analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

CrystalDiskInfo8_1_0.zip

Full analysis: https://app.any.run/tasks/3e809ab5-daf9-47cb-9b7b-cdd342db530b
Verdict: Malicious activity
Analysis date: May 21, 2019, 02:02:39
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

563D0AE995DC41973260681DAB96AD7A

SHA1:

BA60A6C8C9533EFE65B3C33901E0516CE09504A8

SHA256:

840F394F6AAD421BC24FDA4F1625A318C4F1C136D1067BE0C8AB621AF81743EC

SSDEEP:

98304:A74DdJdi5O4M/vvgKQCaPJw6fsYByuRUYSpsU7bzS4/wPbyKZxy9MmQ:FdJdi5OhIKQ4EkASpsU7ZsyQxClQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • DiskInfo32.exe (PID: 2236)
      • DiskInfo32.exe (PID: 2152)
      • DiskInfo32.exe (PID: 2904)
      • DiskInfo32.exe (PID: 3276)

  • SUSPICIOUS

    • Low-level read access rights to disk partition

      • DiskInfo32.exe (PID: 2904)
      • DiskInfo32.exe (PID: 2236)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3400)

  • INFO

    • Manual execution by user

      • DiskInfo32.exe (PID: 2152)
      • DiskInfo32.exe (PID: 2904)
      • DiskInfo32.exe (PID: 2236)
      • DiskInfo32.exe (PID: 3276)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: CdiResource/
ZipUncompressedSize: -
ZipCompressedSize: -
ZipCRC: 0x00000000
ZipModifyDate: 2019:04:22 21:45:11
ZipCompression: None
ZipBitFlag: -
ZipRequiredVersion: 10
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe diskinfo32.exe no specs diskinfo32.exe diskinfo32.exe no specs diskinfo32.exe

Process information

PID
CMD
Path
Indicators
Parent process
3400"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\CrystalDiskInfo8_1_0.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3276"C:\Users\admin\Desktop\DiskInfo32.exe" C:\Users\admin\Desktop\DiskInfo32.exe—explorer.exe
User:
admin
Company:
Crystal Dew World
Integrity Level:
MEDIUM
Description:
CrystalDiskInfo
Exit code:
3221226540
Version:
8.1.0.2019
2236"C:\Users\admin\Desktop\DiskInfo32.exe" C:\Users\admin\Desktop\DiskInfo32.exe
explorer.exe
User:
admin
Company:
Crystal Dew World
Integrity Level:
HIGH
Description:
CrystalDiskInfo
Exit code:
2
Version:
8.1.0.2019
2152"C:\Users\admin\Desktop\DiskInfo32.exe" C:\Users\admin\Desktop\DiskInfo32.exe—explorer.exe
User:
admin
Company:
Crystal Dew World
Integrity Level:
MEDIUM
Description:
CrystalDiskInfo
Exit code:
3221226540
Version:
8.1.0.2019
2904"C:\Users\admin\Desktop\DiskInfo32.exe" C:\Users\admin\Desktop\DiskInfo32.exe
explorer.exe
User:
admin
Company:
Crystal Dew World
Integrity Level:
HIGH
Description:
CrystalDiskInfo
Version:
8.1.0.2019
Total events
454
Read events
435
Write events
19
Delete events
0

Modification events

(PID) Process:(3400) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3400) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3400) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3400) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\CrystalDiskInfo8_1_0.zip
(PID) Process:(3400) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3400) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3400) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3400) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3400) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
(PID) Process:(3400) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\AppData\Local\Temp
Executable files
5
Suspicious files
1
Text files
480
Unknown types
0

Dropped files

PID
Process
Filename
Type
3400WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3400.18462\CdiResource\dialog\Graph.htmlhtml
MD5:006B850CE85CFBCC92BBEE6966BDF0D5
SHA256:647860CDA8FDF6F344B835472C04ACB929EA411270F780B4FA27161E9E145C35
3400WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3400.18462\CdiResource\dialog\flot\jquery.min.jstext
MD5:A9331828C517AC5D97F93B3CFDBCC9BC
SHA256:D548530775A6286F49BA66E0715876B4EC5985966B0291C21568FECFC4178E8D
3400WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3400.18462\CdiResource\dialog\image\graphMenuBar.pngimage
MD5:102C544B1B790C9786FAEAE74207BFF3
SHA256:B3152960A4457271C0692F409A5B3D127CDABCD3CFEE006B40A9F379C78CC755
3400WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3400.18462\CdiResource\dialog\flot\jquery.flot.min.jstext
MD5:F1843ACDB53F2C88903F89E4E175CD32
SHA256:8A0F1DD79995A9308CFFDCAE12445D9F727D66A450EF5158280E0724DE55C32F
3400WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3400.18462\CdiResource\dialog\image\labelEnable.pngimage
MD5:5BF6DFA9A281A52B31CE5190B3CE1D9C
SHA256:985F656FB6EB0ECFBBED6242F6FDC693C15630A7259BD0787326C2B9F28575A1
3400WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3400.18462\CdiResource\dialog\image\buttonHover.pngimage
MD5:05CBBDA99D889FB8A6C6595F8B954FC2
SHA256:FD7B2E419D2954AD2345122BFFCF11F5D4DD3DFDBEE4955E015D60628B0B4896
3400WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3400.18462\CdiResource\dialog\image\GraphAllOn.pngimage
MD5:AD5566B216D5BA4997966A9964D1C64B
SHA256:2730DE1C517663AA87403ABEAF6FE562BC5EABD15FA0C0D898C1AFE37276C935
3400WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3400.18462\CdiResource\dialog\image\background.pngimage
MD5:1CFDA5CA069D29FEF4EE61F8A119249A
SHA256:0201EE1A84E8CE5D1CDEA826C3B793FD26106517DE12D07765E66C97A884B3E3
3400WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3400.18462\CdiResource\dialog\flot\excanvas.min.jstext
MD5:08182065D2093C978A9BFA16B0829173
SHA256:5F94B032A110504B7B261EAF71392FA3E8D82CDC6455C0CBA5C9F03CD34ED122
3400WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3400.18462\CdiResource\AlertMail4.exeexecutable
MD5:7E919B00AEE429607FF663A6511F179F
SHA256:CFB06B92A0483AAD4D653DB58121417B776D41C80DB5CAB1B4465C172F4168A9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
CrystalDiskInfo8_1_0.zip