Find similar analyses in TI Lookup

Analysis date (UTC): 29 October 2020, 16:57Analysis environment: Windows 7 Pro, build 7601, x86

123.bin

MD5:85D03FA245B0C60B199B4EDE1F27A11A

SHA1:60E0B5D0876C64378E5985470F0BFBCD3370467C

SHA256:5EDFC1CB7B964EFAD83A974378E377BAD906D24C686B4490A4D739AFF31D0D65

Analysis result

Threat level:Malicious activity

Tags:

ransomware

Full analysis:Analysis 123.bin (MD5: 85D03FA245B0C60B199B4EDE1F27A11A) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Application was injected by another process

host.exe (PID: 4072)
ctfmon.exe (PID: 696)
explorer.exe (PID: 292)
dwm.exe (PID: 236)
taskeng.exe (PID: 2004)

Runs injected code in another process

rundll32.exe (PID: 544)

Loads dropped or rewritten executable

WerFault.exe (PID: 2912)

Known privilege escalation attack

taskeng.exe (PID: 2004)
dwm.exe (PID: 236)
explorer.exe (PID: 292)
ctfmon.exe (PID: 696)
host.exe (PID: 4072)

Deletes shadow copies

cmd.exe (PID: 636)
cmd.exe (PID: 2176)
cmd.exe (PID: 1720)
cmd.exe (PID: 912)
cmd.exe (PID: 1972)
cmd.exe (PID: 2516)

SUSPICIOUS

Uses RUNDLL32.EXE to load library

explorer.exe (PID: 292)

Starts CMD.EXE for commands execution

taskeng.exe (PID: 2004)
dwm.exe (PID: 236)
explorer.exe (PID: 292)
ctfmon.exe (PID: 696)
host.exe (PID: 4072)
CompMgmtLauncher.exe (PID: 3656)
CompMgmtLauncher.exe (PID: 2536)
CompMgmtLauncher.exe (PID: 2444)
CompMgmtLauncher.exe (PID: 1596)
CompMgmtLauncher.exe (PID: 2628)
CompMgmtLauncher.exe (PID: 352)

Modifies the open verb of a shell class

taskeng.exe (PID: 2004)
dwm.exe (PID: 236)
explorer.exe (PID: 292)
ctfmon.exe (PID: 696)
host.exe (PID: 4072)

Uses WMIC.EXE to create a new process

cmd.exe (PID: 536)
cmd.exe (PID: 2704)
cmd.exe (PID: 2716)
cmd.exe (PID: 2160)
cmd.exe (PID: 2612)

Executed via WMI

cmd.exe (PID: 1868)
cmd.exe (PID: 2464)
cmd.exe (PID: 3348)
cmd.exe (PID: 4088)
cmd.exe (PID: 2948)
cmd.exe (PID: 932)

Executed as Windows Service

vssvc.exe (PID: 2796)

INFO

Loads main object executable

rundll32.exe (PID: 544)

Threats

PID	Process	Class	Message
1060	svchost.exe	Potentially Bad Traffic	ET INFO DNS Query for Suspicious .icu Domain