File name:

3.exe

Full analysis: https://app.any.run/tasks/0ce015ea-b828-4760-b50c-7e7bf8e09069
Verdict: Malicious activity
Threats:

CryptoWall is a notorious ransomware family that emerged in early 2014 and rapidly became one of the most destructive cyber threats of its time. This malware encrypts victims' files using strong AES encryption, demands ransom payments in Bitcoin, and has generated hundreds of millions of dollars for cybercriminals.

Malware Trends Tracker     >>>
Analysis date: August 24, 2023, 04:42:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
ransomware
cryptowall
sinkhole
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

F612500EE9764E18CA78D2E78DF5B017

SHA1:

CCB7B0A421CEFCB24713F5C91E0A19F42DAE266D

SHA256:

7351E53BD863795104D609F2192E3436D3A07FB597F0BAB35D175DF88A34C3E0

SSDEEP:

6144:nvABIYALj5fi7LHvlRLAB2DfnfF+TvKppCvbzOae2Y:YBIvLjVK7vlRLLbxmZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Deletes shadow copies

      • explorer.exe (PID: 3072)

    • Create files in the Startup directory

      • explorer.exe (PID: 3072)

    • Using BCDEDIT.EXE to modify recovery options

      • explorer.exe (PID: 3072)

    • Connects to the CnC server

      • svchost.exe (PID: 2492)

    • CRYPTOWALL was detected

      • svchost.exe (PID: 2492)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • explorer.exe (PID: 3072)

  • INFO

    • Creates files or folders in the user directory

      • explorer.exe (PID: 3072)
      • svchost.exe (PID: 2492)

    • Reads the computer name

      • 3.exe (PID: 1872)

    • Checks supported languages

      • 3.exe (PID: 1872)

    • Checks proxy server information

      • svchost.exe (PID: 2492)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (36.8)
.exe | Win32 Executable MS Visual C++ (generic) (26.6)
.exe | Win64 Executable (generic) (23.6)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)

EXIF

EXE

ProductVersion: 7.8.2.4
ProductName: GrRT Group Reportering Testinger
OriginalFileName: grrepptestt
LegalCopyright: Copyright (C) 2013 PofumGrp
InternalName: gr repor testt
FileVersion: 7.8.2.4
FileDescription: GrRT Groupp Reportering Testinger
CompanyName: PofumGrp
CharacterSet: Unicode
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Windows NT 32-bit
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 7.8.2.4
FileVersionNumber: 7.8.2.4
Subsystem: Windows GUI
SubsystemVersion: 5.1
ImageVersion: -
OSVersion: 5.1
EntryPoint: 0x443c
UninitializedDataSize: -
InitializedDataSize: 163328
CodeSize: 66048
LinkerVersion: 10
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit
TimeStamp: 2014:05:24 14:46:55+00:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 24-May-2014 14:46:55
Detected languages:
  • English - United States
CompanyName: PofumGrp
FileDescription: GrRT Groupp Reportering Testinger
FileVersion: 7.8.2.4
InternalName: gr repor testt
LegalCopyright: Copyright (C) 2013 PofumGrp
OriginalFilename: grrepptestt
ProductName: GrRT Group Reportering Testinger
ProductVersion: 7.8.2.4

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000F0

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 6
Time date stamp: 24-May-2014 14:46:55
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0001013A
0x00010200
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.61703
.rdata
0x00012000
0x00024092
0x00024200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.19533
.data
0x00037000
0x00003230
0x00001400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.55892
.tls
0x0003B000
0x00000009
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x0003C000
0x0000051C
0x00000600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.48344
.reloc
0x0003D000
0x00001F22
0x00002000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
4.06157

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.79597
346
Latin 1 / Western European
English - United States
RT_MANIFEST

Imports

COMCTL32.dll
GDI32.dll
KERNEL32.dll
OLEACC.dll
OLEAUT32.dll
SETUPAPI.dll
SHELL32.dll
SHLWAPI.dll
USER32.dll
ole32.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 3.exe no specs explorer.exe #CRYPTOWALL svchost.exe vssadmin.exe no specs bcdedit.exe no specs bcdedit.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1872"C:\Users\admin\AppData\Local\Temp\3.exe" C:\Users\admin\AppData\Local\Temp\3.exe—explorer.exe
User:
admin
Company:
PofumGrp
Integrity Level:
MEDIUM
Description:
GrRT Groupp Reportering Testinger
Exit code:
0
Version:
7.8.2.4
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\temp\3.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\gdi32.dll
2492-k netsvcsC:\Windows\System32\svchost.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
2680vssadmin.exe Delete Shadows /All /QuietC:\Windows\System32\vssadmin.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\vssadmin.exe
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2696bcdedit /set {default} bootstatuspolicy ignoreallfailuresC:\Windows\System32\bcdedit.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Boot Configuration Data Editor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\bcdedit.exe
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
2760bcdedit /set {default} recoveryenabled NoC:\Windows\System32\bcdedit.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Boot Configuration Data Editor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\bcdedit.exe
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3072"C:\Windows\explorer.exe"C:\Windows\explorer.exe
3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
403
Read events
391
Write events
12
Delete events
0

Modification events

(PID) Process:(2492) svchost.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2492) svchost.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000004F010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2492) svchost.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2492) svchost.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2492) svchost.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2492) svchost.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2492) svchost.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2492) svchost.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
3
Suspicious files
0
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
3072explorer.exeC:\1c99f5c\1c99f5c.exeexecutable
MD5:F612500EE9764E18CA78D2E78DF5B017
SHA256:7351E53BD863795104D609F2192E3436D3A07FB597F0BAB35D175DF88A34C3E0
3072explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1c99f5c.exeexecutable
MD5:F612500EE9764E18CA78D2E78DF5B017
SHA256:7351E53BD863795104D609F2192E3436D3A07FB597F0BAB35D175DF88A34C3E0
2492svchost.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\39895GOV.txttext
MD5:AD2990C49A21ACCFF9E02563DE67F33F
SHA256:566AB03C49335B33B9936EF2854E49FCEEBE0E4105F0A4425FAA46D3B35729B5
2492svchost.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\6T9WGQSF.txttext
MD5:D570E4B1BB5EBF620140448B8BDA9FA2
SHA256:7C16D59C565EE1BA76756FE0AF04465CF0AF0368A4CAA82931E3865511194ACD
2492svchost.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\UG8LE7WF.txttext
MD5:3FBC8E9099F86E85EA65029AFC465918
SHA256:58D352DFA648C7EADEDCB2B7646F8ECB39E492D468283A1E2A531C30B8EE4A0A
2492svchost.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\72UJZYCA.txttext
MD5:21C8652DE9A7F39EB00F535ECB926C89
SHA256:068DA495C93832AAAE73F219B5DAECCC92AEE4BDA3686ADF4BA66E0C8958BA1C
2492svchost.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\PP871D94.txttext
MD5:11F68EAD0432AB1D642422C56B5F1737
SHA256:0937BF955D9C2519025C7A5C1ADDD9899540BDB88AE3B34DB003D4FCA978DB92
2492svchost.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\L6I6U8F5.txttext
MD5:97622B5E441436455E4044C8FB2F74A9
SHA256:D758BDC810332DC748DAAA38E4FEF138652FBDF7A31379210933B6CED9833922
2492svchost.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\KVZE38LC.txttext
MD5:404E71AB48042C2BE7253BD090F8E5AD
SHA256:1A3471A4B40389C436639DBEDD4204CE4894A3C1B4CBD91392FCCA9531DCA218
3072explorer.exeC:\Users\admin\AppData\Roaming\1c99f5c.exeexecutable
MD5:F612500EE9764E18CA78D2E78DF5B017
SHA256:7351E53BD863795104D609F2192E3436D3A07FB597F0BAB35D175DF88A34C3E0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
17
DNS requests
5
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2492
svchost.exe
GET
—
35.205.61.67:80
http://dominicanajoker.com/1
US
—
—
malicious
2492
svchost.exe
GET
—
35.205.61.67:80
http://dominicanajoker.com/1
US
—
—
malicious
2492
svchost.exe
GET
—
35.205.61.67:80
http://dominicanajoker.com/1
US
—
—
malicious
2492
svchost.exe
GET
—
35.205.61.67:80
http://dominicanajoker.com/1
US
—
—
malicious
2492
svchost.exe
GET
—
35.205.61.67:80
http://dominicanajoker.com/1
US
—
—
malicious
2492
svchost.exe
GET
—
35.205.61.67:80
http://dominicanajoker.com/1
US
—
—
malicious
2492
svchost.exe
GET
—
35.205.61.67:80
http://dominicanajoker.com/1
US
—
—
malicious
2492
svchost.exe
POST
—
35.205.61.67:80
http://dominicanajoker.com/40n7q74o8zvol
US
—
—
malicious
2492
svchost.exe
POST
—
35.205.61.67:80
http://dominicanajoker.com/60vu7lg2807ty
US
—
—
malicious
2492
svchost.exe
POST
—
35.205.61.67:80
http://dominicanajoker.com/yb7q3yhl3uv5
US
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3284
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2492
svchost.exe
35.205.61.67:80
dominicanajoker.com
GOOGLE-CLOUD-PLATFORM
BE
malicious

DNS requests

Domain
IP
Reputation
dominikanabestplace.com
  • —
malicious
nofbiatdominicana.com
  • —
unknown
dominicanajoker.com
  • 35.205.61.67
malicious
likeyoudominicana.com
  • —
unknown
maskaradshowdominicana.com
  • —
unknown

Threats

PID
Process
Class
Message
2492
svchost.exe
A Network Trojan was detected
ET MALWARE CryptoWall Check-in
2492
svchost.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst
2492
svchost.exe
A Network Trojan was detected
ET MALWARE CryptoWall Check-in
2492
svchost.exe
A Network Trojan was detected
ET MALWARE CryptoWall Check-in
2492
svchost.exe
A Network Trojan was detected
ET MALWARE CryptoWall Check-in
2492
svchost.exe
A Network Trojan was detected
ET MALWARE CryptoWall Check-in
2492
svchost.exe
A Network Trojan was detected
ET MALWARE CryptoWall Check-in
2492
svchost.exe
A Network Trojan was detected
ET MALWARE CryptoWall Check-in
No debug info