download:

CRN%20Bypass%20v1.5.1.sp.zip

Full analysis: https://app.any.run/tasks/6127237e-82d1-453c-aeb6-58f9e1e27419
Verdict: Malicious activity
Analysis date: July 12, 2020, 11:27:54
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

C7A4433B0DDF7F2F3FD193DFB3F0ED77

SHA1:

21377EE3CFFFDC44B950C2220133961F49875B36

SHA256:

259DE2712D2A769833851BE94DB126912D1F2CD25E49B70629EBC6EFD697080F

SSDEEP:

98304:/gE26D/OD9PEDs/CM2KI9rFDQBne+jzXQBA4I8vCvCmuv+e:/g0D/ODVEDsF2lrFDwnhUM5vCmO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • CRN Bypass v1.5.1.sp.exe (PID: 920)
      • CRN Bypass v1.5.1.sp.exe (PID: 2232)

    • Changes settings of System certificates

      • CRN Bypass v1.5.1.sp.exe (PID: 920)

  • SUSPICIOUS

    • Application launched itself

      • adb.exe (PID: 2288)
      • adb.exe (PID: 2344)
      • adb.exe (PID: 1240)
      • adb.exe (PID: 3052)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 2752)

    • Starts CMD.EXE for commands execution

      • CRN Bypass v1.5.1.sp.exe (PID: 920)

    • Reads internet explorer settings

      • CRN Bypass v1.5.1.sp.exe (PID: 920)

    • Removes files from Windows directory

      • CRN Bypass v1.5.1.sp.exe (PID: 920)

    • Creates files in the Windows directory

      • CRN Bypass v1.5.1.sp.exe (PID: 920)

    • Reads Internet Cache Settings

      • CRN Bypass v1.5.1.sp.exe (PID: 920)

    • Adds / modifies Windows certificates

      • CRN Bypass v1.5.1.sp.exe (PID: 920)

  • INFO

    • Manual execution by user

      • NOTEPAD.EXE (PID: 588)
      • CRN Bypass v1.5.1.sp.exe (PID: 920)
      • CRN Bypass v1.5.1.sp.exe (PID: 2232)

    • Reads settings of System Certificates

      • CRN Bypass v1.5.1.sp.exe (PID: 920)

    • Reads the hosts file

      • CRN Bypass v1.5.1.sp.exe (PID: 920)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2020:07:11 02:32:20
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: ADB/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
481
Monitored processes
227
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs notepad.exe no specs crn bypass v1.5.1.sp.exe no specs crn bypass v1.5.1.sp.exe arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs cmd.exe no specs taskkill.exe no specs taskkill.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs adb.exe arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe arp.exe no specs adb.exe arp.exe no specs adb.exe adb.exe arp.exe no specs arp.exe no specs adb.exe adb.exe adb.exe arp.exe no specs adb.exe arp.exe no specs adb.exe arp.exe no specs adb.exe arp.exe no specs adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs adb.exe adb.exe adb.exe adb.exe adb.exe arp.exe no specs arp.exe no specs arp.exe no specs adb.exe arp.exe no specs adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe arp.exe no specs arp.exe no specs arp.exe no specs adb.exe arp.exe no specs adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe arp.exe no specs adb.exe arp.exe no specs arp.exe no specs adb.exe arp.exe no specs adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs arp.exe no specs cmd.exe no specs adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe arp.exe no specs arp.exe no specs adb.exe arp.exe no specs arp.exe no specs adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe adb.exe no specs adb.exe adb.exe adb.exe no specs adb.exe adb.exe no specs adb.exe adb.exe no specs adb.exe no specs adb.exe no specs adb.exe no specs adb.exe no specs adb.exe no specs adb.exe no specs adb.exe no specs adb.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
320"ADB\adb.exe" shell iptables -L -n -v dpt:17500C:\Users\admin\Desktop\ADB\adb.exe
CRN Bypass v1.5.1.sp.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\desktop\adb\adb.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-crt-string-l1-1-0.dll
c:\windows\system32\ucrtbase.dll
332"C:\Windows\System32\arp.exe" -aC:\Windows\System32\arp.exe—CRN Bypass v1.5.1.sp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Arp Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\arp.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\snmpapi.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\advapi32.dll
376"ADB\adb.exe" shell rm -rf /dev/youC:\Users\admin\Desktop\ADB\adb.exe
CRN Bypass v1.5.1.sp.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\desktop\adb\adb.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-crt-string-l1-1-0.dll
c:\windows\system32\ucrtbase.dll
392"ADB\adb.exe" shell iptables -D OUTPUT -p tcp --dport 17500 -j DROPC:\Users\admin\Desktop\ADB\adb.exe
CRN Bypass v1.5.1.sp.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\desktop\adb\adb.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-crt-string-l1-1-0.dll
c:\windows\system32\ucrtbase.dll
588"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\key(1).txtC:\Windows\system32\NOTEPAD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
600"C:\Windows\System32\arp.exe" -aC:\Windows\System32\arp.exe—CRN Bypass v1.5.1.sp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Arp Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\arp.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\snmpapi.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\advapi32.dll
620"C:\Windows\System32\arp.exe" -aC:\Windows\System32\arp.exe—CRN Bypass v1.5.1.sp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Arp Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\arp.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\snmpapi.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\advapi32.dll
620"ADB\adb.exe" shell mv /system/lib/arm/nb/libdl.so /system/lib/arm/nb/libdl.so1C:\Users\admin\Desktop\ADB\adb.exe
CRN Bypass v1.5.1.sp.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\windows\system32\dhcpcsvc6.dll
c:\windows\system32\msctf.dll
c:\windows\system32\usp10.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\sechost.dll
c:\windows\system32\nsi.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\kernel32.dll
648"C:\Windows\System32\arp.exe" -aC:\Windows\System32\arp.exe—CRN Bypass v1.5.1.sp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Arp Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\arp.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\snmpapi.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\advapi32.dll
684"C:\Windows\System32\arp.exe" -aC:\Windows\System32\arp.exe—CRN Bypass v1.5.1.sp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Arp Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\user32.dll
c:\windows\system32\kernelbase.dll
c:\systemroot\system32\ntdll.dll
c:\windows\system32\arp.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
Total events
3 196
Read events
1 892
Write events
1 304
Delete events
0

Modification events

(PID) Process:(2364) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2364) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2364) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2364) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(2364) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\5de15e16-40ec-46d7-a140-545fd45b79b2.zip
(PID) Process:(2364) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2364) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2364) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2364) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2364) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E
Operation:writeName:@C:\Windows\system32\notepad.exe,-469
Value:
Text Document
Executable files
0
Suspicious files
0
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
2364WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2364.13735\ADB\adb.exe —
MD5:—
SHA256:—
2364WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2364.13735\ADB\AdbWinApi.dll —
MD5:—
SHA256:—
2364WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2364.13735\ADB\AdbWinUsbApi.dll —
MD5:—
SHA256:—
2364WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2364.13735\CRN Bypass v1.5.1.sp.exe —
MD5:—
SHA256:—
2364WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2364.13735\Fix Error (run as admin).exe —
MD5:—
SHA256:—
2364WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2364.13735\key(1).txt —
MD5:—
SHA256:—
920CRN Bypass v1.5.1.sp.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\thongbao[1].txttext
MD5:—
SHA256:—
3736adb.exeC:\Users\admin\.android\adbkey.pubtext
MD5:—
SHA256:—
3736adb.exeC:\Users\admin\.android\adbkeytext
MD5:—
SHA256:—
920CRN Bypass v1.5.1.sp.exeC:\Windows\config0.dattext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
4
DNS requests
2
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
920
CRN Bypass v1.5.1.sp.exe
GET
200
153.92.6.135:80
http://filesgame.xyz/Ldbypass/thongbao.txt
US
text
181 b
suspicious
920
CRN Bypass v1.5.1.sp.exe
GET
200
153.92.6.135:80
http://filesgame.xyz/Ldbypass/dkmconf.dll
US
text
225 Kb
suspicious
920
CRN Bypass v1.5.1.sp.exe
GET
200
153.92.6.135:80
http://filesgame.xyz/Ldbypass/extest.bat
US
text
418 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
920
CRN Bypass v1.5.1.sp.exe
153.92.6.135:80
filesgame.xyz
Hostinger International Limited
US
suspicious
920
CRN Bypass v1.5.1.sp.exe
172.67.187.231:443
api.auth.gg
—
US
suspicious

DNS requests

Domain
IP
Reputation
api.auth.gg
  • 172.67.187.231
  • 104.24.111.151
  • 104.24.110.151
whitelisted
filesgame.xyz
  • 153.92.6.135
suspicious

Threats

PID
Process
Class
Message
920
CRN Bypass v1.5.1.sp.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
920
CRN Bypass v1.5.1.sp.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
920
CRN Bypass v1.5.1.sp.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
CRN%20Bypass%20v1.5.1.sp.zip