File name:

Crimson RAT Builder.b.7z

Full analysis: https://app.any.run/tasks/d62dc077-767c-45bc-9b27-fb0f00c7730d
Verdict: Malicious activity
Analysis date: December 29, 2023, 12:22:43
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

12882048688FCCC08FF7727A69BBF310

SHA1:

2A9DFDC220E7B90217D37B097577FEBE453B35D8

SHA256:

3A45283512A5A2A78FB0CC008A216CCDB3F6313B08E85851F380422BD3C65A62

SSDEEP:

98304:49I7vaB6AUybVprr/2DFWuj3HRBKfuFs9PBSC4lM33RMG+jpqJlpskmUwl/p97E+:4VK/1z4nezYH8V

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • javaw.exe (PID: 2844)

  • SUSPICIOUS

    • Start notepad (likely ransomware note)

      • WinRAR.exe (PID: 2596)

    • Uses ATTRIB.EXE to modify file attributes

      • javaw.exe (PID: 2844)

  • INFO

    • Application launched itself

      • WinRAR.exe (PID: 2184)
      • iexplore.exe (PID: 532)
      • iexplore.exe (PID: 1928)
      • iexplore.exe (PID: 2084)
      • WinRAR.exe (PID: 2596)

    • Manual execution by a user

      • WinRAR.exe (PID: 2596)
      • javaw.exe (PID: 2844)
      • explorer.exe (PID: 604)
      • wmpnscfg.exe (PID: 3740)

    • Checks supported languages

      • javaw.exe (PID: 2844)
      • wmpnscfg.exe (PID: 3740)

    • Create files in a temporary directory

      • javaw.exe (PID: 2844)

    • Creates files in the program directory

      • javaw.exe (PID: 2844)

    • Reads the computer name

      • javaw.exe (PID: 2844)
      • wmpnscfg.exe (PID: 3740)

    • Checks for external IP

      • javaw.exe (PID: 2844)

    • Drops the executable file immediately after the start

      • javaw.exe (PID: 2844)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
58
Monitored processes
15
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe no specs iexplore.exe iexplore.exe no specs iexplore.exe no specs iexplore.exe iexplore.exe no specs winrar.exe no specs winrar.exe no specs notepad.exe no specs javaw.exe icacls.exe no specs attrib.exe no specs explorer.exe no specs wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
532"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2084 CREDAT:144385 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
604"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
968C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)MC:\Windows\System32\icacls.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
1112"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2084 CREDAT:333057 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1288"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Rar$DIb2184.6817\crimsonRAT2.2.6.jarC:\Program Files\WinRAR\WinRAR.exe—WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1928"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Temp\Rar$DIa1288.8643\Time.gifC:\Program Files\Internet Explorer\iexplore.exe
WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1992"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Rar$DIb2596.13940\crimsonRAT2.2.6.jarC:\Program Files\WinRAR\WinRAR.exe—WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2084"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Temp\Rar$DIa1288.7865\Calendar.gifC:\Program Files\Internet Explorer\iexplore.exe
WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2184"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Crimson RAT Builder.b.7z"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2344"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1928 CREDAT:144385 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
22 465
Read events
22 188
Write events
275
Delete events
2

Modification events

(PID) Process:(2184) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2184) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2184) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2184) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2184) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2184) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2184) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2184) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2184) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2184) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
4
Suspicious files
769
Text files
135
Unknown types
37

Dropped files

PID
Process
Filename
Type
2084iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF0EC6E7C31E0E1523.TMPbinary
MD5:A75B71A4871FCE448C6B73ADB6101199
SHA256:9AAF6C596B84B9F04FF72E5CB7075E530E3734872CED7AE084D42FA4E0034E69
1288WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa1288.7865\Calendar.gifimage
MD5:32BFDD4AB4E822A93135983D14F5F582
SHA256:05A04271026E72DFDE99369B578AC3C03C8A9DA60F07DA765ED9C04CB7EB9827
2084iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\RecoveryStore.{42C873D0-1D90-11EB-BA2C-12A9866C77DE}.datbinary
MD5:7095FA7E93C1486A45445B95F181BFE1
SHA256:BA5BA53E971D4E80F204226902BFBC11E417F156C4149908A9BA73AF6AB7F0BE
2184WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb2184.6817\crimsonRAT2.2.6.jarcompressed
MD5:A6324CDB52C0182CCB6E991E53B8B024
SHA256:86592DA5B0F1FB41F2F12DA15EA754BAFA0011FDDBA02065984B164CF4623D4B
2084iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\{0A70B2BE-A645-11EE-AE0A-12A9866C77DE}.datbinary
MD5:FCB5CCBB7C42AE94950D4F17B68328A5
SHA256:128971EE95474C864AD7D4327922A29C66832661270D7ADE7874312F32875934
2084iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{0A70B2BD-A645-11EE-AE0A-12A9866C77DE}.datbinary
MD5:C97EDA029491FD8C4E2067128371B77A
SHA256:AB54C03F593F986AC61B569B0E0DAFF02A60B978545160BFCFC98160BA84E173
2084iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF6108D6929AAF67C0.TMPbinary
MD5:83247BE6DD60FB6C794A28D889DDD824
SHA256:03ECD2A7EB69DE965764D7DB31F1021985F284DDB5D8CFCE290C3E887B8F75E3
2084iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF71B4B2BEA8B253AD.TMPbinary
MD5:7D2E840EB14C36D3103AFDBDAE9AD5C6
SHA256:0F161A03E928E8B725F5D06A18A72ECC00A2BC510241AEB4594D9F7BBDA535FF
1288WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa1288.8643\Time.gifimage
MD5:D8E4CA954D469D3FA9144CA6E6EB374B
SHA256:2F2D5538346FD8E5522AC6D1FDB75A9307560C1823C37D1ABD06F02A6ABD2B81
1928iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF84FC16B3AA757A0F.TMPbinary
MD5:27A4A7BC15E1C636908520551A2DCA32
SHA256:B93706EA66A5953F1E8D7A7E0D3AF026C062593608191640FD3FEC3B950EFF32
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
18
DNS requests
8
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2084
iexplore.exe
GET
200
184.25.51.113:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?fd70820256555726
unknown
compressed
4.66 Kb
unknown
2084
iexplore.exe
GET
200
184.25.51.113:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5ab10afc70c283f8
unknown
compressed
4.66 Kb
unknown
2084
iexplore.exe
GET
200
184.25.51.113:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?2059bfb2f4ebfaa2
unknown
compressed
4.66 Kb
unknown
2084
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
1080
svchost.exe
GET
304
184.24.77.202:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a414549a770d7263
unknown
—
—
unknown
2844
javaw.exe
GET
200
46.137.128.27:80
http://checkip.amazonaws.com/
unknown
text
15 b
unknown
2844
javaw.exe
GET
301
172.67.75.176:80
http://freegeoip.net/xml/216.24.216.192
unknown
—
—
unknown
2844
javaw.exe
GET
200
172.67.75.176:80
http://freegeoip.net/shutdown
unknown
html
1.00 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2084
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
EDGECAST
US
whitelisted
2084
iexplore.exe
184.25.51.113:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
2084
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1928
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
EDGECAST
US
whitelisted
1080
svchost.exe
184.24.77.202:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
2844
javaw.exe
46.137.128.27:80
checkip.amazonaws.com
AMAZON-02
IE
unknown
2844
javaw.exe
172.67.75.176:80
freegeoip.net
CLOUDFLARENET
US
unknown

DNS requests

Domain
IP
Reputation
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ctldl.windowsupdate.com
  • 184.25.51.113
  • 184.25.50.8
  • 184.24.77.202
  • 184.24.77.194
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
checkip.amazonaws.com
  • 46.137.128.27
  • 52.48.21.181
  • 52.48.29.197
  • 52.17.125.217
  • 52.17.13.98
  • 52.212.132.245
  • 34.251.159.179
  • 52.215.138.204
shared
freegeoip.net
  • 172.67.75.176
  • 104.26.14.73
  • 104.26.15.73
shared

Threats

PID
Process
Class
Message
1080
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain (freegeiop .net in DNS lookup)
2844
javaw.exe
Potentially Bad Traffic
ET POLICY Vulnerable Java Version 1.8.x Detected
2844
javaw.exe
Potentially Bad Traffic
ET POLICY Vulnerable Java Version 1.8.x Detected
2844
javaw.exe
Device Retrieving External IP Address Detected
SUSPICIOUS [ANY.RUN] Received IP address from server as result of HTTP request
4 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Crimson RAT Builder.b.7z