URL:

https://pixeldra.in/api/download/lZnJtk

Full analysis: https://app.any.run/tasks/b6170d07-4021-410e-9da2-8b144a9a4e59
Verdict: Malicious activity
Threats:

GandCrab is probably one of the most famous Ransomware. A Ransomware is a malware that asks the victim to pay money in order to restore access to encrypted files. If the user does not cooperate the files are forever lost.

Malware Trends Tracker     >>>
Analysis date: January 31, 2019, 01:52:07
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
ransomware
wannacry
gandcrab
miner
HorridReap
Indicators:
MD5:

71CC618D2BED7A9C1034B07FBB4C2AB5

SHA1:

6CCC5DB8A7BE13FB5EBC6F60F40591891F0D7B2C

SHA256:

4F9A5FB75EBD249A2A7104B8B14711B433A6A6185D0EB835A4A61FB34B4E749D

SSDEEP:

3:N8Ici2AEki:2IEAu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • mssecsvc.exe (PID: 2452)
      • cf8533849ee5e82023ad7adbdbd6543cb6db596c53048b1a0c00b3643a72db30.exe (PID: 2568)
      • 32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.exe (PID: 3364)
      • mssecsvc.exe (PID: 2756)
      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 3728)
      • tasksche.exe (PID: 3252)
      • 02ca4397da55b3175aaa1ad2c99981e792f66151.exe (PID: 2444)
      • 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe (PID: 3820)
      • taskdl.exe (PID: 3212)
      • 4c1dc737915d76b7ce579abddaba74ead6fdb5b519a1ea45308b8c49b950655c (1).exe (PID: 3092)
      • grandcab.exe (PID: 312)
      • NsCpuCNMiner32.exe (PID: 3956)
      • 86e0eac8c5ce70c4b839ef18af5231b5f92e292b81e440193cdbdc7ed108049f.exe (PID: 2532)

    • WANNACRY was detected

      • mssecsvc.exe (PID: 2452)
      • mssecsvc.exe (PID: 2756)

    • Actions looks like stealing of personal data

      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 3728)

    • Dropped file may contain instructions of ransomware

      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 3728)

    • Connects to CnC server

      • 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe (PID: 3820)

    • Writes file to Word startup folder

      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 3728)

    • GandCrab keys found

      • grandcab.exe (PID: 312)

    • Modifies files in Chrome extension folder

      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 3728)

    • Looks like application has launched a miner

      • 02ca4397da55b3175aaa1ad2c99981e792f66151.exe (PID: 2444)
      • cmd.exe (PID: 3020)

    • Changes the autorun value in the registry

      • reg.exe (PID: 2868)

    • Low-level write access rights to disk partition

      • 4c1dc737915d76b7ce579abddaba74ead6fdb5b519a1ea45308b8c49b950655c (1).exe (PID: 3092)

  • SUSPICIOUS

    • Changes tracing settings of the file or console

      • 32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.exe (PID: 3364)

    • Creates files in the Windows directory

      • mssecsvc.exe (PID: 2452)
      • mssecsvc.exe (PID: 2756)

    • Creates files in the user directory

      • mssecsvc.exe (PID: 2452)
      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 3728)

    • Executable content was dropped or overwritten

      • cf8533849ee5e82023ad7adbdbd6543cb6db596c53048b1a0c00b3643a72db30.exe (PID: 2568)
      • mssecsvc.exe (PID: 2452)
      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 3728)
      • HorridReap.exe (PID: 2488)
      • 02ca4397da55b3175aaa1ad2c99981e792f66151.exe (PID: 2444)

    • Uses ATTRIB.EXE to modify file attributes

      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 3728)

    • Uses ICACLS.EXE to modify access control list

      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 3728)

    • Creates files like Ransomware instruction

      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 3728)

    • Starts CMD.EXE for commands execution

      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 3728)
      • 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe (PID: 3820)
      • 02ca4397da55b3175aaa1ad2c99981e792f66151.exe (PID: 2444)

    • Executes scripts

      • cmd.exe (PID: 3768)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 2784)
      • cmd.exe (PID: 1044)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 2504)
      • cmd.exe (PID: 3968)

    • Uses NETSH.EXE for network configuration

      • cmd.exe (PID: 2600)
      • cmd.exe (PID: 4020)
      • cmd.exe (PID: 3784)
      • cmd.exe (PID: 3268)
      • cmd.exe (PID: 3172)

    • Uses RUNDLL32.EXE to load library

      • HorridReap.exe (PID: 2488)

    • Executes application which crashes

      • HorridReap.exe (PID: 2488)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 3032)

    • Creates files in the program directory

      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 3728)

    • Low-level read access rights to disk partition

      • 4c1dc737915d76b7ce579abddaba74ead6fdb5b519a1ea45308b8c49b950655c (1).exe (PID: 3092)

    • Dropped object may contain URLs of mainers pools

      • cmd.exe (PID: 3216)

  • INFO

    • Creates files in the user directory

      • chrome.exe (PID: 2996)

    • Reads settings of System Certificates

      • chrome.exe (PID: 2996)

    • Application launched itself

      • chrome.exe (PID: 2996)

    • Dropped object may contain TOR URL's

      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 3728)
      • HorridReap.exe (PID: 2488)

    • Dropped object may contain URL to Tor Browser

      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 3728)

    • Dropped object may contain Bitcoin addresses

      • ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe (PID: 3728)
      • HorridReap.exe (PID: 2488)

    • Reads Internet Cache Settings

      • chrome.exe (PID: 2996)

    • Application was crashed

      • grandcab.exe (PID: 312)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
104
Monitored processes
49
Malicious processes
8
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs horridreap.exe cf8533849ee5e82023ad7adbdbd6543cb6db596c53048b1a0c00b3643a72db30.exe 32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.exe #WANNACRY mssecsvc.exe ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe #WANNACRY mssecsvc.exe attrib.exe no specs icacls.exe no specs tasksche.exe no specs 02ca4397da55b3175aaa1ad2c99981e792f66151.exe taskdl.exe no specs cmd.exe no specs cscript.exe no specs 8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe cmd.exe no specs taskkill.exe no specs cmd.exe no specs taskkill.exe no specs cmd.exe no specs sc.exe no specs cmd.exe no specs sc.exe no specs cmd.exe no specs netsh.exe no specs 4c1dc737915d76b7ce579abddaba74ead6fdb5b519a1ea45308b8c49b950655c (1).exe cmd.exe no specs netsh.exe no specs #GANDCRAB grandcab.exe cmd.exe no specs ntvdm.exe no specs netsh.exe no specs rundll32.exe no specs cmd.exe no specs netsh.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs nscpucnminer32.exe no specs reg.exe cmd.exe no specs 86e0eac8c5ce70c4b839ef18af5231b5f92e292b81e440193cdbdc7ed108049f.exe no specs netsh.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
312"C:\Users\admin\AppData\Local\Temp\grandcab.exe" C:\Users\admin\AppData\Local\Temp\grandcab.exe
HorridReap.exe
User:
admin
Company:
HWorks
Integrity Level:
HIGH
Description:
Safemode Mentions Coms
Exit code:
0
Version:
5.3.38.4
Modules
Images
c:\users\admin\appdata\local\temp\grandcab.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
340"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=896,1112433181398300262,13346142530850764726,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=33FF2C0AC3CCF2B4F5A9F9DE1C426F58 --mojo-platform-channel-handle=988 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\68.0.3440.106\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
932attrib +h .C:\Windows\system32\attrib.exe—ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Attribute Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\attrib.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ulib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1044C:\Windows\system32\cmd.exe /c taskkill /f /im mmc.exeC:\Windows\system32\cmd.exe—8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
128
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
1620netsh ipsec static add filteraction name=block action=blockC:\Windows\system32\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1820"C:\Windows\system32\ntvdm.exe" -i1 C:\Windows\system32\ntvdm.exe—HorridReap.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
NTVDM.EXE
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntvdm.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2348icacls . /grant Everyone:F /T /C /QC:\Windows\system32\icacls.exe—ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\icacls.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
2444"C:\Users\admin\AppData\Local\Temp\02ca4397da55b3175aaa1ad2c99981e792f66151.exe" C:\Users\admin\AppData\Local\Temp\02ca4397da55b3175aaa1ad2c99981e792f66151.exe
HorridReap.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\02ca4397da55b3175aaa1ad2c99981e792f66151.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\wininet.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2452"C:\Users\admin\AppData\Local\Temp\mssecsvc.exe" C:\Users\admin\AppData\Local\Temp\mssecsvc.exe
HorridReap.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® Disk Defragmenter
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\users\admin\appdata\local\temp\mssecsvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
2488"C:\Users\admin\Downloads\HorridReap.exe" C:\Users\admin\Downloads\HorridReap.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\downloads\horridreap.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
Total events
1 494
Read events
1 136
Write events
355
Delete events
3

Modification events

(PID) Process:(2996) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(2996) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(2996) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(2976) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:writeName:2996-13193373152926000
Value:
259
(PID) Process:(2996) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(2996) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(2996) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:3516-13180984670829101
Value:
0
(PID) Process:(2996) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(2996) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:2996-13193373152926000
Value:
259
(PID) Process:(2996) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:metricsid
Value:
Executable files
95
Suspicious files
354
Text files
141
Unknown types
22

Dropped files

PID
Process
Filename
Type
2996chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\74802bb0-60c3-48cc-b75f-0942b928756a.tmp —
MD5:—
SHA256:—
2996chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB\000016.dbtmp —
MD5:—
SHA256:—
2996chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000016.dbtmp —
MD5:—
SHA256:—
2996chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\6a57f39b-135f-41da-8cbf-96098558724a.tmp —
MD5:—
SHA256:—
2996chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\aad43214-8d78-48c4-b0f6-45c3bd96bed0.tmp —
MD5:—
SHA256:—
2996chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Last Versiontext
MD5:—
SHA256:—
2996chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old~RF19937c.TMPtext
MD5:—
SHA256:—
2996chrome.exeC:\Users\admin\Downloads\e182e731-583a-4ca6-960e-21f103a4c341.tmp —
MD5:—
SHA256:—
2996chrome.exeC:\Users\admin\Downloads\Unconfirmed 422674.crdownload —
MD5:—
SHA256:—
2996chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
310
DNS requests
19
Threats
15

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3820
8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe
GET
200
66.42.108.166:80
http://08.super5566.com/install/start
US
—
—
malicious
2444
02ca4397da55b3175aaa1ad2c99981e792f66151.exe
GET
200
89.111.178.201:80
http://iqtesti.ru/test.html?8
RU
html
2.01 Kb
malicious
3364
32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.exe
GET
200
98.143.148.47:80
http://www.ifferfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
US
html
28 b
unknown
2444
02ca4397da55b3175aaa1ad2c99981e792f66151.exe
GET
404
37.1.216.8:80
http://pstests.ru/test.html?4
DE
html
1.22 Kb
malicious
2444
02ca4397da55b3175aaa1ad2c99981e792f66151.exe
GET
404
37.1.216.8:80
http://jobtests.ru/test.html?7
DE
html
1.22 Kb
malicious
2444
02ca4397da55b3175aaa1ad2c99981e792f66151.exe
GET
404
37.1.216.8:80
http://qptest.ru/test.html?5
DE
html
1.22 Kb
malicious
2444
02ca4397da55b3175aaa1ad2c99981e792f66151.exe
GET
404
37.1.216.8:80
http://hrtests.ru/test.html?1
DE
html
1.22 Kb
malicious
2756
mssecsvc.exe
GET
200
104.17.38.137:80
http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
US
html
607 b
malicious
2444
02ca4397da55b3175aaa1ad2c99981e792f66151.exe
GET
404
37.1.216.8:80
http://profetest.ru/test.html?2
DE
html
1.22 Kb
malicious
2444
02ca4397da55b3175aaa1ad2c99981e792f66151.exe
GET
404
37.1.216.8:80
http://testpsy.ru/test.html?3
DE
html
1.22 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2996
chrome.exe
172.217.22.35:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
2996
chrome.exe
23.175.0.142:443
pixeldra.in
Puppet, Inc.
US
unknown
2996
chrome.exe
216.58.210.3:443
www.gstatic.com
Google Inc.
US
whitelisted
2996
chrome.exe
172.217.16.163:443
ssl.gstatic.com
Google Inc.
US
whitelisted
2996
chrome.exe
216.58.206.14:443
clients4.google.com
Google Inc.
US
whitelisted
3364
32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.exe
98.143.148.47:80
www.ifferfsodp9ifjaposdfjhgosurijfaewrwergwea.com
QuadraNet, Inc
US
unknown
2996
chrome.exe
216.58.210.14:443
sb-ssl.google.com
Google Inc.
US
whitelisted
2452
mssecsvc.exe
104.17.38.137:80
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
Cloudflare Inc
US
shared
2756
mssecsvc.exe
104.17.38.137:80
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
Cloudflare Inc
US
shared
2756
mssecsvc.exe
57.53.225.2:445
—
Societe Internationale de Telecommunications Aeronautiques
BE
unknown

DNS requests

Domain
IP
Reputation
clientservices.googleapis.com
  • 172.217.22.35
whitelisted
www.gstatic.com
  • 216.58.210.3
whitelisted
pixeldra.in
  • 23.175.0.142
suspicious
accounts.google.com
  • 172.217.23.141
shared
ssl.gstatic.com
  • 172.217.16.163
whitelisted
clients4.google.com
  • 216.58.206.14
whitelisted
sb-ssl.google.com
  • 216.58.210.14
whitelisted
www.ifferfsodp9ifjaposdfjhgosurijfaewrwergwea.com
  • 98.143.148.47
unknown
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
  • 104.17.38.137
  • 104.17.37.137
  • 104.17.40.137
  • 104.17.39.137
  • 104.17.41.137
malicious
stafftest.ru
  • 255.255.0.0
malicious

Threats

PID
Process
Class
Message
1056
svchost.exe
A Network Trojan was detected
ET TROJAN Possible WannaCry DNS Lookup 2
1056
svchost.exe
A Network Trojan was detected
MALWARE [PTsecurity] Possible WannaCry killswitch URL pattern
1056
svchost.exe
A Network Trojan was detected
MALWARE [PTsecurity] Possible WannaCry killswitch URL pattern
2452
mssecsvc.exe
A Network Trojan was detected
ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1
2452
mssecsvc.exe
A Network Trojan was detected
ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 2
2452
mssecsvc.exe
A Network Trojan was detected
ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 4
2452
mssecsvc.exe
A Network Trojan was detected
ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 5
2756
mssecsvc.exe
A Network Trojan was detected
ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 1
2756
mssecsvc.exe
A Network Trojan was detected
ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 2
2756
mssecsvc.exe
A Network Trojan was detected
ET TROJAN W32/WannaCry.Ransomware Killswitch Domain HTTP Request 4
2 ETPRO signatures available at the full report
Process
Message
8200755cbedd6f15eecd8207eba534709a01957b172d7a051b9cc4769ddbf233.exe
LD: scripts\main.lua: L(083): Startup
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://pixeldra.in/api/download/lZnJtk