File name:

crss.exe

Full analysis: https://app.any.run/tasks/61ce8bf0-beff-4967-8b37-375a5e20abe5
Verdict: Malicious activity
Analysis date: November 10, 2024, 12:00:26
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
github
evasion
pyinstaller
python
rust
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 6 sections
MD5:

AF7C523ACFDFC98B945B8092170A5FD3

SHA1:

CC8131CDBAECEAA28A757F8289077D3214938176

SHA256:

CD4EBC4942FAF22D6B41D8D0D41AAD0570807E7DC484F35010A903CAA5A1ADB7

SSDEEP:

98304:N6Cya+2u8M+J4tqaOFHhwIsRjKOVWjtKxgA5evnaY8g2XpNpZM/xiLEDKIbjQrf+:77rbyLh6YCU3pIwWBsb0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • crss.exe (PID: 3644)

  • SUSPICIOUS

    • The process drops C-runtime libraries

      • crss.exe (PID: 6044)

    • Process drops legitimate windows executable

      • crss.exe (PID: 6044)

    • Process drops python dynamic module

      • crss.exe (PID: 6044)

    • Executable content was dropped or overwritten

      • crss.exe (PID: 6044)

    • Application launched itself

      • crss.exe (PID: 6044)

    • Starts CMD.EXE for commands execution

      • crss.exe (PID: 3644)

    • Loads Python modules

      • crss.exe (PID: 3644)

    • Checks for external IP

      • crss.exe (PID: 3644)

    • Potential Corporate Privacy Violation

      • crss.exe (PID: 3644)

    • Connects to the server without a host name

      • crss.exe (PID: 3644)

  • INFO

    • Reads the computer name

      • crss.exe (PID: 6044)
      • crss.exe (PID: 3644)

    • Checks supported languages

      • crss.exe (PID: 6044)
      • crss.exe (PID: 3644)

    • Reads the machine GUID from the registry

      • crss.exe (PID: 3644)

    • Checks operating system version

      • crss.exe (PID: 3644)

    • Creates files in the program directory

      • crss.exe (PID: 3644)

    • Checks proxy server information

      • crss.exe (PID: 3644)

    • PyInstaller has been detected (YARA)

      • crss.exe (PID: 6044)
      • crss.exe (PID: 3644)

    • Application based on Rust

      • crss.exe (PID: 3644)

    • Create files in a temporary directory

      • crss.exe (PID: 6044)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:10:30 16:30:49+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.4
CodeSize: 172032
InitializedDataSize: 93184
UninitializedDataSize: -
EntryPoint: 0xcdb0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
7
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start THREAT crss.exe THREAT crss.exe cmd.exe no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
204\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1204C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2784"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3644"C:\Users\admin\AppData\Local\Temp\crss.exe" C:\Users\admin\AppData\Local\Temp\crss.exe
crss.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\crss.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
6044"C:\Users\admin\AppData\Local\Temp\crss.exe" C:\Users\admin\AppData\Local\Temp\crss.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\crss.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
6680C:\WINDOWS\system32\cmd.exe /c "ver"C:\Windows\System32\cmd.exe—crss.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
6784C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
Total events
1 010
Read events
1 009
Write events
1
Delete events
0

Modification events

(PID) Process:(3644) crss.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:козляк
Value:
C:\Users\admin\AppData\Local\Temp\crss.exe
Executable files
33
Suspicious files
1
Text files
124
Unknown types
0

Dropped files

PID
Process
Filename
Type
6044crss.exeC:\Users\admin\AppData\Local\Temp\_MEI60442\VCRUNTIME140.dllexecutable
MD5:F34EB034AA4A9735218686590CBA2E8B
SHA256:9D2B40F0395CC5D1B4D5EA17B84970C29971D448C37104676DB577586D4AD1B1
6044crss.exeC:\Users\admin\AppData\Local\Temp\_MEI60442\_asyncio.pydexecutable
MD5:33D0B6DE555DDBBBD5CA229BFA91C329
SHA256:A9A99A2B847E46C0EFCE7FCFEFD27F4BCE58BAF9207277C17BFFD09EF4D274E5
6044crss.exeC:\Users\admin\AppData\Local\Temp\_MEI60442\_overlapped.pydexecutable
MD5:FDF8663B99959031780583CCE98E10F5
SHA256:2EBBB0583259528A5178DD37439A64AFFCB1AB28CF323C6DC36A8C30362AA992
6044crss.exeC:\Users\admin\AppData\Local\Temp\_MEI60442\_pytransform.dllexecutable
MD5:23376A4DF02C2BB0B770930449355ACB
SHA256:E999F10F53A09DDD5C6E05AD8BD3635C43D1035EB70AFD32463875A1AEF030CD
6044crss.exeC:\Users\admin\AppData\Local\Temp\_MEI60442\_queue.pydexecutable
MD5:D8C1B81BBC125B6AD1F48A172181336E
SHA256:925F05255F4AAE0997DC4EC94D900FD15950FD840685D5B8AA755427C7422B14
6044crss.exeC:\Users\admin\AppData\Local\Temp\_MEI60442\_lzma.pydexecutable
MD5:7447EFD8D71E8A1929BE0FAC722B42DC
SHA256:60793C8592193CFBD00FD3E5263BE4315D650BA4F9E4FDA9C45A10642FD998BE
6044crss.exeC:\Users\admin\AppData\Local\Temp\_MEI60442\_bz2.pydexecutable
MD5:86D1B2A9070CD7D52124126A357FF067
SHA256:62173A8FADD4BF4DD71AB89EA718754AA31620244372F0C5BBBAE102E641A60E
6044crss.exeC:\Users\admin\AppData\Local\Temp\_MEI60442\_multiprocessing.pydexecutable
MD5:A9A0588711147E01EED59BE23C7944A9
SHA256:7581EDEA33C1DB0A49B8361E51E6291688601640E57D75909FB2007B2104FA4C
6044crss.exeC:\Users\admin\AppData\Local\Temp\_MEI60442\_hashlib.pydexecutable
MD5:D4674750C732F0DB4C4DD6A83A9124FE
SHA256:CAA4D2F8795E9A55E128409CC016E2CC5C694CB026D7058FC561E4DD131ED1C9
6044crss.exeC:\Users\admin\AppData\Local\Temp\_MEI60442\_decimal.pydexecutable
MD5:20C77203DDF9FF2FF96D6D11DEA2EDCF
SHA256:9AAC010A424C757C434C460C3C0A6515D7720966AB64BAD667539282A17B4133
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
21
TCP/UDP connections
1 290
DNS requests
27
Threats
19

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
3644
crss.exe
GET
302
142.250.184.228:80
http://www.google.com/
unknown
—
—
whitelisted
3644
crss.exe
GET
429
142.250.184.228:80
http://www.google.com/sorry/index?continue=http://www.google.com/&q=EgQtWGGeGOTAwrkGIjBXxx9CrYevM507SyAIEsxlLit6oSkay1GxLD7dZL-RdjWX2XHnu46VuA1g8JfOjO4yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM
unknown
—
—
whitelisted
3644
crss.exe
GET
—
140.207.58.93:80
http://140.207.58.93/
unknown
—
—
unknown
624
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6252
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6252
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2980
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6944
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1588
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5488
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4360
SearchApp.exe
104.126.37.186:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3644
crss.exe
142.250.184.228:80
www.google.com
GOOGLE
US
whitelisted
3644
crss.exe
185.199.110.133:443
raw.githubusercontent.com
FASTLY
US
shared
3644
crss.exe
140.82.121.5:443
api.github.com
GITHUB
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
  • 40.127.240.158
whitelisted
www.bing.com
  • 104.126.37.186
  • 104.126.37.153
  • 104.126.37.162
  • 104.126.37.163
  • 104.126.37.160
  • 104.126.37.128
  • 104.126.37.155
  • 104.126.37.161
  • 104.126.37.123
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
google.com
  • 142.250.181.238
whitelisted
www.google.com
  • 142.250.184.228
whitelisted
raw.githubusercontent.com
  • 185.199.110.133
  • 185.199.109.133
  • 185.199.111.133
  • 185.199.108.133
shared
api.github.com
  • 140.82.121.5
whitelisted
api.ipify.org
  • 172.67.74.152
  • 104.26.13.205
  • 104.26.12.205
shared
login.live.com
  • 20.190.159.68
  • 20.190.159.0
  • 40.126.31.67
  • 20.190.159.64
  • 40.126.31.69
  • 40.126.31.71
  • 20.190.159.4
  • 20.190.159.75
whitelisted
th.bing.com
  • 104.126.37.128
  • 104.126.37.123
  • 104.126.37.186
  • 104.126.37.162
  • 104.126.37.185
  • 104.126.37.170
  • 104.126.37.177
  • 104.126.37.171
  • 104.126.37.163
whitelisted

Threats

PID
Process
Class
Message
2172
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
2172
svchost.exe
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
3644
crss.exe
Misc activity
ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
16 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
crss.exe