File name:

crss.exe

Full analysis: https://app.any.run/tasks/61ce8bf0-beff-4967-8b37-375a5e20abe5
Verdict: Malicious activity
Analysis date: November 10, 2024, 12:00:26
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
github
evasion
pyinstaller
python
rust
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 6 sections
MD5:

AF7C523ACFDFC98B945B8092170A5FD3

SHA1:

CC8131CDBAECEAA28A757F8289077D3214938176

SHA256:

CD4EBC4942FAF22D6B41D8D0D41AAD0570807E7DC484F35010A903CAA5A1ADB7

SSDEEP:

98304:N6Cya+2u8M+J4tqaOFHhwIsRjKOVWjtKxgA5evnaY8g2XpNpZM/xiLEDKIbjQrf+:77rbyLh6YCU3pIwWBsb0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • crss.exe (PID: 3644)

  • SUSPICIOUS

    • Process drops python dynamic module

      • crss.exe (PID: 6044)

    • Process drops legitimate windows executable

      • crss.exe (PID: 6044)

    • Executable content was dropped or overwritten

      • crss.exe (PID: 6044)

    • Application launched itself

      • crss.exe (PID: 6044)

    • The process drops C-runtime libraries

      • crss.exe (PID: 6044)

    • Starts CMD.EXE for commands execution

      • crss.exe (PID: 3644)

    • Loads Python modules

      • crss.exe (PID: 3644)

    • Potential Corporate Privacy Violation

      • crss.exe (PID: 3644)

    • Checks for external IP

      • crss.exe (PID: 3644)

    • Connects to the server without a host name

      • crss.exe (PID: 3644)

  • INFO

    • Reads the computer name

      • crss.exe (PID: 6044)
      • crss.exe (PID: 3644)

    • Checks supported languages

      • crss.exe (PID: 6044)
      • crss.exe (PID: 3644)

    • Reads the machine GUID from the registry

      • crss.exe (PID: 3644)

    • Checks operating system version

      • crss.exe (PID: 3644)

    • Creates files in the program directory

      • crss.exe (PID: 3644)

    • Checks proxy server information

      • crss.exe (PID: 3644)

    • PyInstaller has been detected (YARA)

      • crss.exe (PID: 6044)
      • crss.exe (PID: 3644)

    • Application based on Rust

      • crss.exe (PID: 3644)

    • Create files in a temporary directory

      • crss.exe (PID: 6044)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:10:30 16:30:49+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.4
CodeSize: 172032
InitializedDataSize: 93184
UninitializedDataSize: -
EntryPoint: 0xcdb0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
7
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start THREAT crss.exe THREAT crss.exe cmd.exe no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
204\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1204C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2784"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3644"C:\Users\admin\AppData\Local\Temp\crss.exe" C:\Users\admin\AppData\Local\Temp\crss.exe
crss.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\crss.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
6044"C:\Users\admin\AppData\Local\Temp\crss.exe" C:\Users\admin\AppData\Local\Temp\crss.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\crss.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
6680C:\WINDOWS\system32\cmd.exe /c "ver"C:\Windows\System32\cmd.exe—crss.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
6784C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
Total events
1 010
Read events
1 009
Write events
1
Delete events
0

Modification events

(PID) Process:(3644) crss.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:козляк
Value:
C:\Users\admin\AppData\Local\Temp\crss.exe
Executable files
33
Suspicious files
1
Text files
124
Unknown types
0

Dropped files

PID
Process
Filename
Type
6044crss.exeC:\Users\admin\AppData\Local\Temp\_MEI60442\_brotli.cp310-win_amd64.pydexecutable
MD5:EE3D454883556A68920CAAEDEFBC1F83
SHA256:791E7195D7DF47A21466868F3D7386CFF13F16C51FCD0350BF4028E96278DFF1
6044crss.exeC:\Users\admin\AppData\Local\Temp\_MEI60442\_cffi_backend.cp310-win_amd64.pydexecutable
MD5:2BAAA98B744915339AE6C016B17C3763
SHA256:4F1CE205C2BE986C9D38B951B6BCB6045EB363E06DACC069A41941F80BE9068C
6044crss.exeC:\Users\admin\AppData\Local\Temp\_MEI60442\VCRUNTIME140_1.dllexecutable
MD5:135359D350F72AD4BF716B764D39E749
SHA256:34048ABAA070ECC13B318CEA31425F4CA3EDD133D350318AC65259E6058C8B32
6044crss.exeC:\Users\admin\AppData\Local\Temp\_MEI60442\VCRUNTIME140.dllexecutable
MD5:F34EB034AA4A9735218686590CBA2E8B
SHA256:9D2B40F0395CC5D1B4D5EA17B84970C29971D448C37104676DB577586D4AD1B1
6044crss.exeC:\Users\admin\AppData\Local\Temp\_MEI60442\_asyncio.pydexecutable
MD5:33D0B6DE555DDBBBD5CA229BFA91C329
SHA256:A9A99A2B847E46C0EFCE7FCFEFD27F4BCE58BAF9207277C17BFFD09EF4D274E5
6044crss.exeC:\Users\admin\AppData\Local\Temp\_MEI60442\_socket.pydexecutable
MD5:819166054FEC07EFCD1062F13C2147EE
SHA256:E6DEB751039CD5424A139708475CE83F9C042D43E650765A716CB4A924B07E4F
6044crss.exeC:\Users\admin\AppData\Local\Temp\_MEI60442\_queue.pydexecutable
MD5:D8C1B81BBC125B6AD1F48A172181336E
SHA256:925F05255F4AAE0997DC4EC94D900FD15950FD840685D5B8AA755427C7422B14
6044crss.exeC:\Users\admin\AppData\Local\Temp\_MEI60442\_pytransform.dllexecutable
MD5:23376A4DF02C2BB0B770930449355ACB
SHA256:E999F10F53A09DDD5C6E05AD8BD3635C43D1035EB70AFD32463875A1AEF030CD
6044crss.exeC:\Users\admin\AppData\Local\Temp\_MEI60442\certifi\cacert.pemtext
MD5:50EA156B773E8803F6C1FE712F746CBA
SHA256:94EDEB66E91774FCAE93A05650914E29096259A5C7E871A1F65D461AB5201B47
6044crss.exeC:\Users\admin\AppData\Local\Temp\_MEI60442\_multiprocessing.pydexecutable
MD5:A9A0588711147E01EED59BE23C7944A9
SHA256:7581EDEA33C1DB0A49B8361E51E6291688601640E57D75909FB2007B2104FA4C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
21
TCP/UDP connections
1 290
DNS requests
27
Threats
19

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
3644
crss.exe
GET
302
142.250.184.228:80
http://www.google.com/
unknown
—
—
whitelisted
3644
crss.exe
GET
429
142.250.184.228:80
http://www.google.com/sorry/index?continue=http://www.google.com/&q=EgQtWGGeGOTAwrkGIjBXxx9CrYevM507SyAIEsxlLit6oSkay1GxLD7dZL-RdjWX2XHnu46VuA1g8JfOjO4yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM
unknown
—
—
whitelisted
3644
crss.exe
GET
—
140.207.58.93:80
http://140.207.58.93/
unknown
—
—
unknown
6944
svchost.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
624
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6252
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6252
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2980
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6944
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1588
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5488
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4360
SearchApp.exe
104.126.37.186:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3644
crss.exe
142.250.184.228:80
www.google.com
GOOGLE
US
whitelisted
3644
crss.exe
185.199.110.133:443
raw.githubusercontent.com
FASTLY
US
shared
3644
crss.exe
140.82.121.5:443
api.github.com
GITHUB
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
  • 40.127.240.158
whitelisted
www.bing.com
  • 104.126.37.186
  • 104.126.37.153
  • 104.126.37.162
  • 104.126.37.163
  • 104.126.37.160
  • 104.126.37.128
  • 104.126.37.155
  • 104.126.37.161
  • 104.126.37.123
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
google.com
  • 142.250.181.238
whitelisted
www.google.com
  • 142.250.184.228
whitelisted
raw.githubusercontent.com
  • 185.199.110.133
  • 185.199.109.133
  • 185.199.111.133
  • 185.199.108.133
shared
api.github.com
  • 140.82.121.5
whitelisted
api.ipify.org
  • 172.67.74.152
  • 104.26.13.205
  • 104.26.12.205
shared
login.live.com
  • 20.190.159.68
  • 20.190.159.0
  • 40.126.31.67
  • 20.190.159.64
  • 40.126.31.69
  • 40.126.31.71
  • 20.190.159.4
  • 20.190.159.75
whitelisted
th.bing.com
  • 104.126.37.128
  • 104.126.37.123
  • 104.126.37.186
  • 104.126.37.162
  • 104.126.37.185
  • 104.126.37.170
  • 104.126.37.177
  • 104.126.37.171
  • 104.126.37.163
whitelisted

Threats

PID
Process
Class
Message
2172
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
2172
svchost.exe
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
3644
crss.exe
Misc activity
ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
16 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
crss.exe