • Shell Open Command Hijack T1546.001 clean
  • SilentProcessExit Monitor T1546.012 clean
  • Telemetry Controller Command T1546.015 clean
  • WER ReflectDebugger T1546.012 clean
  • Windows Error Reporting Debugger T1546.012 clean
DLL Load Order 12 clean
  • .NET CLR Profiler DLL T1574.012 clean
  • .NET Startup Hook DLL T1574 clean
  • AppCert DLLs T1546.009 clean
  • AppInit DLLs T1546.010 clean
  • AutodialDLL Winsock Injection T1546.006 clean
  • DLL Search-Order Hijack T1574.001 T1574.002 clean
  • DNS Server Plugin DLL T1574.001 clean
  • HTML Help Helper DLL T1546 clean
  • KnownDLLs Manipulation T1574.001 clean
  • Natural Language Platform DLL Override T1546 clean
  • Netsh Helper DLL T1546.007 clean
  • Winsock Layered Service Provider T1546.006 clean
COM & Browser 6 clean
  • Browser Extension T1176 clean
  • Browser Helper Object T1176 clean
  • COM Server Hijack T1546.015 clean
  • HTML Help COM Object Hijack T1546.015 clean
  • Shell Context Menu Handler T1546.001 clean
  • Shell Extension Handler T1546.001 clean
Security Providers & Accounts 11 clean
  • Account RID Hijack T1098 clean
  • AMSI Provider T1562.001 clean
  • Credential Provider T1547.014 clean
  • DSRM Admin Logon Backdoor T1556 clean
  • Hidden Local Account T1136.001 clean
  • LSA Authentication Package T1547.002 clean
  • LSA Extension DLL T1547.005 clean
  • LSA Notification Package T1547.005 clean
  • LSA Security Package T1547.005 clean
  • Network Provider DLL T1556.008 clean
  • Security Support Provider T1547.005 clean
Scripting & Applications 9 clean
  • Netsh Port Proxy T1090.001 clean
  • Office Add-in T1137.006 clean
  • Office Executable Sideload T1574.002 clean
  • Office Startup Template T1137.001 clean
  • Office Test Key T1137.002 clean
  • Power Automate Flow T1546 clean
  • PowerShell Profile T1546.013 clean
  • Windows Terminal Startup Action T1546 clean
  • WMI Event Subscription T1546.003 clean
Boot & Firmware 4 clean
  • BootExecute Native Image T1547.002 clean
  • PlatformExecute Native Image T1547.002 clean
  • SetupExecute Native Image T1547.002 clean
  • UEFI / Bootkit Artifact T1542.003 T1542.001 clean

File activity summary

create 104 write 0 modify 0 delete 4 rename 0

Dropped files

4 payloads
PathSHA-256SizeProcessTimeDownload
C:\Users\user\AppData\Local\Temp\7zSC47E8624\run.bat - - Crystal_Snoser.exe pid 1868 - -
C:\Users\user\AppData\Local\Temp\7zSC47E8624\Crystal Snoser TG.exe - - Crystal_Snoser.exe pid 1868 - -
C:\Users\user\AppData\Local\Temp\7zSC47E8624\soft.exe - - Crystal_Snoser.exe pid 1868 - -
C:\Users\user\AppData\Local\Temp\_MEI23322\VCRUNTIME140.dll - - Crystal Snoser TG.exe pid 2332 - -

Dropped payload analysis

not examined

The run recorded 4 payload writes and the guest returned no payload capture, so no bytes were kept and none of these files was examined. Their paths are listed above. Read this as a gap in the evidence: nothing here says those payloads were harmless.

File & registry ops

108 file · 4 registry · sample scope

File operation times: 108 not observed

OperationTargetProcess
delete
C:\Windows\Temp\{82A82F17-1310-4CC1-A4C5-441601A39344} - OProcSessId.dat
kernel trace
 soft.exe pid 4788
create
C:\Users\user\AppData\Local\Temp\7zSC47E8624
kernel trace
 Crystal_Snoser.exe pid 1868
create
C:\Users\user\AppData\Local\Temp\7zSC47E8624\run.bat
kernel trace
 Crystal_Snoser.exe pid 1868
create
C:\Users\user\AppData\Local\Temp\7zSC47E8624\Crystal Snoser TG.exe
kernel trace
 Crystal_Snoser.exe pid 1868
create
C:\Users\user\AppData\Local\Temp\7zSC47E8624\soft.exe
kernel trace
 Crystal_Snoser.exe pid 1868
create
C:\Users\user\AppData\Local\Temp\_MEI23322
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\VCRUNTIME140.dll
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_bz2.pyd
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_decimal.pyd
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_hashlib.pyd
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_lzma.pyd
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_socket.pyd
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_ssl.pyd
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\auto.tcl
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\clock.tcl
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\ascii.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\big5.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\cns11643.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\cp1250.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\cp1251.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\cp1252.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\cp1253.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\cp1254.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\cp1255.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\cp1256.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\cp1257.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\cp1258.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\cp437.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\cp737.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\cp775.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\cp850.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\cp852.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\cp855.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\cp857.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\cp860.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\cp861.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\cp862.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\cp863.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\cp864.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\cp865.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\cp866.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\cp869.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\cp874.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\cp932.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\cp936.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\cp949.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\cp950.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\dingbats.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\ebcdic.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\euc-cn.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\euc-jp.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\euc-kr.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\gb12345.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\gb1988.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\gb2312-raw.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\gb2312.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\iso2022-jp.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\iso2022-kr.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\iso2022.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\iso8859-1.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\iso8859-10.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\iso8859-11.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\iso8859-13.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\iso8859-14.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\iso8859-15.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\iso8859-16.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\iso8859-2.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\iso8859-3.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\iso8859-4.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\iso8859-5.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\iso8859-6.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\iso8859-7.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\iso8859-8.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\iso8859-9.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\jis0201.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\jis0208.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\jis0212.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
delete
C:\Users\user\AppData\Local\Temp\7zSC47E8624\Crystal Snoser TG.exe
kernel trace
 Crystal_Snoser.exe pid 1868
delete
C:\Users\user\AppData\Local\Temp\7zSC47E8624\run.bat
kernel trace
 Crystal_Snoser.exe pid 1868
delete
C:\Users\user\AppData\Local\Temp\7zSC47E8624\soft.exe
kernel trace
 Crystal_Snoser.exe pid 1868
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\koi8-r.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\koi8-ru.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\koi8-t.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\koi8-u.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\ksc5601.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\macCentEuro.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\macCroatian.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\macCyrillic.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\macDingbats.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\macGreek.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\macIceland.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\macJapan.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\macRoman.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\macRomania.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\macThai.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\macTurkish.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\macUkraine.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\shiftjis.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\symbol.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\encoding\tis-620.enc
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\history.tcl
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\http1.0
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\http1.0\http.tcl
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\http1.0\pkgIndex.tcl
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\init.tcl
kernel trace
 Crystal Snoser TG.exe pid 2332
create
C:\Users\user\AppData\Local\Temp\_MEI23322\_tcl_data\msgs
kernel trace
 Crystal Snoser TG.exe pid 2332
create
SOFTWARE\Microsoft\NET Framework Setup\NDP
kernel trace
 soft.exe pid 4788
create
v4\Full
kernel trace
 soft.exe pid 4788
create
SOFTWARE\Microsoft\Office\Common
kernel trace
 soft.exe pid 4788
create
Common\CrashPersistence\OFFICEC2\4788
kernel trace
 soft.exe pid 4788

External reputation was not produced for this scan. Threat intelligence enrichment is a paid-plan layer: every extracted indicator - hashes, addresses, hostnames - is checked against the external reputation services. Our own ingested feeds ran on this scan and every result below is theirs. Adding the paid layer adds an external reputation verdict on each indicator, so VirusTotal, MalwareBazaar and filescan.io are listed below as not checked. See plans.

Earlier analysis of these bytes

2 earlier runs

Earlier analyses of the identical file, matched by SHA-256. Same bytes, same questions - what this platform found the last time it looked is evidence about the file in front of you now.

RunAnalysedModuleVerdictScore
#2892 2026-10-22 14:34 File Analysis Suspicious46 46/100
#2891 2026-10-22 14:31 File Analysis Suspicious42 42/100
1 reported a hit 16 answered no 1 could not answer 5 had nothing to check
1Sources with a hit
18Sources queriedof 23 available
470.6kFeed records
1Could not answer

File reputation

4 clear · 3 not checked
SourceChecksResultDetailFeed
MalwareBazaar hash feed File hash clean not in feed 3,003 records
4 minutes ago
MalwareBazaar ransomware feed File hash clean not in feed 3,348 records
3 hours ago
ThreatFox hash IOCs File hash clean not in feed 1,153 records
4 minutes ago
URLhaus payload hashes File hash clean not in feed 1,680 records
4 minutes ago
filescan.io File hash not checked no hash lookup ran for this scan live lookup
MalwareBazaar File hash not checked no hash lookup ran for this scan live lookup
VirusTotal File hash not checked no hash lookup ran for this scan live lookup

Hash lookups only - the sample itself is never uploaded to any third party.

Network indicators

7 clear · 1 could not answer
SourceChecksResultDetailFeed
URLhaus IP / domain / URL feed unavailable 1 observed indicator, none listed no records ingested
blocklist.de IP / domain / URL clean 1 observed indicator, none listed 27.6k records
4 minutes ago
CINS Army IP / domain / URL clean 1 observed indicator, none listed 15k records
4 minutes ago
Emerging Threats IP / domain / URL clean 1 observed indicator, none listed 482 records
4 minutes ago
Feodo Tracker IP / domain / URL clean 1 observed indicator, none listed 5 records
4 minutes ago
IPsum IP / domain / URL clean 1 observed indicator, none listed 19.7k records
4 minutes ago
Phishing.Database IP / domain / URL clean 1 observed indicator, none listed 391.5k records
3 hours ago
ThreatFox IP / domain / URL clean 1 observed indicator, none listed 1,153 records
4 minutes ago

TLS fingerprints

nothing of this kind to check
SourceChecksResultDetailFeed
JA3 / JA4 fingerprint blocklists JA3 / JA4 not checked no TLS client fingerprint observed 97 records
9 hours ago
SSL blocklist Server certificate not checked no server certificate fingerprint is extracted to check live lookup

Detection rules

1 of 2 listed
SourceChecksResultDetailFeed
Sigma rules Behavior log 1 match Uncommon Child Process Of Conhost.EXE 2,275 records
5 hours ago
Signature rules Sample content clean 5 structural rules matched (file properties, not findings) 110 records
5 minutes ago

Tooling catalogs

4 clear
SourceChecksResultDetailFeed
LOLBAS Process image paths clean 113 process image paths, none masqueraded 245 records
5 minutes ago
LOLBootloaders File hash clean not a known vulnerable bootloader 520 records
4 minutes ago
LOLDrivers File hash clean not a known vulnerable driver 2,333 records
4 minutes ago
LOLRMM Names and domains clean 115 name/domain indicators checked, no remote-management tooling 360 records
4 minutes ago

AI analysis

The AI layer is a paid-plan feature. It reads what the other layers produced - the behaviour summary, the call sequence, the indicator list - and writes the narrative and the kill-chain walkthrough.

Nothing is being withheld. This layer did not run for this scan, so there is no result stored behind the lock.

See plans Create an account

0 malicious 7 suspicious 0 info

File indicators

7
SeverityTypeIndicatorDescription
suspicious sample_sha256 d6ba9737fdb1c0f6a70156e92bc6b5e2398dd4400a43e152940c9f2584ce6854 Submitted sample (SHA256)
suspicious sample_md5 e6c8cb0c3f9611532112129d8c84548a Submitted sample (MD5)
suspicious imphash 9d36299141dab99fcb6ba060f8918cae Import table hash (imphash)
suspicious dropped_file C:\Users\user\AppData\Local\Temp\7zSC47E8624\run.bat Executable written to disk during execution
suspicious dropped_file C:\Users\user\AppData\Local\Temp\7zSC47E8624\Crystal Snoser TG.exe Executable written to disk during execution
suspicious dropped_file C:\Users\user\AppData\Local\Temp\7zSC47E8624\soft.exe Executable written to disk during execution
suspicious dropped_file C:\Users\user\AppData\Local\Temp\_MEI23322\VCRUNTIME140.dll Executable written to disk during execution

MITRE ATT&CK

1 technique
Uncommon Child Process Of Conhost.EXE
T1202

Sigma detections

1 match of 2275 rules
LevelDetectionLog sourceATT&CKEvidence
Medium Uncommon Child Process Of Conhost.EXE
Detects uncommon "conhost" child processes. This could be a sign of "conhost" usage as a LOLBIN or potential process injection activity.
 process_creation T1202 process pid=5204

Generated rules

Sigma: auto_file_2894_sigma_reg

Auto-generated
title: Auto-generated registry behavior rule (sandbox scan 2894)
id: sandbox-auto-2894-reg
status: experimental
description: Auto-generated from sandbox scan 2894
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|contains:
            - 'SOFTWARE\Microsoft\NET Framework Setup\NDP'
            - 'v4\Full'
            - 'SOFTWARE\Microsoft\Office\Common'
            - 'Common\CrashPersistence\OFFICEC2\4788'
    condition: selection
level: medium

YARA: auto_file_2894_yara

Auto-generated
rule auto_file_2894_yara
{
    meta:
        description = "Auto-generated from scan 2894"
        author = "sandbox auto-generator"
        imphash = "9d36299141dab99fcb6ba060f8918cae"
        anchors = "5 independent regions"
    strings:
        $s0 = "0123456789ABCDEF0123456789abcdef" ascii fullword
        $s1 = "7zS.sfx.exe" wide fullword
        $s2 = "\\4noaiCD" ascii fullword
        $s3 = ".?AVCUnsupportedFeatureException@N7z@NArchive@@" ascii fullword
        $s4 = "setup.exe" ascii fullword
    condition:
        uint16(0) == 0x5a4d and filesize < 62770856 and all of them
}

Extracted files

What came out of the sample: unpacked payloads, carved objects and captured memory. Each one is stored by content hash, so the same object extracted twice is the same row.

Artifacts

3 files
TypeNameSizeWhat it isSHA-256Download
Extracted file Crystal Snoser TG.exe 11.0 MB PEno detection 1c2d6e242f10a3312f40e04ec46004add868528b994bfb9247ac336f554b3df9 ZIP
Extracted file run.bat 82.0 B no detection 3fcc66fbfedff67ee0a823fa69f35f66f0e906ba64a16b529b6d554a34b47f26 ZIP
Extracted file soft.exe 5.5 MB PEno detection 4cae40ef8622e68e60db0ba4676956056ab363df79eb08ac6b57f91a2c05cd1d ZIP

Export & download

/s/2894

Structured exports for your SIEM/TIP - ATT&CK Navigator layer, STIX 2.1 bundle, MISP event and a defanged IOC list - are free on every report. The packet capture follows this scan's plan, because a capture is the rawest network output this platform produces.

AI analysis report

An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).

Public analyses of this file

3 runs

This file has been analysed more than once. The report below is the run that found the most, which is not always the most recent one.

SubmittedEnvironmentVerdictScore
2026-10-22 14:43 Shown below Windows 10 22H2 Suspicious 46/100
2026-10-22 14:30 Windows 10 22H2 Suspicious 46/100
2026-10-22 14:26 Windows 10 22H2 Suspicious 42/100