| File name: | OwnZ Crypter 3.5.9.rar |
| Full analysis: | https://app.any.run/tasks/828e8ed0-3437-4ac3-aa11-41cac5dcf572 |
| Verdict: | Malicious activity |
| Threats: | Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying. |
| Analysis date: | September 09, 2018, 11:59:26 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-rar |
| File info: | RAR archive data, v4, os: Win32 |
| MD5: | D869572C1A506B1D48EC277EF7F76BEB |
| SHA1: | 552DE3637A354431AE22B3974EF581EA61784B8F |
| SHA256: | 2C1ADBECC649DB5527E8B602CAF6DDD6AF6DE8F801AEFDE95849DEC9CDFE10C7 |
| SSDEEP: | 98304:L2DUDKNzpYdSjP+zrJZWJgHiotb+lh9kYEs14Mavr0XrrVNeS7Chlh77Y+xTqTZZ:L2DUGidSDu3WMta9p2PIXrJ7mLyT |
MALICIOUS
Loads dropped or rewritten executable
- SearchProtocolHost.exe (PID: 980)
- Eazfuscator.NET.exe (PID: 992)
- PEiD.exe (PID: 2012)
- PEiD.exe (PID: 3792)
Application was dropped or rewritten from another process
- OwnZ Crypter Cracked.exe (PID: 1032)
- Eazfuscator.NET.exe (PID: 992)
- 1234.exe (PID: 2448)
- PEiD.exe (PID: 2012)
- PEiD.exe (PID: 3792)
SUSPICIOUS
Creates files like Ransomware instruction
- WinRAR.exe (PID: 2664)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 2420)
- WinRAR.exe (PID: 2320)
- OwnZ Crypter Cracked.exe (PID: 1032)
- vbc.exe (PID: 3856)
- PEiD.exe (PID: 2012)
- PEiD.exe (PID: 3792)
Starts CMD.EXE for commands execution
- OwnZ Crypter Cracked.exe (PID: 1032)
Executes scripts
- OwnZ Crypter Cracked.exe (PID: 1032)
Starts Internet Explorer
- 1234.exe (PID: 2448)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .rar | | | RAR compressed archive (v-4.x) (58.3) |
|---|---|---|
| .rar | | | RAR compressed archive (gen) (41.6) |
EXIF
ZIP
| CompressedSize: | 80 |
|---|---|
| UncompressedSize: | - |
| OperatingSystem: | Win32 |
| ModifyDate: | 2011:02:21 07:13:11 |
| PackingMethod: | Stored |
| ArchivedFileName: | OwnZ Crypter 3.5.9\3.5.9\Infos\borlo = Normal Stub.txt |
Total processes
62
Monitored processes
17
Malicious processes
6
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 980 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe12_ Global\UsGthrCtrlFltPipeMssGthrPipe12 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" | C:\Windows\System32\SearchProtocolHost.exe | — | SearchIndexer.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Windows Search Protocol Host Exit code: 0 Version: 7.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 992 | EazFuscator\Eazfuscator.NET.exe 1234.exe | C:\Users\admin\Desktop\OwnZ Crypter 3.5.9\3.5.9\EazFuscator\Eazfuscator.NET.exe | cmd.exe | ||||||||||||
User: admin Company: Oleksiy Gapotchenko Integrity Level: MEDIUM Description: Eazfuscator.NET Exit code: 1 Version: 3.1.85.3273 Modules
| |||||||||||||||
| 1032 | "C:\Users\admin\Desktop\OwnZ Crypter 3.5.9\3.5.9\OwnZ Crypter Cracked.exe" | C:\Users\admin\Desktop\OwnZ Crypter 3.5.9\3.5.9\OwnZ Crypter Cracked.exe | explorer.exe | ||||||||||||
User: admin Company: LSD Integrity Level: MEDIUM Description: OwnZ Exit code: 0 Version: 3.5.9.0 Modules
| |||||||||||||||
| 1592 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\PEiD.v0.95[www.cracklab.ru].rar" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 Modules
| |||||||||||||||
| 1680 | "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\u05rats-.cmdline" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe | — | 1234.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual C# Command Line Compiler Exit code: 0 Version: 8.0.50727.4927 (NetFXspW7.050727-4900) Modules
| |||||||||||||||
| 2012 | "C:\Users\admin\Desktop\PEiD.v0.95[www.cracklab.ru]\PEiD.exe" | C:\Users\admin\Desktop\PEiD.v0.95[www.cracklab.ru]\PEiD.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 1 Modules
| |||||||||||||||
| 2140 | cmd /c ""C:\Users\admin\Desktop\OwnZ Crypter 3.5.9\3.5.9\Obfuscate.bat" " | C:\Windows\system32\cmd.exe | — | OwnZ Crypter Cracked.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2320 | "C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\PEiD.v0.95[www.cracklab.ru].rar" "?\" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 Modules
| |||||||||||||||
| 2420 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\OwnZ Crypter 3.5.9.rar" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 Modules
| |||||||||||||||
| 2448 | "C:\Users\admin\Desktop\OwnZ Crypter 3.5.9\3.5.9\1234.exe" | C:\Users\admin\Desktop\OwnZ Crypter 3.5.9\3.5.9\1234.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
Total events
2 485
Read events
2 283
Write events
195
Delete events
7
Modification events
| (PID) Process: | (2420) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (2420) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (2420) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\59\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2420) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\OwnZ Crypter 3.5.9.rar | |||
| (PID) Process: | (2420) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (2420) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (2420) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (2420) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (2420) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin |
| Operation: | write | Name: | Placement |
Value: 2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF2C0000002C000000EC03000021020000 | |||
| (PID) Process: | (2420) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\General |
| Operation: | write | Name: | LastFolder |
Value: C:\Users\admin\Desktop | |||
Executable files
75
Suspicious files
4
Text files
18
Unknown types
3
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2664 | WinRAR.exe | C:\Users\admin\Desktop\external.txt | — | |
MD5:— | SHA256:— | |||
| 2664 | WinRAR.exe | C:\Users\admin\Desktop\IDToText.Ini | — | |
MD5:— | SHA256:— | |||
| 2664 | WinRAR.exe | C:\Users\admin\Desktop\mfc70.dll | — | |
MD5:— | SHA256:— | |||
| 2664 | WinRAR.exe | C:\Users\admin\Desktop\PEiD.exe | — | |
MD5:— | SHA256:— | |||
| 2664 | WinRAR.exe | C:\Users\admin\Desktop\PEIDSO.exe | — | |
MD5:— | SHA256:— | |||
| 2664 | WinRAR.exe | C:\Users\admin\Desktop\PlgLdr.exe | — | |
MD5:— | SHA256:— | |||
| 2664 | WinRAR.exe | C:\Users\admin\Desktop\PLUGINS\AddSig.dll | — | |
MD5:— | SHA256:— | |||
| 2664 | WinRAR.exe | C:\Users\admin\Desktop\PLUGINS\advanced_scan.dll | — | |
MD5:— | SHA256:— | |||
| 2664 | WinRAR.exe | C:\Users\admin\Desktop\PLUGINS\AMver.dll | — | |
MD5:— | SHA256:— | |||
| 2664 | WinRAR.exe | C:\Users\admin\Desktop\PLUGINS\CRC32.DLL | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
1
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
DNS requests
Domain | IP | Reputation |
|---|---|---|
ownz-crypter.com |
| unknown |
Threats
Process | Message |
|---|---|
Eazfuscator.NET.exe | |
Eazfuscator.NET.exe | Eazfuscator.NET.exe Information: 0 : |
Eazfuscator.NET.exe | Software updates check thread entry.
|
Eazfuscator.NET.exe | |
Eazfuscator.NET.exe | Eazfuscator.NET.exe Information: 0 : |
Eazfuscator.NET.exe | Reming timeout = 7.00:00:00
|
Eazfuscator.NET.exe | |
Eazfuscator.NET.exe | Eazfuscator.NET.exe Information: 0 : |
Eazfuscator.NET.exe | Last update check time = 09/09/2018 12:01:42 (UTC)
|
Eazfuscator.NET.exe | |