File name:

CrystalDiskInfo8_1_0.zip

Full analysis: https://app.any.run/tasks/3e809ab5-daf9-47cb-9b7b-cdd342db530b
Verdict: Malicious activity
Analysis date: May 21, 2019, 02:02:39
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

563D0AE995DC41973260681DAB96AD7A

SHA1:

BA60A6C8C9533EFE65B3C33901E0516CE09504A8

SHA256:

840F394F6AAD421BC24FDA4F1625A318C4F1C136D1067BE0C8AB621AF81743EC

SSDEEP:

98304:A74DdJdi5O4M/vvgKQCaPJw6fsYByuRUYSpsU7bzS4/wPbyKZxy9MmQ:FdJdi5OhIKQ4EkASpsU7ZsyQxClQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • DiskInfo32.exe (PID: 3276)
      • DiskInfo32.exe (PID: 2904)
      • DiskInfo32.exe (PID: 2236)
      • DiskInfo32.exe (PID: 2152)

  • SUSPICIOUS

    • Low-level read access rights to disk partition

      • DiskInfo32.exe (PID: 2904)
      • DiskInfo32.exe (PID: 2236)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3400)

  • INFO

    • Manual execution by user

      • DiskInfo32.exe (PID: 2904)
      • DiskInfo32.exe (PID: 2152)
      • DiskInfo32.exe (PID: 2236)
      • DiskInfo32.exe (PID: 3276)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2019:04:22 21:45:11
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: CdiResource/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe diskinfo32.exe no specs diskinfo32.exe diskinfo32.exe no specs diskinfo32.exe

Process information

PID
CMD
Path
Indicators
Parent process
2152"C:\Users\admin\Desktop\DiskInfo32.exe" C:\Users\admin\Desktop\DiskInfo32.exe—explorer.exe
User:
admin
Company:
Crystal Dew World
Integrity Level:
MEDIUM
Description:
CrystalDiskInfo
Exit code:
3221226540
Version:
8.1.0.2019
Modules
Images
c:\users\admin\desktop\diskinfo32.exe
c:\systemroot\system32\ntdll.dll
2236"C:\Users\admin\Desktop\DiskInfo32.exe" C:\Users\admin\Desktop\DiskInfo32.exe
explorer.exe
User:
admin
Company:
Crystal Dew World
Integrity Level:
HIGH
Description:
CrystalDiskInfo
Exit code:
2
Version:
8.1.0.2019
Modules
Images
c:\users\admin\desktop\diskinfo32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msimg32.dll
2904"C:\Users\admin\Desktop\DiskInfo32.exe" C:\Users\admin\Desktop\DiskInfo32.exe
explorer.exe
User:
admin
Company:
Crystal Dew World
Integrity Level:
HIGH
Description:
CrystalDiskInfo
Exit code:
0
Version:
8.1.0.2019
Modules
Images
c:\users\admin\desktop\diskinfo32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msimg32.dll
3276"C:\Users\admin\Desktop\DiskInfo32.exe" C:\Users\admin\Desktop\DiskInfo32.exe—explorer.exe
User:
admin
Company:
Crystal Dew World
Integrity Level:
MEDIUM
Description:
CrystalDiskInfo
Exit code:
3221226540
Version:
8.1.0.2019
Modules
Images
c:\users\admin\desktop\diskinfo32.exe
c:\systemroot\system32\ntdll.dll
3400"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\CrystalDiskInfo8_1_0.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
454
Read events
435
Write events
19
Delete events
0

Modification events

(PID) Process:(3400) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3400) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3400) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3400) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\CrystalDiskInfo8_1_0.zip
(PID) Process:(3400) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3400) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3400) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3400) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3400) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
(PID) Process:(3400) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\AppData\Local\Temp
Executable files
5
Suspicious files
1
Text files
480
Unknown types
0

Dropped files

PID
Process
Filename
Type
3400WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3400.18462\CdiResource\dialog\image\buttonDisable.pngimage
MD5:8CE9F3A5880F1C753F75E814A77EED91
SHA256:EA1304F8D276D6E0775611C6FA8E0DEC1E320F4D13F94C1AB8F03F22328774FB
3400WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3400.18462\CdiResource\dialog\image\GraphAllOff.pngimage
MD5:2861E08530AC1A86BD1CEA0E00BA4934
SHA256:A65706643F47DD3413CB0ADDDEA632FEEAC6270C966CB61E3C3B42E7DDAAC295
3400WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3400.18462\CdiResource\dialog\flot\excanvas.min.jstext
MD5:08182065D2093C978A9BFA16B0829173
SHA256:5F94B032A110504B7B261EAF71392FA3E8D82CDC6455C0CBA5C9F03CD34ED122
3400WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3400.18462\CdiResource\AlertMail4.exeexecutable
MD5:7E919B00AEE429607FF663A6511F179F
SHA256:CFB06B92A0483AAD4D653DB58121417B776D41C80DB5CAB1B4465C172F4168A9
3400WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3400.18462\CdiResource\dialog\flot\jquery.flot.min.jstext
MD5:F1843ACDB53F2C88903F89E4E175CD32
SHA256:8A0F1DD79995A9308CFFDCAE12445D9F727D66A450EF5158280E0724DE55C32F
3400WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3400.18462\CdiResource\dialog\image\buttonHover.pngimage
MD5:05CBBDA99D889FB8A6C6595F8B954FC2
SHA256:FD7B2E419D2954AD2345122BFFCF11F5D4DD3DFDBEE4955E015D60628B0B4896
3400WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3400.18462\CdiResource\AlertMail.exeexecutable
MD5:46A29DAB77E0C3FF5B7E0EA2F1E5B7C8
SHA256:A9B8A51A99B4C63038C948C5BDA54750EA85E0D9B4DB7D78FB4DAC9D8854FEEA
3400WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3400.18462\CdiResource\dialog\image\file.pngimage
MD5:4D329376128328C069C43D21AEF2C792
SHA256:6C0363C3B862A56B8DFD7BBDCD7759E6A4B4843FC1627873B97309939EDDF7C4
3400WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3400.18462\CdiResource\dialog\image\GraphAllOn.pngimage
MD5:AD5566B216D5BA4997966A9964D1C64B
SHA256:2730DE1C517663AA87403ABEAF6FE562BC5EABD15FA0C0D898C1AFE37276C935
3400WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3400.18462\CdiResource\dialog\image\GraphReset.pngimage
MD5:6A14DF27BA1CCE174D896B3F0196C653
SHA256:BCCB279A905906F1B4DF54541E410A11E31CACCE3158342FF8219395418F209B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
CrystalDiskInfo8_1_0.zip