We're sorry but any.run reports doesn't work properly without JavaScript enabled. Please enable it to continue.
Analysis result
Behavior activities
Threats
Find similar analyses in TI Lookup
Analysis date (UTC):
25 January 2019, 09:11
Analysis environment:
Windows 7 Pro, build 7601, x86
Crysis_check.exe
MD5:
F206E97D5B68B5B877FFF1095FD0FBB3
SHA1:
AA6B3A7F7A430D4F4DEDD6DE1F60C0E5B8372F2A
SHA256:
4B5B11E64FDF9D164AB4A592ECBF99032AE0AC79AECBF68FE6A59DEFFB8E6EF3
Analysis result
Threat level:
Malicious activity
Tags:
ransomware
dharma
Full analysis:
Analysis Crysis_check.exe (MD5: F206E97D5B68B5B877FFF1095FD0FBB3) Malicious activity - Interactive analysis ANY.RUN
Behavior activities
MALICIOUS
Changes the autorun value in the registry
Crysis_check.exe (PID: 3612)
Crysis_check.exe (PID: 2420)
Runs app for hidden code execution
Crysis_check.exe (PID: 3612)
Crysis_check.exe (PID: 2420)
Writes to a start menu file
Crysis_check.exe (PID: 3612)
Crysis_check.exe (PID: 2420)
Deletes shadow copies
cmd.exe (PID: 1324)
cmd.exe (PID: 3412)
cmd.exe (PID: 2200)
Renames files like Ransomware
Crysis_check.exe (PID: 2420)
SUSPICIOUS
Creates files in the user directory
Crysis_check.exe (PID: 3612)
Starts CMD.EXE for commands execution
Crysis_check.exe (PID: 3612)
Crysis_check.exe (PID: 2420)
Executable content was dropped or overwritten
Crysis_check.exe (PID: 3612)
Crysis_check.exe (PID: 2420)
Application launched itself
Crysis_check.exe (PID: 3612)
Creates files in the Windows directory
Crysis_check.exe (PID: 2420)
Creates files in the program directory
Crysis_check.exe (PID: 3612)
Crysis_check.exe (PID: 2420)
INFO
No info indicators.
Threats
No threats detected