File name:

법원의 논문.png.js

Full analysis: https://app.any.run/tasks/c8345ada-972d-45d6-8d45-8a6e89f1e8bc
Verdict: Malicious activity
Threats:

GandCrab is probably one of the most famous Ransomware. A Ransomware is a malware that asks the victim to pay money in order to restore access to encrypted files. If the user does not cooperate the files are forever lost.

Malware Trends Tracker     >>>
Analysis date: March 21, 2019, 04:57:47
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
gandcrab
trojan
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines, with no line terminators
MD5:

89239F1D08CBFB8E11F083F65686C395

SHA1:

DF09E2FE9AADCC40FBF0DAB6E7F32B74140D913C

SHA256:

6014D608618D6E8E02AB87AFD6192C1920353E7B20296D00B8CFF2196640111D

SSDEEP:

3072:FVYlVZIBHsrBIhkXBMgkTVgonDDSTEad0oxTstEisqf8QeNNqD6cPIRbK3pONosp:nSKkRMTVgo6TMo8tIq9IMZOGs1Iq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 58480.exe (PID: 2388)

    • Actions looks like stealing of personal data

      • 58480.exe (PID: 2388)

    • Writes file to Word startup folder

      • 58480.exe (PID: 2388)

    • Renames files like Ransomware

      • 58480.exe (PID: 2388)

    • Dropped file may contain instructions of ransomware

      • 58480.exe (PID: 2388)

    • Deletes shadow copies

      • cmd.exe (PID: 3104)

    • Changes settings of System certificates

      • 58480.exe (PID: 2388)

    • Connects to CnC server

      • 58480.exe (PID: 2388)

    • GANDCRAB detected

      • 58480.exe (PID: 2388)

  • SUSPICIOUS

    • Creates files in the user directory

      • WScript.exe (PID: 1048)
      • 58480.exe (PID: 2388)

    • Creates files in the program directory

      • 58480.exe (PID: 2388)

    • Executable content was dropped or overwritten

      • WScript.exe (PID: 1048)

    • Reads the cookies of Mozilla Firefox

      • 58480.exe (PID: 2388)

    • Starts CMD.EXE for commands execution

      • 58480.exe (PID: 2388)

    • Adds / modifies Windows certificates

      • 58480.exe (PID: 2388)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • 58480.exe (PID: 2388)

    • Dropped object may contain TOR URL's

      • 58480.exe (PID: 2388)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
5
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start wscript.exe #GANDCRAB 58480.exe cmd.exe vssadmin.exe no specs vssvc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
764vssadmin delete shadows /all /quietC:\Windows\system32\vssadmin.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssadmin.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1048"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\법원의 논문.png.js"C:\Windows\System32\WScript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2388"C:\Users\admin\AppData\Roaming\Microsoft\58480.exe" C:\Users\admin\AppData\Roaming\Microsoft\58480.exe
WScript.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\microsoft\58480.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3104"C:\Windows\system32\cmd.exe" /c vssadmin delete shadows /all /quietC:\Windows\system32\cmd.exe
58480.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3252C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
498
Read events
457
Write events
41
Delete events
0

Modification events

(PID) Process:(1048) WScript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(1048) WScript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2388) 58480.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2388) 58480.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2388) 58480.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\58480_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2388) 58480.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\58480_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2388) 58480.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\58480_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(2388) 58480.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\58480_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(2388) 58480.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\58480_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2388) 58480.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\58480_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
Executable files
1
Suspicious files
409
Text files
321
Unknown types
15

Dropped files

PID
Process
Filename
Type
238858480.exeC:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\boot.sdi —
MD5:—
SHA256:—
238858480.exeC:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\Winre.wim.mqodok —
MD5:—
SHA256:—
238858480.exeC:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\Winre.wim —
MD5:—
SHA256:—
238858480.exeC:\System Volume Information\SPP\OnlineMetadataCache\{05ed3515-06b3-48f6-8cf2-bf24b1bf0727}_OnDiskSnapshotProp —
MD5:—
SHA256:—
238858480.exeC:\System Volume Information\SPP\OnlineMetadataCache\{16d74681-6bc3-4c44-97f0-8b8dfefe2355}_OnDiskSnapshotProp —
MD5:—
SHA256:—
238858480.exeC:\System Volume Information\SPP\OnlineMetadataCache\{38e8535f-27d0-4352-aa3a-ce4178930102}_OnDiskSnapshotProp —
MD5:—
SHA256:—
238858480.exeC:\System Volume Information\SPP\OnlineMetadataCache\{3cc0f82b-873a-4e59-b89f-689fbdf88af9}_OnDiskSnapshotProp —
MD5:—
SHA256:—
238858480.exeC:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\MQODOK-MANUAL.txttext
MD5:—
SHA256:—
238858480.exeC:\System Volume Information\SPP\OnlineMetadataCache\{5c4beaff-a038-4df7-9b35-072a18f8e3d6}_OnDiskSnapshotProp —
MD5:—
SHA256:—
238858480.exeC:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-500\MQODOK-MANUAL.txttext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
2
DNS requests
1
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2388
58480.exe
GET
301
107.173.49.208:80
http://www.kakaocorp.link/
US
html
162 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2388
58480.exe
107.173.49.208:80
www.kakaocorp.link
ColoCrossing
US
malicious
2388
58480.exe
107.173.49.208:443
www.kakaocorp.link
ColoCrossing
US
malicious

DNS requests

Domain
IP
Reputation
www.kakaocorp.link
  • 107.173.49.208
malicious

Threats

PID
Process
Class
Message
2388
58480.exe
A Network Trojan was detected
MALWARE [PTsecurity] Blacklisted GandCrab Ransomware C2 Server
2388
58480.exe
A Network Trojan was detected
MALWARE [PTsecurity] Blacklisted GandCrab Ransomware C2 Server
2388
58480.exe
A Network Trojan was detected
MALWARE [PTsecurity] GandCrab v.5 SSL Connection
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
법원의 논문.png.js