analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

Ransomware.Cryptowall.zip

Full analysis: https://app.any.run/tasks/03deffcd-09cf-47df-9025-de6aaa79ca85
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: January 24, 2022, 16:58:49
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
trojan
ransomware
cryptowall
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

8710EA46C2DB18965A3F13C5FB7C5BE8

SHA1:

24978C79B5B4B3796ADCEFFE06A3A39B33DDA41D

SHA256:

60D574055AE164CC32DF9E5C9402DEEFA9D07E5034328D7B41457D35B7312A0E

SSDEEP:

3072:OCDc19avf1fHqOhdzVD/9Ae7RT5f6IiL+WfXS21o4D:OCD0QvlqGRlAlX+sXjo4D

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • cryptowall.exe (PID: 3896)
      • cryptowall.exe (PID: 2112)

    • Uses SVCHOST.EXE for hidden code execution

      • explorer.exe (PID: 1384)

    • Writes to a start menu file

      • explorer.exe (PID: 1384)

    • Starts BCDEDIT.EXE to disable recovery

      • explorer.exe (PID: 1384)

    • Deletes shadow copies

      • explorer.exe (PID: 1384)

    • Changes the autorun value in the registry

      • explorer.exe (PID: 1384)

    • Drops executable file immediately after starts

      • explorer.exe (PID: 1384)

    • Connects to CnC server

      • svchost.exe (PID: 2220)

    • CRYPTOWALL was detected

      • svchost.exe (PID: 2220)

  • SUSPICIOUS

    • Reads the computer name

      • WinRAR.exe (PID: 3720)

    • Checks supported languages

      • WinRAR.exe (PID: 3720)
      • cryptowall.exe (PID: 2112)
      • cryptowall.exe (PID: 3896)

    • Creates files in the user directory

      • explorer.exe (PID: 1384)

    • Application launched itself

      • cryptowall.exe (PID: 3896)

    • Executable content was dropped or overwritten

      • explorer.exe (PID: 1384)
      • WinRAR.exe (PID: 3720)

    • Checks for external IP

      • svchost.exe (PID: 2220)

  • INFO

    • Checks supported languages

      • explorer.exe (PID: 1384)
      • svchost.exe (PID: 2220)
      • vssadmin.exe (PID: 3684)
      • bcdedit.exe (PID: 3500)
      • bcdedit.exe (PID: 3800)

    • Reads the computer name

      • explorer.exe (PID: 1384)
      • svchost.exe (PID: 2220)
      • vssadmin.exe (PID: 3684)

    • Manual execution by user

      • cryptowall.exe (PID: 3896)

    • Reads settings of System Certificates

      • svchost.exe (PID: 2220)

    • Checks Windows Trust Settings

      • svchost.exe (PID: 2220)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: cryptowall.bin
ZipUncompressedSize: 246272
ZipCompressedSize: 102838
ZipCRC: 0x6baaab1e
ZipModifyDate: 2015:02:09 22:05:26
ZipCompression: Deflated
ZipBitFlag: 0x0009
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
48
Monitored processes
8
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe cryptowall.exe no specs cryptowall.exe no specs explorer.exe #CRYPTOWALL svchost.exe vssadmin.exe no specs bcdedit.exe no specs bcdedit.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3720"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Ransomware.Cryptowall.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3896"C:\Users\admin\Desktop\cryptowall.exe" C:\Users\admin\Desktop\cryptowall.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\cryptowall.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\comdlg32.dll
2112"C:\Users\admin\Desktop\cryptowall.exe" C:\Users\admin\Desktop\cryptowall.exe—cryptowall.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\cryptowall.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1384"C:\Windows\explorer.exe"C:\Windows\explorer.exe
cryptowall.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2220-k netsvcsC:\Windows\system32\svchost.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3684vssadmin.exe Delete Shadows /All /QuietC:\Windows\system32\vssadmin.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Command Line Interface for Microsoft� Volume Shadow Copy Service
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
3500bcdedit /set {default} recoveryenabled NoC:\Windows\system32\bcdedit.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Boot Configuration Data Editor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\bcdedit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3800bcdedit /set {default} bootstatuspolicy ignoreallfailuresC:\Windows\system32\bcdedit.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Boot Configuration Data Editor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\bcdedit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
5 721
Read events
5 660
Write events
61
Delete events
0

Modification events

(PID) Process:(3720) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3720) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3720) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3720) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3720) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3720) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Ransomware.Cryptowall.zip
(PID) Process:(3720) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3720) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3720) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3720) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
4
Suspicious files
5
Text files
0
Unknown types
3

Dropped files

PID
Process
Filename
Type
2220svchost.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_45E3C223BCF135987E4038FB6B0DBA13der
MD5:34615E035F22E0F62ABB877EF4E65B52
SHA256:77DA562E421B1004406EBDA1A1E2576B3B04D6D6E62BBDFF40B8C67E0A3C6486
2220svchost.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:A4F77D254753D078218DE5D8102F43E1
SHA256:09B1386DF42D16D385D6BCF52A1875EA1436821A4D8B75CB9ACECB62FF440AC2
2220svchost.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:DC7C110C5CF28D3588EA986224260687
SHA256:EF802D7ED563C9AE3AB129B98BDDDBC7D7EA1079BF5C5E72F8EFBAF423D4C6F4
2220svchost.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAder
MD5:0213524244EAF6A7E638BB1910432065
SHA256:2CCB09AE116851A6DFF4849062A18092D522A05897CECB74DFCA383AA2DEA296
2220svchost.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_45E3C223BCF135987E4038FB6B0DBA13binary
MD5:86185FE439A33EE73AB238ABE4E579A4
SHA256:578F0E0CA2081E34B5B9802827E8F581D3E45CF4D086ABB4ED7440FF65160287
2220svchost.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\19CB7CB85F3C1BAA0B50740305CB83A0_E82339634BA2CD03EAD3AF4785D65A60der
MD5:0375EB6B80FA64E8E836628BD4B05046
SHA256:391E9EB7FC753398A21A9F2E723C9A5BFEF8F652517B9F44B0D37A5406F7684C
2220svchost.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\19CB7CB85F3C1BAA0B50740305CB83A0_E82339634BA2CD03EAD3AF4785D65A60binary
MD5:E8FF9F391FC3B68103663BC9F755FCD2
SHA256:B299B8B5CF62CD70EFF7A02821DD347BEDC7892C087826EC703C19B4EB27E114
2220svchost.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:F7DCB24540769805E5BB30D193944DCE
SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA
1384explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\46695237.exeexecutable
MD5:47363B94CEE907E2B8926C1BE61150C7
SHA256:45317968759D3E37282CEB75149F627D648534C5B4685F6DA3966D8F6FCA662D
1384explorer.exeC:\Users\admin\AppData\Roaming\46695237.exeexecutable
MD5:47363B94CEE907E2B8926C1BE61150C7
SHA256:45317968759D3E37282CEB75149F627D648534C5B4685F6DA3966D8F6FCA662D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
26
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2220
svchost.exe
GET
200
142.250.186.131:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIAjrICMzZli2TN25s%3D
US
der
724 b
whitelisted
2220
svchost.exe
GET
200
142.250.186.131:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
2220
svchost.exe
GET
—
184.106.112.172:80
http://curlmyip.com/
US
—
—
malicious
2220
svchost.exe
GET
200
142.250.186.131:80
http://ocsp.pki.goog/gts1d4/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSMBFDqU0NJQdZdEGU3bkhj0FoRrQQUJeIYDrJXkZQq5dRdhpCD3lOzuJICEQDiOJGRlIYAiAoAAAABKkNX
US
der
472 b
whitelisted
2220
svchost.exe
POST
—
94.247.31.19:8080
http://proxy1-1-1.i2p/8pa639492ew0
ES
—
—
malicious
2220
svchost.exe
POST
—
94.247.31.19:8080
http://proxy2-2-2.i2p/og4273v2gey5
ES
—
—
malicious
2220
svchost.exe
POST
—
94.247.31.19:8080
http://proxy1-1-1.i2p/sb8unrxt7yyu0
ES
—
—
malicious
2220
svchost.exe
GET
302
34.117.59.81:80
http://myexternalip.com/raw
US
text
50 b
shared
2220
svchost.exe
GET
302
34.117.59.81:80
http://myexternalip.com/raw
US
text
50 b
shared
2220
svchost.exe
GET
200
23.32.238.208:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?01b7e6dda3f8ab25
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2220
svchost.exe
188.165.164.184:80
ip-addr.es
OVH SAS
FR
suspicious
2220
svchost.exe
23.32.238.208:80
ctldl.windowsupdate.com
XO Communications
US
unknown
2220
svchost.exe
34.117.59.81:80
myexternalip.com
—
US
whitelisted
2220
svchost.exe
34.117.59.81:443
myexternalip.com
—
US
whitelisted
2220
svchost.exe
94.247.31.19:8080
—
ELB Multimedia SARL
ES
malicious
2220
svchost.exe
94.247.28.156:8081
—
ELB Multimedia SARL
FR
suspicious
2220
svchost.exe
142.250.186.131:80
ocsp.pki.goog
Google Inc.
US
whitelisted
—
—
94.247.28.26:2525
—
ELB Multimedia SARL
FR
unknown
2220
svchost.exe
184.106.112.172:80
curlmyip.com
Rackspace Ltd.
US
suspicious

DNS requests

Domain
IP
Reputation
ip-addr.es
  • 188.165.164.184
shared
myexternalip.com
  • 34.117.59.81
shared
ctldl.windowsupdate.com
  • 23.32.238.208
  • 23.32.238.232
whitelisted
ocsp.pki.goog
  • 142.250.186.131
whitelisted
dns.msftncsi.com
  • 131.107.255.255
shared
curlmyip.com
  • 184.106.112.172
malicious

Threats

PID
Process
Class
Message
2220
svchost.exe
A Network Trojan was detected
ET POLICY Possible IP Check ip-addr.es
2220
svchost.exe
Potential Corporate Privacy Violation
ET POLICY External IP Check myexternalip.com
2220
svchost.exe
Potential Corporate Privacy Violation
ET POLICY IP Check Domain (myexternalip .com in TLS SNI)
2220
svchost.exe
A Network Trojan was detected
ET TROJAN CryptoWall Check-in
2220
svchost.exe
A Network Trojan was detected
ET TROJAN CryptoWall CryptoWall 3.0 Check-in
2220
svchost.exe
A Network Trojan was detected
ET TROJAN CryptoWall Check-in
2220
svchost.exe
A Network Trojan was detected
ET TROJAN CryptoWall CryptoWall 3.0 Check-in
2220
svchost.exe
A Network Trojan was detected
ET POLICY Possible IP Check ip-addr.es
2220
svchost.exe
Potential Corporate Privacy Violation
ET POLICY External IP Check myexternalip.com
2220
svchost.exe
Potential Corporate Privacy Violation
ET POLICY IP Check Domain (myexternalip .com in TLS SNI)
4 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Ransomware.Cryptowall.zip