analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://topwarenhub.top/summerjam.exe

Full analysis: https://app.any.run/tasks/40fb003c-0b23-43e1-9df9-ab5d09962fe6
Verdict: Malicious activity
Threats:

GandCrab is probably one of the most famous Ransomware. A Ransomware is a malware that asks the victim to pay money in order to restore access to encrypted files. If the user does not cooperate the files are forever lost.

Malware Trends Tracker     >>>
Analysis date: December 18, 2018, 12:27:25
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
gandcrab
trojan
loader
Indicators:
MD5:

66D0CFEC63A4D5945B07F18418E9BBF2

SHA1:

8F8B973434EDE7EC9E29E749D68493D472E00E8D

SHA256:

0858AC7D2125446C2905A8238352E7D25C0D3B001DDCE6A2799C24DF661AF529

SSDEEP:

3:N1KKKJQ5SlONd9XPCC:CKF5SlMzX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • summerjam[1].exe (PID: 2532)

    • Writes file to Word startup folder

      • summerjam[1].exe (PID: 2532)

    • GandCrab keys found

      • summerjam[1].exe (PID: 2532)

    • Actions looks like stealing of personal data

      • summerjam[1].exe (PID: 2532)

    • Dropped file may contain instructions of ransomware

      • summerjam[1].exe (PID: 2532)

    • Renames files like Ransomware

      • summerjam[1].exe (PID: 2532)

    • Downloads executable files from the Internet

      • iexplore.exe (PID: 3100)

    • Connects to CnC server

      • summerjam[1].exe (PID: 2532)

    • Deletes shadow copies

      • summerjam[1].exe (PID: 2532)

    • Changes settings of System certificates

      • summerjam[1].exe (PID: 2532)

  • SUSPICIOUS

    • Creates files in the program directory

      • summerjam[1].exe (PID: 2532)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 3100)
      • iexplore.exe (PID: 2956)

    • Creates files like Ransomware instruction

      • summerjam[1].exe (PID: 2532)

    • Reads the cookies of Mozilla Firefox

      • summerjam[1].exe (PID: 2532)

    • Adds / modifies Windows certificates

      • summerjam[1].exe (PID: 2532)

    • Creates files in the user directory

      • summerjam[1].exe (PID: 2532)

  • INFO

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2956)
      • iexplore.exe (PID: 3100)

    • Changes internet zones settings

      • iexplore.exe (PID: 2956)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 3100)
      • iexplore.exe (PID: 2956)

    • Dropped object may contain TOR URL's

      • summerjam[1].exe (PID: 2532)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start iexplore.exe iexplore.exe #GANDCRAB summerjam[1].exe wmic.exe no specs explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2956"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3100"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2956 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2532"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0UU90R59\summerjam[1].exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0UU90R59\summerjam[1].exe
iexplore.exe
User:
admin
Integrity Level:
MEDIUM
3004"C:\Windows\system32\wbem\wmic.exe" shadowcopy deleteC:\Windows\system32\wbem\wmic.exe—summerjam[1].exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
2147749908
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3628"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
796
Read events
698
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
286
Text files
215
Unknown types
6

Dropped files

PID
Process
Filename
Type
2956iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\favicon[1].ico —
MD5:—
SHA256:—
2956iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
2956iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF37E930B3BDD8E85F.TMP —
MD5:—
SHA256:—
2532summerjam[1].exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamp —
MD5:—
SHA256:—
3100iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\summerjam[1].exeexecutable
MD5:EDC88B1ACB2039EC8DB260B93D8ABEA0
SHA256:0DCCAFAA1C0F8188D6C87CA950EA17CF25A2B3FEDC48A964A4EF70D12A471B6D
2532summerjam[1].exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\WGVSDI-DECRYPT.txttext
MD5:383BEE3E28B6600BD51B6CC15E6A4599
SHA256:8FD998F2B7EF74129AF1E6CB9151BAA9D0EF4ADF85BD6BD070036D69BA1CC9B9
2532summerjam[1].exeC:\Users\admin\.oracle_jre_usage\WGVSDI-DECRYPT.txttext
MD5:383BEE3E28B6600BD51B6CC15E6A4599
SHA256:8FD998F2B7EF74129AF1E6CB9151BAA9D0EF4ADF85BD6BD070036D69BA1CC9B9
2532summerjam[1].exeC:\Users\admin\AppData\WGVSDI-DECRYPT.txttext
MD5:383BEE3E28B6600BD51B6CC15E6A4599
SHA256:8FD998F2B7EF74129AF1E6CB9151BAA9D0EF4ADF85BD6BD070036D69BA1CC9B9
3100iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012018121820181219\index.datdat
MD5:60E2E2272C2C95970FA73E9929E0C39B
SHA256:6E98795A8E54A369E170354F784CF5256B12EA304B3701FFC6D9CC5457CAF243
2532summerjam[1].exeC:\Users\admin\AppData\Roaming\WGVSDI-DECRYPT.txttext
MD5:383BEE3E28B6600BD51B6CC15E6A4599
SHA256:8FD998F2B7EF74129AF1E6CB9151BAA9D0EF4ADF85BD6BD070036D69BA1CC9B9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
30
TCP/UDP connections
44
DNS requests
23
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2532
summerjam[1].exe
GET
—
136.243.13.215:80
http://www.holzbock.biz/
DE
—
—
suspicious
2532
summerjam[1].exe
GET
—
78.46.77.98:80
http://www.2mmotorsport.biz/
DE
—
—
suspicious
2532
summerjam[1].exe
POST
—
136.243.13.215:80
http://www.holzbock.biz/includes/pics/kadafuka.bmp
DE
—
—
suspicious
2532
summerjam[1].exe
POST
404
217.26.53.161:80
http://www.haargenau.biz/wp-content/assets/moamzuzu.gif
CH
html
11.1 Kb
malicious
2532
summerjam[1].exe
POST
—
78.46.77.98:80
http://www.2mmotorsport.biz/content/images/fuseru.png
DE
—
—
suspicious
2532
summerjam[1].exe
GET
301
83.138.82.107:80
http://www.swisswellness.com/
DE
—
—
whitelisted
2532
summerjam[1].exe
GET
302
192.185.159.253:80
http://www.pizcam.com/
US
—
—
malicious
2532
summerjam[1].exe
GET
—
217.26.53.37:80
http://www.hrk-ramoz.com/
CH
—
—
malicious
3100
iexplore.exe
GET
200
203.91.116.53:80
http://topwarenhub.top/summerjam.exe
MN
executable
239 Kb
malicious
2532
summerjam[1].exe
GET
—
212.59.186.61:80
http://www.hotelweisshorn.com/
CH
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2956
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2532
summerjam[1].exe
78.46.77.98:80
www.2mmotorsport.biz
Hetzner Online GmbH
DE
suspicious
2532
summerjam[1].exe
138.201.162.99:80
www.fliptray.biz
Hetzner Online GmbH
DE
malicious
2532
summerjam[1].exe
192.185.159.253:80
www.pizcam.com
CyrusOne LLC
US
malicious
2532
summerjam[1].exe
74.220.215.73:80
www.bizziniinfissi.com
Unified Layer
US
malicious
2532
summerjam[1].exe
136.243.13.215:80
www.holzbock.biz
Hetzner Online GmbH
DE
suspicious
2532
summerjam[1].exe
192.185.159.253:443
www.pizcam.com
CyrusOne LLC
US
malicious
2532
summerjam[1].exe
217.26.53.161:80
www.haargenau.biz
Hostpoint AG
CH
malicious
2532
summerjam[1].exe
83.138.82.107:80
www.swisswellness.com
hostNET Medien GmbH
DE
suspicious
3100
iexplore.exe
203.91.116.53:80
topwarenhub.top
G-Mobile Corporation
MN
malicious

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
topwarenhub.top
  • 203.91.116.53
  • 89.17.225.163
  • 85.187.48.16
  • 194.204.25.137
  • 46.238.18.157
  • 95.140.195.178
  • 188.254.142.85
  • 95.158.162.200
  • 213.6.58.250
  • 89.47.94.113
malicious
www.2mmotorsport.biz
  • 78.46.77.98
unknown
www.haargenau.biz
  • 217.26.53.161
unknown
www.bizziniinfissi.com
  • 74.220.215.73
malicious
www.holzbock.biz
  • 136.243.13.215
unknown
www.fliptray.biz
  • 138.201.162.99
malicious
www.pizcam.com
  • 192.185.159.253
unknown
www.swisswellness.com
  • 83.138.82.107
whitelisted
www.hotelweisshorn.com
  • 212.59.186.61
unknown

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
3100
iexplore.exe
A Network Trojan was detected
ET CURRENT_EVENTS SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016
3100
iexplore.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
3100
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3100
iexplore.exe
Misc activity
ET INFO Possible EXE Download From Suspicious TLD
2532
summerjam[1].exe
A Network Trojan was detected
ET TROJAN [eSentire] Win32/GandCrab v4/5 Ransomware CnC Activity
2532
summerjam[1].exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/GandCrab Ransomware CnC Activity
2532
summerjam[1].exe
A Network Trojan was detected
ET POLICY Data POST to an image file (gif)
2532
summerjam[1].exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/GandCrab Ransomware CnC Activity
2532
summerjam[1].exe
A Network Trojan was detected
ET POLICY Data POST to an image file (gif)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://topwarenhub.top/summerjam.exe