| File name: | Release.zip |
| Full analysis: | https://app.any.run/tasks/d5ad4bde-9211-4e11-868a-482b784e71ef |
| Verdict: | Malicious activity |
| Analysis date: | July 08, 2024, 10:39:20 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract, compression method=deflate |
| MD5: | 0732D394560BB5EBA4AFBDF4C62D27F4 |
| SHA1: | 1FEEA0BCC9D9B4149C1CB6A000E05C0817FB6E31 |
| SHA256: | 33F2F6C55B6DC7BA169BA10DE870F41D881414C84A02C25998C65FB5980CD0C3 |
| SSDEEP: | 49152:kWmBzs0QTF7+mdz89BQZXXPl6XTjVjz9JxH+WKVKTUmRpFMDxfMsctnHQu6dpIXZ:kLA0KFamdg9BQ9/l6XT5xrBTUmcfMs0J |
MALICIOUS
Drops the executable file immediately after the start
- WinRAR.exe (PID: 4976)
- csc.exe (PID: 2060)
- csc.exe (PID: 6760)
Starts Visual C# compiler
- Crybat.exe (PID: 4072)
SUSPICIOUS
Reads security settings of Internet Explorer
- Crybat.exe (PID: 4072)
Executable content was dropped or overwritten
- csc.exe (PID: 2060)
- csc.exe (PID: 6760)
Uses .NET C# to load dll
- Crybat.exe (PID: 4072)
INFO
Checks supported languages
- Crybat.exe (PID: 4072)
- csc.exe (PID: 6760)
- csc.exe (PID: 2060)
- cvtres.exe (PID: 7068)
- cvtres.exe (PID: 448)
Reads the machine GUID from the registry
- Crybat.exe (PID: 4072)
- csc.exe (PID: 2060)
- csc.exe (PID: 6760)
Reads the computer name
- Crybat.exe (PID: 4072)
Manual execution by a user
- Crybat.exe (PID: 4072)
- cmd.exe (PID: 4024)
- cmd.exe (PID: 5504)
Disables trace logs
- Crybat.exe (PID: 4072)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 4976)
Reads Environment values
- Crybat.exe (PID: 4072)
Checks proxy server information
- Crybat.exe (PID: 4072)
Reads the software policy settings
- Crybat.exe (PID: 4072)
Create files in a temporary directory
- csc.exe (PID: 2060)
- cvtres.exe (PID: 7068)
- Crybat.exe (PID: 4072)
- cvtres.exe (PID: 448)
- csc.exe (PID: 6760)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | - |
| ZipCompression: | Deflated |
| ZipModifyDate: | 2024:07:01 22:54:14 |
| ZipCRC: | 0xd8e08508 |
| ZipCompressedSize: | 929323 |
| ZipUncompressedSize: | 982528 |
| ZipFileName: | Crybat.exe |
Total processes
152
Monitored processes
16
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 448 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RESC48B.tmp" "c:\Users\admin\AppData\Local\Temp\CSCC5FC84BE79B148C09C967FD8C080B950.TMP" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe | — | csc.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft® Resource File To COFF Object Conversion Utility Exit code: 0 Version: 14.32.31326.0 Modules
| |||||||||||||||
| 1924 | net file | C:\Windows\System32\net.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Net Command Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2060 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\1uj1rm12.cmdline" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe | Crybat.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual C# Command Line Compiler Exit code: 0 Version: 4.8.9037.0 built by: NET481REL1 Modules
| |||||||||||||||
| 2220 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | csc.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2456 | C:\WINDOWS\system32\net1 file | C:\Windows\System32\net1.exe | — | net.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Net Command Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2912 | net file | C:\Windows\System32\net.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Net Command Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4024 | "C:\WINDOWS\System32\cmd.exe" /C "C:\Users\admin\Desktop\Crybat.bat" | C:\Windows\System32\cmd.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4072 | "C:\Users\admin\Desktop\Crybat.exe" | C:\Users\admin\Desktop\Crybat.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Crybat Version: 1.0.0.0 Modules
| |||||||||||||||
| 4976 | "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\Release.zip | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
| 5504 | "C:\WINDOWS\System32\cmd.exe" /C "C:\Users\admin\Desktop\cp.bat" | C:\Windows\System32\cmd.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
17 222
Read events
17 032
Write events
174
Delete events
16
Modification events
| (PID) Process: | (4976) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (4976) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (4976) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip | |||
| (PID) Process: | (4976) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\Release.zip | |||
| (PID) Process: | (4976) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (4976) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (4976) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (4976) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (4072) Crybat.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (4072) Crybat.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Crybat_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
Executable files
3
Suspicious files
6
Text files
16
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 4976 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa4976.843\System.Diagnostics.DiagnosticSource.xml | xml | |
MD5:4B31B7723A6C70C5B0FEEA34CF227172 | SHA256:236D094482EA1DDF63B1F160D84FC364C1D661A9080B2685A317DA82FDB3D43C | |||
| 4976 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa4976.843\System.Numerics.Vectors.xml | xml | |
MD5:95DD29CA17B63843AD787D3BC9C8C933 | SHA256:AE2C3DE9AD57D7091D9F44DCDEE3F88ECCF2BA7CB43ADC9BB24769154A532DC7 | |||
| 4976 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa4976.843\Newtonsoft.Json.xml | xml | |
MD5:D398FFE9FDAC6A53A8D8BB26F29BBB3C | SHA256:79EE87D4EDE8783461DE05B93379D576F6E8575D4AB49359F15897A854B643C4 | |||
| 4976 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa4976.843\System.Memory.xml | xml | |
MD5:ADD19745A43B2515280CE24671863114 | SHA256:D5714C96607EB1A9D0F90F57CA194D8A9C3EDE0656A1D1F461E78B209F054813 | |||
| 4976 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa4976.843\System.Runtime.CompilerServices.Unsafe.xml | xml | |
MD5:C782E92ABBFC0531226F735C6AC56498 | SHA256:39C2D4A63A186D423E9C866F4D3E9A6ACBA0103398F20BAF8B92A38744894215 | |||
| 4976 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa4976.843\bin\settings.json | binary | |
MD5:779AE5513E8577FF437B4E92112A00CA | SHA256:732D7C8588954C651B8A52530D3C5B2C2B0E100D12C12AE975B0AE29F8CFC851 | |||
| 4976 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa4976.843\dnlib.xml | xml | |
MD5:4F66F6D14A67BBD0F70012557D88D17B | SHA256:F453807C0866BDB424541C9297A4C55107143C0103CB84F23D070044F62B7273 | |||
| 4976 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa4976.843\System.Buffers.xml | xml | |
MD5:1C55860DD93297A6EA2FAD2974834C3A | SHA256:2EC7FB12E11F9831E40524427F6D88A3C9FFDD56CCFA81D373467B75B479A578 | |||
| 6760 | csc.exe | C:\Users\admin\AppData\Local\Temp\CSCC5FC84BE79B148C09C967FD8C080B950.TMP | binary | |
MD5:D5F05A3077F696A066FAAAE09E0FE7B1 | SHA256:92DDE7610B80C8BAFFFA9D06B0A61A0740D2A64772FE7976DE06C62C01AAFABB | |||
| 4976 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa4976.843\Crybat.exe.config | xml | |
MD5:467C9988E896A5596D1C64968CDCFF73 | SHA256:DD2A10593CCCB1D99DF5D76E63CD5081BA7E3387AED34DED0EF9588AACD4D3A1 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
67
DNS requests
15
Threats
1
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
7052 | SIHClient.exe | GET | 200 | 23.52.120.96:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | unknown |
4656 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | unknown |
7052 | SIHClient.exe | GET | 200 | 23.52.120.96:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | unknown |
2300 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | unknown |
5940 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | unknown |
3508 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | unknown |
3040 | OfficeClickToRun.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2056 | svchost.exe | 20.73.194.208:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1292 | RUXIMICS.exe | 20.73.194.208:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6004 | svchost.exe | 20.73.194.208:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4032 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
4656 | SearchApp.exe | 2.16.110.168:443 | www.bing.com | Akamai International B.V. | DE | unknown |
4656 | SearchApp.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
3508 | svchost.exe | 40.126.32.136:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | unknown |
3508 | svchost.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
login.live.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
nexusrules.officeapps.live.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
arc.msn.com |
| whitelisted |
fd.api.iris.microsoft.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2168 | svchost.exe | Not Suspicious Traffic | INFO [ANY.RUN] Attempting to access raw user content on GitHub |