File name: | 19113_원본 이미지 .zip |
Full analysis: | https://app.any.run/tasks/6ed799d4-e29e-4da5-9ccf-317497b3a608 |
Verdict: | Malicious activity |
Threats: | GandCrab is probably one of the most famous Ransomware. A Ransomware is a malware that asks the victim to pay money in order to restore access to encrypted files. If the user does not cooperate the files are forever lost. |
Analysis date: | April 15, 2019, 05:28:18 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 6414B6AD39EE0997DD2B9813846A2AF0 |
SHA1: | A7F630DAB5100B92E88B990302D4E6EACF2E7902 |
SHA256: | 2FCCDA57891FD38F947DF6E4959E9182259C5303725619B30104CD2FA2F06A13 |
SSDEEP: | 3072:iyoX/ktyDl8mJuEwYF6x6TpEdN74Ep4vlxjaDc9qr0qQWNR2XKHtqH4:CctU8mQ6FEXpSlxjaDcMr0qJiXqMH4 |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | 19113_???? ?̹??����???????????????????????????????????????????????????????????????????????????????????????????????????.exe |
---|---|
ZipUncompressedSize: | 290816 |
ZipCompressedSize: | 151830 |
ZipCRC: | 0x06652261 |
ZipModifyDate: | 2019:04:13 03:08:29 |
ZipCompression: | Deflated |
ZipBitFlag: | - |
ZipRequiredVersion: | 20 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2812 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\19113_원본 이미지 .zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
2312 | "C:\Users\admin\Desktop\19113_원본 이미지 .exe" | C:\Users\admin\Desktop\19113_원본 이미지 .exe | explorer.exe | |
User: admin Integrity Level: MEDIUM | ||||
3384 | "C:\Users\admin\Desktop\19113_원본 이미지 .exe" | C:\Users\admin\Desktop\19113_원본 이미지 .exe | — | explorer.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
4064 | "C:\Windows\System32\cmd.exe" /c timeout -c 5 & del "C:\Users\admin\Desktop\19113_원본 이미지 .exe" /f /q | C:\Windows\System32\cmd.exe | 19113_원본 이미지 .exe | |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2740 | timeout -c 5 | C:\Windows\system32\timeout.exe | — | cmd.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: timeout - pauses command processing Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3688 | "C:\Windows\system32\cmd.exe" /c vssadmin delete shadows /all /quiet | C:\Windows\system32\cmd.exe | 19113_원본 이미지 .exe | |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2708 | vssadmin delete shadows /all /quiet | C:\Windows\system32\vssadmin.exe | — | cmd.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Command Line Interface for Microsoft® Volume Shadow Copy Service Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3532 | C:\Windows\system32\vssvc.exe | C:\Windows\system32\vssvc.exe | — | services.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft® Volume Shadow Copy Service Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
(PID) Process: | (2812) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (2812) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (2812) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (2812) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\19113_원본 이미지 .zip | |||
(PID) Process: | (2812) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (2812) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (2812) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (2812) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 | |||
(PID) Process: | (3384) 19113_원본 이미지 .exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
(PID) Process: | (3384) 19113_원본 이미지 .exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2812 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2812.12932\19113_원본 이미지 .exe | — | |
MD5:— | SHA256:— | |||
2312 | 19113_원본 이미지 .exe | C:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\boot.sdi | — | |
MD5:— | SHA256:— | |||
2312 | 19113_원본 이미지 .exe | C:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\Winre.wim | — | |
MD5:— | SHA256:— | |||
2312 | 19113_원본 이미지 .exe | C:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\Winre.wim.jabhgkl | — | |
MD5:— | SHA256:— | |||
2312 | 19113_원본 이미지 .exe | C:\System Volume Information\SPP\OnlineMetadataCache\{05ed3515-06b3-48f6-8cf2-bf24b1bf0727}_OnDiskSnapshotProp | — | |
MD5:— | SHA256:— | |||
2312 | 19113_원본 이미지 .exe | C:\System Volume Information\SPP\OnlineMetadataCache\{16d74681-6bc3-4c44-97f0-8b8dfefe2355}_OnDiskSnapshotProp | — | |
MD5:— | SHA256:— | |||
2312 | 19113_원본 이미지 .exe | C:\System Volume Information\SPP\OnlineMetadataCache\{38e8535f-27d0-4352-aa3a-ce4178930102}_OnDiskSnapshotProp | — | |
MD5:— | SHA256:— | |||
2312 | 19113_원본 이미지 .exe | C:\System Volume Information\SPP\OnlineMetadataCache\{3cc0f82b-873a-4e59-b89f-689fbdf88af9}_OnDiskSnapshotProp | — | |
MD5:— | SHA256:— | |||
2312 | 19113_원본 이미지 .exe | C:\System Volume Information\SPP\OnlineMetadataCache\{5c4beaff-a038-4df7-9b35-072a18f8e3d6}_OnDiskSnapshotProp | — | |
MD5:— | SHA256:— | |||
2312 | 19113_원본 이미지 .exe | C:\Users\JABHGKL-MANUAL.txt | text | |
MD5:B41C31A5A1D0394048E9B4B847564BEB | SHA256:F5D6C10401378F87C31060BDBC8D58698A7901D46DC7A3E05D4E6BA94B9F15DB |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2312 | 19113_원본 이미지 .exe | GET | 301 | 107.173.49.208:80 | http://www.kakaocorp.link/ | US | html | 162 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
— | — | 107.173.49.208:80 | www.kakaocorp.link | ColoCrossing | US | malicious |
— | — | 107.173.49.208:443 | www.kakaocorp.link | ColoCrossing | US | malicious |
Domain | IP | Reputation |
---|---|---|
www.kakaocorp.link |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
2312 | 19113_원본 이미지 .exe | A Network Trojan was detected | MALWARE [PTsecurity] Blacklisted GandCrab Ransomware C2 Server |
2312 | 19113_원본 이미지 .exe | A Network Trojan was detected | MALWARE [PTsecurity] Blacklisted GandCrab Ransomware C2 Server |