analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

CRN%20Bypass%20v1.5.1.sp.zip

Full analysis: https://app.any.run/tasks/31bc3757-f1f0-4e17-9b1a-1cda7c8c49ee
Verdict: Malicious activity
Analysis date: July 12, 2020, 11:16:20
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

01A04429C9956B05999C891BABF16599

SHA1:

F4118336FCD8BDF758D8518D6E24E97E873EE171

SHA256:

02633F7FA5985E0F05CF4263C5071BF920AEA3926727926073C6C4BBBBB18831

SSDEEP:

98304:/gE26D/OD9PEDs/CM2KI9rFDQBne+jzXQBA4I8vCvCmuv+8:/g0D/ODVEDsF2lrFDwnhUM5vCms

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • CRN Bypass v1.5.1.sp.exe (PID: 1832)
      • CRN Bypass v1.5.1.sp.exe (PID: 3800)

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3604)

    • Changes settings of System certificates

      • CRN Bypass v1.5.1.sp.exe (PID: 1832)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 544)

    • Reads internet explorer settings

      • CRN Bypass v1.5.1.sp.exe (PID: 1832)

    • Reads Internet Cache Settings

      • CRN Bypass v1.5.1.sp.exe (PID: 1832)

    • Adds / modifies Windows certificates

      • CRN Bypass v1.5.1.sp.exe (PID: 1832)

  • INFO

    • Manual execution by user

      • CRN Bypass v1.5.1.sp.exe (PID: 3800)
      • CRN Bypass v1.5.1.sp.exe (PID: 1832)

    • Reads the hosts file

      • CRN Bypass v1.5.1.sp.exe (PID: 1832)

    • Reads settings of System Certificates

      • CRN Bypass v1.5.1.sp.exe (PID: 1832)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2020:07:11 02:32:20
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: ADB/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
67
Monitored processes
18
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe searchprotocolhost.exe no specs crn bypass v1.5.1.sp.exe no specs crn bypass v1.5.1.sp.exe arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
544"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\0fbf9104-4b01-4351-926b-67893031ebf0.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3604"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
3800"C:\Users\admin\Desktop\CRN Bypass v1.5.1.sp.exe" C:\Users\admin\Desktop\CRN Bypass v1.5.1.sp.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
CRN Team
Exit code:
3221226540
Version:
1.5.0.0
1832"C:\Users\admin\Desktop\CRN Bypass v1.5.1.sp.exe" C:\Users\admin\Desktop\CRN Bypass v1.5.1.sp.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
CRN Team
Version:
1.5.0.0
2976"C:\Windows\System32\arp.exe" -aC:\Windows\System32\arp.exe—CRN Bypass v1.5.1.sp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Arp Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1856"C:\Windows\System32\arp.exe" -aC:\Windows\System32\arp.exe—CRN Bypass v1.5.1.sp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Arp Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2572"C:\Windows\System32\arp.exe" -aC:\Windows\System32\arp.exe—CRN Bypass v1.5.1.sp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Arp Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
592"C:\Windows\System32\arp.exe" -aC:\Windows\System32\arp.exe—CRN Bypass v1.5.1.sp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Arp Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
880"C:\Windows\System32\arp.exe" -aC:\Windows\System32\arp.exe—CRN Bypass v1.5.1.sp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Arp Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3256"C:\Windows\System32\arp.exe" -aC:\Windows\System32\arp.exe—CRN Bypass v1.5.1.sp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Arp Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
2 277
Read events
1 039
Write events
0
Delete events
0

Modification events

No data
Executable files
5
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
1832CRN Bypass v1.5.1.sp.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\thongbao[1].txttext
MD5:CFC7D51A0EB6C743217598D1FBD7442E
SHA256:59EB596E8DF1E91FB0323EA3067886F3CFF1C863D0E75C9CBE7E6E2ECB3698ED
544WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa544.44550\CRN Bypass v1.5.1.sp.exeexecutable
MD5:6F822BFACF5E2C5F838E0E3CADF7115E
SHA256:D96B78C972004FDC53776D42750B0B13F44B109AB18A4E2A65E035308C410769
544WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa544.44550\Fix Error (run as admin).exeexecutable
MD5:EAA8AFA22E99A64EF4EADC7FA1D3E0B3
SHA256:75483790A42BDE2270D0431F7E35E16AE20213EC70A89B79EEA5F26DE258747B
544WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa544.44550\ADB\adb.exeexecutable
MD5:94226EA671D068461171EC790197ADB9
SHA256:FBB96C5B47F7166C70B6790ACC01CF19FE9CCF17CAD77615CDFE2BB06BEA2330
544WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa544.44550\ADB\AdbWinUsbApi.dllexecutable
MD5:0E24119DAF1909E398FA1850B6112077
SHA256:25207C506D29C4E8DCEB61B4BD50E8669BA26012988A43FBF26A890B1E60FC97
544WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa544.44550\ADB\AdbWinApi.dllexecutable
MD5:ED5A809DC0024D83CBAB4FB9933D598D
SHA256:D60103A5E99BC9888F786EE916F5D6E45493C3247972CB053833803DE7E95CF9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
2
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1832
CRN Bypass v1.5.1.sp.exe
GET
200
153.92.6.135:80
http://filesgame.xyz/Ldbypass/thongbao.txt
US
text
181 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1832
CRN Bypass v1.5.1.sp.exe
153.92.6.135:80
filesgame.xyz
Hostinger International Limited
US
suspicious
1832
CRN Bypass v1.5.1.sp.exe
104.24.111.151:443
api.auth.gg
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
api.auth.gg
  • 104.24.111.151
  • 172.67.187.231
  • 104.24.110.151
whitelisted
filesgame.xyz
  • 153.92.6.135
suspicious

Threats

PID
Process
Class
Message
1832
CRN Bypass v1.5.1.sp.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
CRN%20Bypass%20v1.5.1.sp.zip