File name:

ASSIGNMENT.exe

Full analysis: https://app.any.run/tasks/d8a55918-e391-4725-872f-93e602f0a1b9
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: November 16, 2023, 10:21:28
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
cryptgh0st
ransomware
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

BB5D5E87F9F6D59555B322C2207977D0

SHA1:

99B64A6095992BD686C7019B18CADC82926F7EB6

SHA256:

4652D97F65F45BA49CD80FE6A5418391D802A0BF9B67BBCE3B20888DE262B561

SSDEEP:

49152:bFu+JVFyTCgxpITQE/KJ2Os4F/ToojB1xNhEMJYAykoHqRdgGqbzu6PZTenZgS2g:8txpyeL131xVWAyn3GEFdlES6QRoWk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • CRYPTGH0ST has been detected (SURICATA)

      • ASSIGNMENT.exe (PID: 2900)

  • SUSPICIOUS

    • Creates files like ransomware instruction

      • ASSIGNMENT.exe (PID: 2900)

    • Write to the desktop.ini file (may be used to cloak folders)

      • ASSIGNMENT.exe (PID: 2900)

    • Connects to unusual port

      • ASSIGNMENT.exe (PID: 2900)

  • INFO

    • Create files in a temporary directory

      • ASSIGNMENT.exe (PID: 2900)

    • Reads the computer name

      • ASSIGNMENT.exe (PID: 2900)
      • wmpnscfg.exe (PID: 3444)

    • Checks supported languages

      • ASSIGNMENT.exe (PID: 2900)
      • wmpnscfg.exe (PID: 3444)

    • Dropped object may contain TOR URL's

      • ASSIGNMENT.exe (PID: 2900)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3444)

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 3444)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 3
CodeSize: 2665984
InitializedDataSize: 188928
UninitializedDataSize: -
EntryPoint: 0x6cc30
OSVersion: 6.1
ImageVersion: 1
SubsystemVersion: 6.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #CRYPTGH0ST assignment.exe wmpnscfg.exe no specs assignment.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2900"C:\Users\admin\AppData\Local\Temp\ASSIGNMENT.exe" C:\Users\admin\AppData\Local\Temp\ASSIGNMENT.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\assignment.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winmm.dll
c:\windows\system32\user32.dll
3416"C:\Users\admin\AppData\Local\Temp\ASSIGNMENT.exe" C:\Users\admin\AppData\Local\Temp\ASSIGNMENT.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\assignment.exe
c:\windows\system32\ntdll.dll
3444"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
Total events
172
Read events
169
Write events
0
Delete events
3

Modification events

(PID) Process:(3444) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{691F8A04-59B1-4F26-9A3C-3A20E334BD5B}\{72FAA35A-9535-47F6-9AFC-5318EF9B947E}
Operation:delete keyName:(default)
Value:
(PID) Process:(3444) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{691F8A04-59B1-4F26-9A3C-3A20E334BD5B}
Operation:delete keyName:(default)
Value:
(PID) Process:(3444) wmpnscfg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Health\{68F34061-137E-47A2-9ED6-1A54DF457615}
Operation:delete keyName:(default)
Value:
Executable files
0
Suspicious files
141
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
2900ASSIGNMENT.exeC:\Users\Administrator\Music\desktop.inibinary
MD5:EAE4439AF57C6D3088771FDFFDAEE9A8
SHA256:37EAD00B49E19F32A455C6D1825A432CE66FCDC2193DA862FB71111FED60C1AE
2900ASSIGNMENT.exeC:\Users\admin\AppData\Local\Temp\desktop.inibinary
MD5:666FAAC4791F342B0EB7344806B5AE1E
SHA256:F9F00D8BD972971D17038154A512ABFE17A6D96CCC88B449FBF57383704590EA
2900ASSIGNMENT.exeC:\Users\Administrator\Favorites\Links\desktop.inibinary
MD5:8E3155C928FB6C5AE2F615E04FE31178
SHA256:DD4B564D6B2B0163581D4AEF41075907763BF3A2372BA30ACD52722B767C54E7
2900ASSIGNMENT.exeC:\Users\Administrator\Downloads\desktop.inibinary
MD5:435868F57D61D12216879E01F92B2606
SHA256:3954EFED037CC196E36C356E40638F5538AF95774D613C549E518B89A9F1DCD0
2900ASSIGNMENT.exeC:\Users\Administrator\Videos\desktop.inibinary
MD5:8E208AC5FAC2147804827D6ABCE6DEE6
SHA256:22FEB6AEAAB8CEF4861F47A6BC62AF97567F79B44728D6DA927AF3111FF5A8DA
2900ASSIGNMENT.exeC:\Users\admin\AppData\Local\Temp\ntuser.inibinary
MD5:BB394C9ECD918B62F89C0476CEB68FAC
SHA256:28B135D08D5AEC75412C56DB4E13EB413BC839B7C8238064DA183376B87A632C
2900ASSIGNMENT.exeC:\Users\admin\AppData\Local\Temp\Sleep Away.mp3 —
MD5:—
SHA256:—
2900ASSIGNMENT.exeC:\Users\Administrator\Favorites\Links for United States\desktop.inibinary
MD5:70A99A36E6ED79FA298F5FD541BCC5A6
SHA256:8F4343045261865326807279834775C292D4D752E587171676B364B5488CEE50
2900ASSIGNMENT.exeC:\Users\Public\Music\Sample Music\Sleep Away.mp3 —
MD5:—
SHA256:—
2900ASSIGNMENT.exeC:\Users\Administrator\Saved Games\desktop.inibinary
MD5:8E208AC5FAC2147804827D6ABCE6DEE6
SHA256:22FEB6AEAAB8CEF4861F47A6BC62AF97567F79B44728D6DA927AF3111FF5A8DA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
3
DNS requests
0
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2900
ASSIGNMENT.exe
POST
204
144.126.232.4:9090
http://144.126.232.4:9090/api/keys/add
unknown
binary
40 b
unknown
2900
ASSIGNMENT.exe
POST
409
144.126.232.4:9090
http://144.126.232.4:9090/api/keys/add
unknown
binary
40 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2900
ASSIGNMENT.exe
144.126.232.4:9090
—
DIGITALOCEAN-ASN
GB
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

No data

Threats

PID
Process
Class
Message
2900
ASSIGNMENT.exe
A Network Trojan was detected
RANSOMWARE [ANY.RUN] CryptGh0st Generic Ransomware
2900
ASSIGNMENT.exe
A Network Trojan was detected
RANSOMWARE [ANY.RUN] CryptGh0st Generic Ransomware
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ASSIGNMENT.exe