File name:

Trojan-Ransom.Win32.Crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.7z

Full analysis: https://app.any.run/tasks/5eaf4ed7-4c51-4f3b-9938-0c3d08616394
Verdict: Malicious activity
Threats:

Dharma is advanced ransomware that has been observed in the wild since 2016. It is considered to be the second most profitable RaaS operation by the FBI. The malware targets hospitals and state organizations, encrypts files, and demands a payment to restore access to lost information.

Malware Trends Tracker     >>>
Analysis date: May 02, 2025, 21:40:54
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
arch-exec
phobos
ransomware
dharma
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

5CB427C9ADD7FB6BC4D45B2B529DCA6F

SHA1:

97A455E4423AB0D4EC0EC2FF68187734FC001A41

SHA256:

609C976F42C395500EA292568E94BF111390A99D49EC1403FE2663BB1E3100D4

SSDEEP:

12288:n2iDaVzNq/h8RwvWzbd8T3lRjUQjzGOtij+unr89z/fSp:2iDAzNqqRwvW/d8T3llUuGOtij+u49zO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • DHARMA mutex has been found

      • Trojan-Ransom.Win32.Crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.exe (PID: 2412)

    • Changes the autorun value in the registry

      • Trojan-Ransom.Win32.Crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.exe (PID: 2412)

    • Create files in the Startup directory

      • Trojan-Ransom.Win32.Crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.exe (PID: 2412)

    • Deletes shadow copies

      • cmd.exe (PID: 984)

    • PHOBOS has been detected

      • Trojan-Ransom.Win32.Crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.exe (PID: 2412)

    • Renames files like ransomware

      • Trojan-Ransom.Win32.Crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.exe (PID: 2412)

  • SUSPICIOUS

    • Application launched itself

      • Trojan-Ransom.Win32.Crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.exe (PID: 1548)

    • Executable content was dropped or overwritten

      • Trojan-Ransom.Win32.Crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.exe (PID: 2412)

    • Starts CMD.EXE for commands execution

      • Trojan-Ransom.Win32.Crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.exe (PID: 2412)

    • Creates file in the systems drive root

      • Trojan-Ransom.Win32.Crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.exe (PID: 2412)

    • Executes as Windows Service

      • VSSVC.exe (PID: 3312)

    • Process drops legitimate windows executable

      • Trojan-Ransom.Win32.Crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.exe (PID: 2412)

  • INFO

    • The sample compiled with english language support

      • WinRAR.exe (PID: 2448)
      • Trojan-Ransom.Win32.Crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.exe (PID: 2412)

    • Checks supported languages

      • Trojan-Ransom.Win32.Crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.exe (PID: 1548)
      • Trojan-Ransom.Win32.Crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.exe (PID: 2412)
      • mode.com (PID: 2544)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2448)

    • Reads the computer name

      • Trojan-Ransom.Win32.Crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.exe (PID: 1548)
      • Trojan-Ransom.Win32.Crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.exe (PID: 2412)

    • Manual execution by a user

      • Trojan-Ransom.Win32.Crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.exe (PID: 1548)

    • Creates files or folders in the user directory

      • Trojan-Ransom.Win32.Crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.exe (PID: 2412)

    • Creates files in the program directory

      • Trojan-Ransom.Win32.Crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.exe (PID: 2412)

    • Starts MODE.COM to configure console settings

      • mode.com (PID: 2544)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
ModifyDate: 2019:11:20 19:53:44+00:00
ArchivedFileName: Trojan-Ransom.Win32.Crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
7
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe trojan-ransom.win32.crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.exe #DHARMA trojan-ransom.win32.crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.exe cmd.exe no specs mode.com no specs vssadmin.exe no specs vssvc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
984"C:\Windows\system32\cmd.exe"C:\Windows\System32\cmd.exe—Trojan-Ransom.Win32.Crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1548"C:\Users\admin\Desktop\Trojan-Ransom.Win32.Crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.exe" C:\Users\admin\Desktop\Trojan-Ransom.Win32.Crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.exe
explorer.exe
User:
admin
Company:
CloneDVD Studio.
Integrity Level:
HIGH
Description:
Directives Pipelined Switches Imultiple Francis Privilege
Exit code:
0
Version:
7.6.3.3
Modules
Images
c:\users\admin\desktop\trojan-ransom.win32.crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2412C:\Users\admin\Desktop\Trojan-Ransom.Win32.Crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.exeC:\Users\admin\Desktop\Trojan-Ransom.Win32.Crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.exe
Trojan-Ransom.Win32.Crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.exe
User:
admin
Company:
CloneDVD Studio.
Integrity Level:
HIGH
Description:
Directives Pipelined Switches Imultiple Francis Privilege
Version:
7.6.3.3
Modules
Images
c:\users\admin\desktop\trojan-ransom.win32.crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2448"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\Trojan-Ransom.Win32.Crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.7zC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2544mode con cp select=1251C:\Windows\System32\mode.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
DOS Device MODE Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\mode.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ulib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3080vssadmin delete shadows /all /quietC:\Windows\System32\vssadmin.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
3312C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
1 381
Read events
1 357
Write events
24
Delete events
0

Modification events

(PID) Process:(2448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Trojan-Ransom.Win32.Crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.7z
(PID) Process:(2448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
Executable files
98
Suspicious files
1 087
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
2412Trojan-Ransom.Win32.Crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.exeC:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-500\desktop.ini —
MD5:—
SHA256:—
2412Trojan-Ransom.Win32.Crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.exeC:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\desktop.ini —
MD5:—
SHA256:—
2412Trojan-Ransom.Win32.Crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.exeC:\config.sys —
MD5:—
SHA256:—
2412Trojan-Ransom.Win32.Crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.exeC:\autoexec.bat —
MD5:—
SHA256:—
2412Trojan-Ransom.Win32.Crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.exeC:\MSOCache\All Users\{90140000-0015-0407-0000-0000000FF1CE}-C\AccessMUI.xml —
MD5:—
SHA256:—
2412Trojan-Ransom.Win32.Crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.exeC:\MSOCache\All Users\{90140000-0015-0407-0000-0000000FF1CE}-C\AccLR.cab.id-C4BA3647.[admin@fentex.net].money —
MD5:—
SHA256:—
2412Trojan-Ransom.Win32.Crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.exeC:\MSOCache\All Users\{90140000-0015-0407-0000-0000000FF1CE}-C\Setup.xml —
MD5:—
SHA256:—
2412Trojan-Ransom.Win32.Crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.exeC:\MSOCache\All Users\{90140000-0015-0407-0000-0000000FF1CE}-C\branding.xml —
MD5:—
SHA256:—
2412Trojan-Ransom.Win32.Crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.exeC:\MSOCache\All Users\{90140000-0015-040C-0000-0000000FF1CE}-C\AccessMUI.xml —
MD5:—
SHA256:—
2412Trojan-Ransom.Win32.Crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.exeC:\MSOCache\All Users\{90140000-0015-0410-0000-0000000FF1CE}-C\AccessMUI.xml —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.110
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Trojan-Ransom.Win32.Crusis.drt-95fab2c98cea2e2e587b6807f64151d2e8acc90ab4c5be176199af57dba9bcd8.7z