File name:

CryptoRipper v1.0.zip

Full analysis: https://app.any.run/tasks/8b8b8bfb-1868-45dc-b7d1-ac5db324a708
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: September 01, 2024, 22:09:40
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
python
sniffthem
loader
clipper
diamotrix
pyinstaller
crypto-regex
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

0CD0D3FB921F5457BB4FAE22C1752477

SHA1:

05D513BA4F76ECBDC819577A6B7008DC38223C4C

SHA256:

9B9EF99293591F149691116D16B76E87970059D06BA94EF462FBFC8ED910E2E5

SSDEEP:

98304:xk6nVGSBz2wvFOjhfHw1F3Rd8qt1rY7qFrUTApPCRzJdvMRplO9uGwcpRXd5Ywu8:xkWdBLKFnQGtF2A

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • temp_nik_zbi.exe (PID: 2128)
      • svchost.exe (PID: 5400)

    • Create files in the Startup directory

      • temp_nik_zbi.exe (PID: 2128)

    • Runs injected code in another process

      • svchost.exe (PID: 5400)

    • Application was injected by another process

      • explorer.exe (PID: 4552)

    • DIAMOTRIX has been detected (SURICATA)

      • explorer.exe (PID: 4552)

    • SNIFFTHEM has been detected (SURICATA)

      • svchost.exe (PID: 5400)

  • SUSPICIOUS

    • The process drops C-runtime libraries

      • CryptoRipper v1.0.exe (PID: 1920)

    • Drops the executable file immediately after the start

      • CryptoRipper v1.0.exe (PID: 1920)
      • CryptoRipper v1.0.exe (PID: 1640)
      • temp_nik_zbi.exe (PID: 2128)

    • Process drops python dynamic module

      • CryptoRipper v1.0.exe (PID: 1920)

    • Executable content was dropped or overwritten

      • CryptoRipper v1.0.exe (PID: 1920)
      • temp_nik_zbi.exe (PID: 2128)
      • svchost.exe (PID: 5400)
      • CryptoRipper v1.0.exe (PID: 1640)

    • Application launched itself

      • CryptoRipper v1.0.exe (PID: 1920)

    • Process drops legitimate windows executable

      • CryptoRipper v1.0.exe (PID: 1920)

    • Loads Python modules

      • CryptoRipper v1.0.exe (PID: 1640)

    • Connects to the server without a host name

      • CryptoRipper v1.0.exe (PID: 1640)
      • explorer.exe (PID: 4552)
      • svchost.exe (PID: 5400)

    • Potential Corporate Privacy Violation

      • CryptoRipper v1.0.exe (PID: 1640)
      • svchost.exe (PID: 5400)

    • Process requests binary or script from the Internet

      • CryptoRipper v1.0.exe (PID: 1640)

    • Contacting a server suspected of hosting an CnC

      • explorer.exe (PID: 4552)

    • Found regular expressions for crypto-addresses (YARA)

      • svchost.exe (PID: 5400)

  • INFO

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 4552)
      • svchost.exe (PID: 5400)
      • Taskmgr.exe (PID: 5064)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 4980)
      • explorer.exe (PID: 4552)

    • Manual execution by a user

      • CryptoRipper v1.0.exe (PID: 1920)

    • Create files in a temporary directory

      • CryptoRipper v1.0.exe (PID: 1920)
      • CryptoRipper v1.0.exe (PID: 1640)
      • svchost.exe (PID: 5400)

    • Checks supported languages

      • CryptoRipper v1.0.exe (PID: 1920)
      • CryptoRipper v1.0.exe (PID: 1640)
      • temp_nik_zbi.exe (PID: 2128)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4980)

    • Reads the computer name

      • CryptoRipper v1.0.exe (PID: 1920)
      • temp_nik_zbi.exe (PID: 2128)

    • Reads the machine GUID from the registry

      • CryptoRipper v1.0.exe (PID: 1640)

    • Checks proxy server information

      • CryptoRipper v1.0.exe (PID: 1640)
      • svchost.exe (PID: 5400)

    • Creates files or folders in the user directory

      • temp_nik_zbi.exe (PID: 2128)
      • explorer.exe (PID: 4552)

    • PyInstaller has been detected (YARA)

      • CryptoRipper v1.0.exe (PID: 1920)
      • CryptoRipper v1.0.exe (PID: 1640)

    • Reads the software policy settings

      • slui.exe (PID: 3660)

    • Changes appearance of the Explorer extensions

      • svchost.exe (PID: 5400)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2024:08:30 04:58:36
ZipCRC: 0x237d5886
ZipCompressedSize: 6107606
ZipUncompressedSize: 6278539
ZipFileName: CryptoRipper v1.0.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
13
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe THREAT cryptoripper v1.0.exe conhost.exe no specs THREAT cryptoripper v1.0.exe temp_nik_zbi.exe #SNIFFTHEM svchost.exe #DIAMOTRIX explorer.exe sppextcomobj.exe no specs slui.exe slui.exe no specs taskmgr.exe no specs taskmgr.exe rundll32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1640"C:\Users\admin\Desktop\CryptoRipper v1.0.exe" C:\Users\admin\Desktop\CryptoRipper v1.0.exe
CryptoRipper v1.0.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225786
Modules
Images
c:\users\admin\desktop\cryptoripper v1.0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1920"C:\Users\admin\Desktop\CryptoRipper v1.0.exe" C:\Users\admin\Desktop\CryptoRipper v1.0.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225786
Modules
Images
c:\users\admin\desktop\cryptoripper v1.0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2128C:\Users\admin\AppData\Local\Temp\temp_nik_zbi.exeC:\Users\admin\AppData\Local\Temp\temp_nik_zbi.exe
CryptoRipper v1.0.exe
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Description:
Services.exe
Exit code:
0
Version:
1.2.0.1
Modules
Images
c:\users\admin\appdata\local\temp\temp_nik_zbi.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3660"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4344C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
4552C:\WINDOWS\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\aepic.dll
c:\windows\system32\oleaut32.dll
4980"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\CryptoRipper v1.0.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
5048\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—CryptoRipper v1.0.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5064"C:\WINDOWS\system32\taskmgr.exe" /4C:\Windows\System32\Taskmgr.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Manager
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\combase.dll
5104C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
Total events
30 025
Read events
26 160
Write events
3 856
Delete events
9

Modification events

(PID) Process:(4980) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(4980) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(4552) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000007039A
Operation:writeName:VirtualDesktop
Value:
1000000030304456033BCEE44DE41B4E8AEC331E84F566D2
(PID) Process:(4980) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(4980) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\CryptoRipper v1.0.zip
(PID) Process:(4980) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4980) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4980) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4980) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4552) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Bags\1\Desktop
Operation:writeName:IconLayouts
Value:
00000000000000000000000000000000030001000100010011000000000000002C000000000000003A003A007B00360034003500460046003000340030002D0035003000380031002D0031003000310042002D0039004600300038002D003000300041004100300030003200460039003500340045007D003E002000200000001000000000000000430043006C00650061006E00650072002E006C006E006B003E0020007C0000001500000000000000410064006F006200650020004100630072006F006200610074002E006C006E006B003E0020007C0000000F00000000000000460069007200650066006F0078002E006C006E006B003E0020007C000000150000000000000047006F006F0067006C00650020004300680072006F006D0065002E006C006E006B003E0020007C000000180000000000000056004C00430020006D006500640069006100200070006C0061007900650072002E006C006E006B003E0020007C00000016000000000000004D006900630072006F0073006F0066007400200045006400670065002E006C006E006B003E0020007C0000000D0000000000000053006B007900700065002E006C006E006B003E0020007C000000170000000000000061007600610069006C00610062006C0065006300720065006400690074002E007200740066003E00200020000000140000000000000063006800720069007300670061006C006C006500720079002E0070006E0067003E00200020000000170000000000000063006F0075006E00630069006C006D006F006400690066006900650064002E0070006E0067003E002000200000000E0000000000000065006200750069006C0064002E007200740066003E002000200000001300000000000000660065006500740070006F00700075006C00610072002E007200740066003E0020002000000013000000000000006D0061006A006F00720068006100760069006E0067002E006A00700067003E0020002000000014000000000000007000610063006B0061006700650062006C006F006F0064002E007200740066003E002000200000001100000000000000760069006500770073006D006100700073002E007200740066003E002000200000001900000000000000430072007900700074006F005200690070007000650072002000760031002E0030002E006500780065003E00200020000000010000000000000002000100000000000000000001000000000000000200010000000000000000001100000006000000010000001100000000000000000000000000000000000000803F0000004008000000803F0000404009000000803F000080400A000000803F0000A0400B0000000040000000000C00000000400000803F0D0000000040000000400E0000000040000040400F00000000000000803F0100000000000000004002000000000000004040030000000000000080400400000000000000A04005000000803F0000000006000000803F0000803F07000000C040000040401000
Executable files
71
Suspicious files
5
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
4552explorer.exeC:\Users\admin\Desktop\good.txt —
MD5:—
SHA256:—
1920CryptoRipper v1.0.exeC:\Users\admin\AppData\Local\Temp\_MEI19202\_lzma.pydexecutable
MD5:37057C92F50391D0751F2C1D7AD25B02
SHA256:9442DC46829485670A6AC0C02EF83C54B401F1570D1D5D1D85C19C1587487764
1920CryptoRipper v1.0.exeC:\Users\admin\AppData\Local\Temp\_MEI19202\_bz2.pydexecutable
MD5:3DC8AF67E6EE06AF9EEC52FE985A7633
SHA256:C55821F5FDB0064C796B2C0B03B51971F073140BC210CBE6ED90387DB2BED929
4980WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4980.40314\CryptoRipper v1.0.exeexecutable
MD5:B047E7DD9459142C1D1D57DE29DA7A8F
SHA256:A2DA42E80F1FEE72A4552902D16EE11134D2C5E05EC996935A4CE01C08CC760C
4552explorer.exeC:\Users\admin\Desktop\CryptoRipper v1.0.exeexecutable
MD5:B047E7DD9459142C1D1D57DE29DA7A8F
SHA256:A2DA42E80F1FEE72A4552902D16EE11134D2C5E05EC996935A4CE01C08CC760C
1920CryptoRipper v1.0.exeC:\Users\admin\AppData\Local\Temp\_MEI19202\api-ms-win-core-debug-l1-1-0.dllexecutable
MD5:33BBECE432F8DA57F17BF2E396EBAA58
SHA256:7CF0944901F7F7E0D0B9AD62753FC2FE380461B1CCE8CDC7E9C9867C980E3B0E
1920CryptoRipper v1.0.exeC:\Users\admin\AppData\Local\Temp\_MEI19202\VCRUNTIME140.dllexecutable
MD5:0E675D4A7A5B7CCD69013386793F68EB
SHA256:BF5FF4603557C9959ACEC995653D052D9054AD4826DF967974EFD2F377C723D1
1920CryptoRipper v1.0.exeC:\Users\admin\AppData\Local\Temp\_MEI19202\api-ms-win-core-errorhandling-l1-1-0.dllexecutable
MD5:EB0978A9213E7F6FDD63B2967F02D999
SHA256:AB25A1FE836FC68BCB199F1FE565C27D26AF0C390A38DA158E0D8815EFE1103E
1920CryptoRipper v1.0.exeC:\Users\admin\AppData\Local\Temp\_MEI19202\api-ms-win-core-file-l2-1-0.dllexecutable
MD5:BFFFA7117FD9B1622C66D949BAC3F1D7
SHA256:1EA267A2E6284F17DD548C6F2285E19F7EDB15D6E737A55391140CE5CB95225E
1920CryptoRipper v1.0.exeC:\Users\admin\AppData\Local\Temp\_MEI19202\_ctypes.pydexecutable
MD5:F1E33A8F6F91C2ED93DC5049DD50D7B8
SHA256:9459D246DF7A3C638776305CF3683946BA8DB26A7DE90DF8B60E1BE0B27E53C4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
33
DNS requests
16
Threats
28

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1640
CryptoRipper v1.0.exe
GET
200
176.111.174.140:80
http://176.111.174.140/nuke.exe
unknown
—
—
unknown
5400
svchost.exe
GET
200
176.111.174.140:80
http://176.111.174.140/vvTBswN.php
unknown
—
—
unknown
5400
svchost.exe
GET
200
176.111.174.140:80
http://176.111.174.140/api/update.pack
unknown
—
—
unknown
5400
svchost.exe
GET
200
176.111.174.140:80
http://176.111.174.140/api/update2.pack
unknown
—
—
unknown
4552
explorer.exe
POST
200
176.111.174.140:80
http://176.111.174.140/api.php?{2F33566DA0B91573532102}
unknown
—
—
unknown
4552
explorer.exe
POST
200
176.111.174.140:80
http://176.111.174.140/api.php?{2F33566DA0B91573532102}
unknown
—
—
unknown
4552
explorer.exe
POST
200
176.111.174.140:80
http://176.111.174.140/api.php?{2F33566DA0B91573532102}
unknown
—
—
unknown
3272
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3272
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
3652
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
7008
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2120
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6020
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
7008
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1640
CryptoRipper v1.0.exe
176.111.174.140:80
—
Chang Way Technologies Co. Limited
RU
malicious
5400
svchost.exe
176.111.174.140:80
—
Chang Way Technologies Co. Limited
RU
malicious
4552
explorer.exe
176.111.174.140:80
—
Chang Way Technologies Co. Limited
RU
malicious
3260
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
  • 20.73.194.208
  • 4.231.128.59
whitelisted
google.com
  • 142.250.184.238
whitelisted
client.wns.windows.com
  • 40.113.103.199
  • 40.115.3.253
whitelisted
login.live.com
  • 20.190.160.20
  • 40.126.32.72
  • 20.190.160.14
  • 40.126.32.140
  • 40.126.32.76
  • 40.126.32.136
  • 40.126.32.133
  • 20.190.160.22
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
slscr.update.microsoft.com
  • 13.85.23.86
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

PID
Process
Class
Message
1640
CryptoRipper v1.0.exe
Attempted Information Leak
ET POLICY Python-urllib/ Suspicious User Agent
1640
CryptoRipper v1.0.exe
Misc activity
ET INFO Packed Executable Download
1640
CryptoRipper v1.0.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
1640
CryptoRipper v1.0.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1640
CryptoRipper v1.0.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 30
1640
CryptoRipper v1.0.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
5400
svchost.exe
A suspicious filename was detected
ET HUNTING Terse Named Filename EXE Download - Possibly Hostile
5400
svchost.exe
Misc activity
ET INFO EXE - Served Inline HTTP
5400
svchost.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
5400
svchost.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
CryptoRipper v1.0.zip