analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

CRN%20Bypass%20v1.5.1.sp.zip

Full analysis: https://app.any.run/tasks/6127237e-82d1-453c-aeb6-58f9e1e27419
Verdict: Malicious activity
Analysis date: July 12, 2020, 11:27:54
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

C7A4433B0DDF7F2F3FD193DFB3F0ED77

SHA1:

21377EE3CFFFDC44B950C2220133961F49875B36

SHA256:

259DE2712D2A769833851BE94DB126912D1F2CD25E49B70629EBC6EFD697080F

SSDEEP:

98304:/gE26D/OD9PEDs/CM2KI9rFDQBne+jzXQBA4I8vCvCmuv+e:/g0D/ODVEDsF2lrFDwnhUM5vCmO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • CRN Bypass v1.5.1.sp.exe (PID: 920)
      • CRN Bypass v1.5.1.sp.exe (PID: 2232)

    • Changes settings of System certificates

      • CRN Bypass v1.5.1.sp.exe (PID: 920)

  • SUSPICIOUS

    • Reads internet explorer settings

      • CRN Bypass v1.5.1.sp.exe (PID: 920)

    • Reads Internet Cache Settings

      • CRN Bypass v1.5.1.sp.exe (PID: 920)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 2752)

    • Starts CMD.EXE for commands execution

      • CRN Bypass v1.5.1.sp.exe (PID: 920)

    • Creates files in the Windows directory

      • CRN Bypass v1.5.1.sp.exe (PID: 920)

    • Application launched itself

      • adb.exe (PID: 2288)
      • adb.exe (PID: 2344)
      • adb.exe (PID: 3052)
      • adb.exe (PID: 1240)

    • Removes files from Windows directory

      • CRN Bypass v1.5.1.sp.exe (PID: 920)

    • Adds / modifies Windows certificates

      • CRN Bypass v1.5.1.sp.exe (PID: 920)

  • INFO

    • Manual execution by user

      • NOTEPAD.EXE (PID: 588)
      • CRN Bypass v1.5.1.sp.exe (PID: 2232)
      • CRN Bypass v1.5.1.sp.exe (PID: 920)

    • Reads settings of System Certificates

      • CRN Bypass v1.5.1.sp.exe (PID: 920)

    • Reads the hosts file

      • CRN Bypass v1.5.1.sp.exe (PID: 920)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2020:07:11 02:32:20
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: ADB/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
481
Monitored processes
227
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs notepad.exe no specs crn bypass v1.5.1.sp.exe no specs crn bypass v1.5.1.sp.exe arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs cmd.exe no specs taskkill.exe no specs taskkill.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs adb.exe arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe arp.exe no specs adb.exe arp.exe no specs adb.exe adb.exe arp.exe no specs arp.exe no specs adb.exe adb.exe adb.exe arp.exe no specs adb.exe arp.exe no specs adb.exe arp.exe no specs adb.exe arp.exe no specs adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs adb.exe adb.exe adb.exe adb.exe adb.exe arp.exe no specs arp.exe no specs arp.exe no specs adb.exe arp.exe no specs adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe arp.exe no specs arp.exe no specs arp.exe no specs adb.exe arp.exe no specs adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe arp.exe no specs arp.exe no specs arp.exe no specs adb.exe arp.exe no specs adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs cmd.exe no specs adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe arp.exe no specs arp.exe no specs adb.exe arp.exe no specs arp.exe no specs adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe no specs adb.exe adb.exe adb.exe no specs adb.exe adb.exe no specs adb.exe adb.exe no specs adb.exe no specs adb.exe no specs adb.exe no specs adb.exe no specs adb.exe no specs adb.exe no specs adb.exe no specs adb.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2364"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\5de15e16-40ec-46d7-a140-545fd45b79b2.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
588"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\key(1).txtC:\Windows\system32\NOTEPAD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2232"C:\Users\admin\Desktop\CRN Bypass v1.5.1.sp.exe" C:\Users\admin\Desktop\CRN Bypass v1.5.1.sp.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
CRN Team
Exit code:
3221226540
Version:
1.5.0.0
920"C:\Users\admin\Desktop\CRN Bypass v1.5.1.sp.exe" C:\Users\admin\Desktop\CRN Bypass v1.5.1.sp.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
CRN Team
Version:
1.5.0.0
1400"C:\Windows\System32\arp.exe" -aC:\Windows\System32\arp.exe—CRN Bypass v1.5.1.sp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Arp Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1896"C:\Windows\System32\arp.exe" -aC:\Windows\System32\arp.exe—CRN Bypass v1.5.1.sp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Arp Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2452"C:\Windows\System32\arp.exe" -aC:\Windows\System32\arp.exe—CRN Bypass v1.5.1.sp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Arp Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3752"C:\Windows\System32\arp.exe" -aC:\Windows\System32\arp.exe—CRN Bypass v1.5.1.sp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Arp Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2668"C:\Windows\System32\arp.exe" -aC:\Windows\System32\arp.exe—CRN Bypass v1.5.1.sp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Arp Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1912"C:\Windows\System32\arp.exe" -aC:\Windows\System32\arp.exe—CRN Bypass v1.5.1.sp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Arp Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
3 196
Read events
1 892
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
2364WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2364.13735\ADB\adb.exe —
MD5:—
SHA256:—
2364WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2364.13735\ADB\AdbWinApi.dll —
MD5:—
SHA256:—
2364WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2364.13735\ADB\AdbWinUsbApi.dll —
MD5:—
SHA256:—
2364WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2364.13735\CRN Bypass v1.5.1.sp.exe —
MD5:—
SHA256:—
2364WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2364.13735\Fix Error (run as admin).exe —
MD5:—
SHA256:—
2364WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2364.13735\key(1).txt —
MD5:—
SHA256:—
3736adb.exeC:\Users\admin\AppData\Local\Temp\adb.logtext
MD5:1737ACF19AA953DC59E3E81311F993FD
SHA256:0665DB616ED9575AD440A35E749961FE2914594879FB92880660F37AFA0CD0F0
2964adb.exeC:\Users\admin\AppData\Local\Temp\adb.logtext
MD5:1F718907F309094E35B74679352CECAA
SHA256:6E39991A9914F200FA5EB8FFE9D0BD3C3E10CDD12AF1E3C95333D53C5754530A
3736adb.exeC:\Users\admin\.android\adbkey.pubtext
MD5:2D07022FCD352A7FDFFC38DC1CE33412
SHA256:B9ABE675CD6F3D7CD6027DB69142D35D4211767F5925F8298642F82C193E8418
2616adb.exeC:\Users\admin\AppData\Local\Temp\adb.logtext
MD5:7715ADD8C37C1B7B3738FFA407CA12D3
SHA256:3FC697C8DD7EB2537F94CF5F11A0FA9300CEA5E3A13D36D6214F11545A709383
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
4
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
920
CRN Bypass v1.5.1.sp.exe
GET
200
153.92.6.135:80
http://filesgame.xyz/Ldbypass/dkmconf.dll
US
text
225 Kb
suspicious
920
CRN Bypass v1.5.1.sp.exe
GET
200
153.92.6.135:80
http://filesgame.xyz/Ldbypass/thongbao.txt
US
text
181 b
suspicious
920
CRN Bypass v1.5.1.sp.exe
GET
200
153.92.6.135:80
http://filesgame.xyz/Ldbypass/extest.bat
US
text
418 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
920
CRN Bypass v1.5.1.sp.exe
172.67.187.231:443
api.auth.gg
—
US
suspicious
920
CRN Bypass v1.5.1.sp.exe
153.92.6.135:80
filesgame.xyz
Hostinger International Limited
US
suspicious

DNS requests

Domain
IP
Reputation
api.auth.gg
  • 172.67.187.231
  • 104.24.111.151
  • 104.24.110.151
whitelisted
filesgame.xyz
  • 153.92.6.135
suspicious

Threats

PID
Process
Class
Message
920
CRN Bypass v1.5.1.sp.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
920
CRN Bypass v1.5.1.sp.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
920
CRN Bypass v1.5.1.sp.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
CRN%20Bypass%20v1.5.1.sp.zip