| File name: | Trojan-Ransom.Win32.Crusis.g-9a5a620bf7e1eeed874d02afa8f7d2a6bb7c51ed431346f87514cf239c0d5a17.7z |
| Full analysis: | https://app.any.run/tasks/8219906d-e2ce-41ca-9ed3-62fa50550a7f |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | April 29, 2025, 15:27:35 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-7z-compressed |
| File info: | 7-zip archive data, version 0.4 |
| MD5: | E5F7CC082AD9020CBEC46A1F53A12A31 |
| SHA1: | 2AA93CB81CA73EBCEF4BED492E30E03A07173172 |
| SHA256: | 776E7DD943C236C7A4CE25638377A07565F82D4239F5613251F2916A4C28FCA0 |
| SSDEEP: | 1536:kIdnUz8410Oco6ELEmEkOtYaA4V05Pe8PJhJO0agWY0laUdp2veG3lqBTvnf:z2841vco6RRYu051rJO0C3dkGwlqBbnf |
MALICIOUS
Application was injected by another process
- SearchFilterHost.exe (PID: 184)
- ctfmon.exe (PID: 1356)
- dwm.exe (PID: 664)
- taskeng.exe (PID: 292)
- explorer.exe (PID: 1452)
Runs injected code in another process
- explorer.exe (PID: 2732)
Changes the autorun value in the registry
- explorer.exe (PID: 2732)
SMOKE has been detected (SURICATA)
- explorer.exe (PID: 2732)
SUSPICIOUS
Application launched itself
- Trojan-Ransom.Win32.Crusis.g-9a5a620bf7e1eeed874d02afa8f7d2a6bb7c51ed431346f87514cf239c0d5a17.exe (PID: 1500)
Executable content was dropped or overwritten
- explorer.exe (PID: 2732)
Searches for installed software
- explorer.exe (PID: 2732)
INFO
Executable content was dropped or overwritten
- WinRAR.exe (PID: 2472)
Reads the Internet Settings
- explorer.exe (PID: 1452)
- explorer.exe (PID: 2732)
Checks supported languages
- Trojan-Ransom.Win32.Crusis.g-9a5a620bf7e1eeed874d02afa8f7d2a6bb7c51ed431346f87514cf239c0d5a17.exe (PID: 1500)
- Trojan-Ransom.Win32.Crusis.g-9a5a620bf7e1eeed874d02afa8f7d2a6bb7c51ed431346f87514cf239c0d5a17.exe (PID: 1028)
Reads settings of System Certificates
- explorer.exe (PID: 2732)
Manual execution by a user
- Trojan-Ransom.Win32.Crusis.g-9a5a620bf7e1eeed874d02afa8f7d2a6bb7c51ed431346f87514cf239c0d5a17.exe (PID: 1500)
Reads security settings of Internet Explorer
- explorer.exe (PID: 1452)
Reads the computer name
- Trojan-Ransom.Win32.Crusis.g-9a5a620bf7e1eeed874d02afa8f7d2a6bb7c51ed431346f87514cf239c0d5a17.exe (PID: 1028)
Creates files or folders in the user directory
- explorer.exe (PID: 2732)
Reads the software policy settings
- explorer.exe (PID: 2732)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .7z | | | 7-Zip compressed archive (v0.4) (57.1) |
|---|---|---|
| .7z | | | 7-Zip compressed archive (gen) (42.8) |
EXIF
ZIP
| FileVersion: | 7z v0.04 |
|---|---|
| ModifyDate: | 2016:07:20 14:54:30+00:00 |
| ArchivedFileName: | Trojan-Ransom.Win32.Crusis.g-9a5a620bf7e1eeed874d02afa8f7d2a6bb7c51ed431346f87514cf239c0d5a17.exe |
Total processes
41
Monitored processes
10
Malicious processes
4
Suspicious processes
4
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 184 | "C:\Windows\system32\SearchFilterHost.exe" 0 520 524 532 65536 528 | C:\Windows\System32\SearchFilterHost.exe | SearchIndexer.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Windows Search Filter Host Exit code: 0 Version: 7.00.7601.24542 (win7sp1_ldr_escrow.191209-2211) Modules
| |||||||||||||||
| 292 | taskeng.exe {665B2EB3-4094-4F5C-9CFD-B00E6B5BA3D1} | C:\Windows\System32\taskeng.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Task Scheduler Engine Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 664 | "C:\Windows\system32\Dwm.exe" | C:\Windows\System32\dwm.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Desktop Window Manager Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1028 | "C:\Users\admin\Desktop\Trojan-Ransom.Win32.Crusis.g-9a5a620bf7e1eeed874d02afa8f7d2a6bb7c51ed431346f87514cf239c0d5a17.exe" | C:\Users\admin\Desktop\Trojan-Ransom.Win32.Crusis.g-9a5a620bf7e1eeed874d02afa8f7d2a6bb7c51ed431346f87514cf239c0d5a17.exe | — | Trojan-Ransom.Win32.Crusis.g-9a5a620bf7e1eeed874d02afa8f7d2a6bb7c51ed431346f87514cf239c0d5a17.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 1080 | C:\Windows\system32\svchost.exe -k NetworkService | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1356 | C:\Windows\System32\ctfmon.exe | C:\Windows\System32\ctfmon.exe | taskeng.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: CTF Loader Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1452 | C:\Windows\Explorer.EXE | C:\Windows\explorer.exe | — | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1500 | "C:\Users\admin\Desktop\Trojan-Ransom.Win32.Crusis.g-9a5a620bf7e1eeed874d02afa8f7d2a6bb7c51ed431346f87514cf239c0d5a17.exe" | C:\Users\admin\Desktop\Trojan-Ransom.Win32.Crusis.g-9a5a620bf7e1eeed874d02afa8f7d2a6bb7c51ed431346f87514cf239c0d5a17.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 2472 | "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\Trojan-Ransom.Win32.Crusis.g-9a5a620bf7e1eeed874d02afa8f7d2a6bb7c51ed431346f87514cf239c0d5a17.7z | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 2732 | explorer.exe | C:\Windows\explorer.exe | Trojan-Ransom.Win32.Crusis.g-9a5a620bf7e1eeed874d02afa8f7d2a6bb7c51ed431346f87514cf239c0d5a17.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Explorer Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
12 605
Read events
12 524
Write events
80
Delete events
1
Modification events
| (PID) Process: | (2472) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2472) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
| (PID) Process: | (2472) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip | |||
| (PID) Process: | (2472) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (2472) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\Trojan-Ransom.Win32.Crusis.g-9a5a620bf7e1eeed874d02afa8f7d2a6bb7c51ed431346f87514cf239c0d5a17.7z | |||
| (PID) Process: | (2472) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (2472) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (2472) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (2472) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (2472) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
Executable files
3
Suspicious files
3
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1452 | explorer.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\290532160612e071.automaticDestinations-ms | binary | |
MD5:D4714D5B00C1342DCD22A2D29089B3E6 | SHA256:F17822263539D05E5368F16EBA90AEA88BF1984CFDC5D1CD14C2194900DC1FC4 | |||
| 2732 | explorer.exe | C:\Users\admin\AppData\Roaming\hwjjeece\tesrdgeh.exe | executable | |
MD5:3DAFD3CCA1EDF4B51321EB019CE0196F | SHA256:9A5A620BF7E1EEED874D02AFA8F7D2A6BB7C51ED431346F87514CF239C0D5A17 | |||
| 1452 | explorer.exe | C:\Users\admin\Desktop\Trojan-Ransom.Win32.Crusis.g-9a5a620bf7e1eeed874d02afa8f7d2a6bb7c51ed431346f87514cf239c0d5a17.exe | executable | |
MD5:3DAFD3CCA1EDF4B51321EB019CE0196F | SHA256:9A5A620BF7E1EEED874D02AFA8F7D2A6BB7C51ED431346F87514CF239C0D5A17 | |||
| 2472 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb2472.27496\Trojan-Ransom.Win32.Crusis.g-9a5a620bf7e1eeed874d02afa8f7d2a6bb7c51ed431346f87514cf239c0d5a17.exe | executable | |
MD5:3DAFD3CCA1EDF4B51321EB019CE0196F | SHA256:9A5A620BF7E1EEED874D02AFA8F7D2A6BB7C51ED431346F87514CF239C0D5A17 | |||
| 1452 | explorer.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\1b4dd67f29cb1962.automaticDestinations-ms | binary | |
MD5:062AA1ED1884A17703AF14AB6A8C7EA2 | SHA256:D664F1862E44F8980E6031186452DD20853F8E5C71014D558F5B8A39DDD2208D | |||
| 1452 | explorer.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\Trojan-Ransom.Win32.Crusis.g-9a5a620bf7e1eeed874d02afa8f7d2a6bb7c51ed431346f87514cf239c0d5a17.7z.lnk | binary | |
MD5:CE8C763791C3913CEA4A97E3AF660069 | SHA256:5909085BAA6E51665422F8DDC9993063F1A82DF8813134443F1AE9B141FAD76F | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
12
DNS requests
5
Threats
3
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2732 | explorer.exe | GET | 301 | 204.79.197.203:80 | http://www.msn.com/ | unknown | — | — | whitelisted |
2732 | explorer.exe | POST | — | 2.20.245.141:80 | http://www.adobe.com/ | unknown | — | — | whitelisted |
2732 | explorer.exe | POST | 400 | 13.107.253.64:80 | http://support.microsoft.com/kb/2460049 | unknown | — | — | whitelisted |
2732 | explorer.exe | POST | — | 2.20.245.136:80 | http://www.adobe.com/ | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 224.0.0.252:5355 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2732 | explorer.exe | 204.79.197.203:80 | www.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
2732 | explorer.exe | 204.79.197.203:443 | www.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
2732 | explorer.exe | 2.20.245.136:80 | www.adobe.com | Akamai International B.V. | NL | whitelisted |
2732 | explorer.exe | 13.107.253.64:80 | support.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
2732 | explorer.exe | 13.107.253.64:443 | support.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
2732 | explorer.exe | 2.20.245.141:80 | www.adobe.com | Akamai International B.V. | SE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
www.msn.com |
| whitelisted |
www.adobe.com |
| whitelisted |
support.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2732 | explorer.exe | A Network Trojan was detected | ET MALWARE Sharik/Smoke Loader Adobe Connectivity Check 3 |
2732 | explorer.exe | A Network Trojan was detected | ET MALWARE Sharik/Smoke Loader Microsoft Connectivity check |
2732 | explorer.exe | A Network Trojan was detected | ET MALWARE Sharik/Smoke Loader Adobe Connectivity Check 3 |