File name:

cr-keygen.exe

Full analysis: https://app.any.run/tasks/47302633-5d60-4ffc-b0e7-253fe08e5156
Verdict: Malicious activity
Analysis date: February 04, 2024, 11:19:26
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: MS-DOS executable PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

4B7ABC332F365A639E3B976CA9E6118C

SHA1:

CF7A994358C19C6366E78DA0B16D437425582344

SHA256:

9CD29E9D1A3C1033107833A1700B3D9C41DEFF0DE26B65A9855741770A6F6055

SSDEEP:

12288:TkHVzuRA1g2tqscVL2hVZEXPXSu68aWi18nu40f:A1yW1g2tqN2hVZEXPXSu68Di1T4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • cr-keygen.exe (PID: 1264)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • cr-keygen.exe (PID: 1264)

  • INFO

    • Checks supported languages

      • cr-keygen.exe (PID: 1264)

    • Reads the computer name

      • cr-keygen.exe (PID: 1264)

    • Create files in a temporary directory

      • cr-keygen.exe (PID: 1264)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:20 00:22:17+02:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 401920
InitializedDataSize: 343552
UninitializedDataSize: -
EntryPoint: 0x4aad9
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start cr-keygen.exe

Process information

PID
CMD
Path
Indicators
Parent process
1264"C:\Users\admin\AppData\Local\Temp\cr-keygen.exe" C:\Users\admin\AppData\Local\Temp\cr-keygen.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\cr-keygen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
Total events
122
Read events
122
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
0
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
1264cr-keygen.exeC:\Users\admin\AppData\Local\Temp\Test.dattext
MD5:0CBC6611F5540BD0809A388DC95A615B
SHA256:532EAABD9574880DBF76B9B8CC00832C20A6EC113D682299550D7A6E0F345E25
1264cr-keygen.exeC:\Users\admin\AppData\Local\Temp\ReZbBEdUEJIOymffDzAl.DLLexecutable
MD5:76A9565C5F51775719EEBDA1F25530A5
SHA256:A1A7C4F74D4FE7784ED03709E5F946B94CC10A64E3AE0AD5A9A3BECE9A8A2C0A
1264cr-keygen.exeC:\Users\admin\AppData\Local\Temp\frWUXZdZliJqKAFmiWze.DLLexecutable
MD5:E6144FB36C1FDC6BA1D1AFA9632588F8
SHA256:B141412D0611571DF381C26186B3FC438C725D6E45AD66FD76413322C17A9AC6
1264cr-keygen.exeC:\Users\admin\AppData\Local\Temp\jOevuUspnD.DLLexecutable
MD5:E4EC57E8508C5C4040383EBE6D367928
SHA256:8AD9E47693E292F381DA42DDC13724A3063040E51C26F4CA8E1F8E2F1DDD547F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
cr-keygen.exe