analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| URL: | https://github.com/Endermanch/MalwareDatabase/blob/master/ransomwares/NoMoreRansom.zip?raw=true |
| Full analysis: | https://app.any.run/tasks/43ebb43d-d3e2-4d83-b508-c42909ee5ee6 |
| Verdict: | Malicious activity |
| Threats: | Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying. |
| Analysis date: | January 25, 2022, 02:27:51 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MD5: | 58755388CB9D0D250B8AF871C7E46890 |
| SHA1: | 43CB532338C9FCDCDF067A8C52D5609D12F4D388 |
| SHA256: | 79A08B012BA9938B74775FD7DECA7EF2F88495F4678CFFA886407BA5C2237259 |
| SSDEEP: | 3:N8tEdegLaKoEJ3PqkzEHcEie+mrgAxMnj:2ufLtfnz+cEizmrgeMnj |
MALICIOUS
Application was dropped or rewritten from another process
- [email protected] (PID: 1908)
- [email protected] (PID: 3028)
- [email protected] (PID: 1004)
- [email protected] (PID: 3392)
- [email protected] (PID: 2280)
- [email protected] (PID: 1584)
- [email protected] (PID: 2348)
Changes the autorun value in the registry
- [email protected] (PID: 1908)
Drops executable file immediately after starts
- [email protected] (PID: 1908)
TROLDESH was detected
- [email protected] (PID: 1908)
- [email protected] (PID: 2348)
Deletes shadow copies
- [email protected] (PID: 1908)
Runs app for hidden code execution
- [email protected] (PID: 1908)
Steals credentials from Web Browsers
- [email protected] (PID: 2348)
- [email protected] (PID: 1908)
Actions looks like stealing of personal data
- [email protected] (PID: 2348)
- [email protected] (PID: 1908)
SUSPICIOUS
Reads the computer name
- WinRAR.exe (PID: 3028)
- [email protected] (PID: 1908)
- [email protected] (PID: 3028)
- [email protected] (PID: 3392)
- [email protected] (PID: 1584)
- [email protected] (PID: 1004)
- [email protected] (PID: 2280)
- javaw.exe (PID: 3660)
- jucheck.exe (PID: 3620)
- jucheck.exe (PID: 1580)
- [email protected] (PID: 2348)
Checks supported languages
- WinRAR.exe (PID: 3028)
- [email protected] (PID: 1908)
- [email protected] (PID: 3028)
- [email protected] (PID: 3392)
- [email protected] (PID: 1004)
- [email protected] (PID: 1584)
- [email protected] (PID: 2280)
- javacpl.exe (PID: 2852)
- chcp.com (PID: 2616)
- cmd.exe (PID: 2692)
- jucheck.exe (PID: 3620)
- javaw.exe (PID: 3660)
- jucheck.exe (PID: 1580)
- [email protected] (PID: 2348)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 3028)
- [email protected] (PID: 1908)
Creates files in the program directory
- [email protected] (PID: 1908)
Executed as Windows Service
- vssvc.exe (PID: 3968)
Executes JAVA applets
- javacpl.exe (PID: 2852)
Starts CMD.EXE for commands execution
- [email protected] (PID: 1908)
Starts application with an unusual extension
- cmd.exe (PID: 2692)
Check for Java to be installed
- javaw.exe (PID: 3660)
- jucheck.exe (PID: 3620)
- jucheck.exe (PID: 1580)
Drops a file with a compile date too recent
- [email protected] (PID: 1908)
- [email protected] (PID: 2348)
INFO
Checks supported languages
- chrome.exe (PID: 2396)
- chrome.exe (PID: 2408)
- chrome.exe (PID: 2852)
- chrome.exe (PID: 416)
- chrome.exe (PID: 4044)
- chrome.exe (PID: 4084)
- chrome.exe (PID: 2188)
- chrome.exe (PID: 3508)
- chrome.exe (PID: 2276)
- chrome.exe (PID: 3500)
- chrome.exe (PID: 2640)
- chrome.exe (PID: 1780)
- vssadmin.exe (PID: 2640)
- vssadmin.exe (PID: 2112)
- vssvc.exe (PID: 3968)
- vssadmin.exe (PID: 308)
- notepad.exe (PID: 1436)
- chrome.exe (PID: 1128)
- rundll32.exe (PID: 2984)
- chrome.exe (PID: 2780)
- chrome.exe (PID: 3384)
- chrome.exe (PID: 3460)
- chrome.exe (PID: 1348)
- chrome.exe (PID: 3104)
- chrome.exe (PID: 1876)
- chrome.exe (PID: 1620)
- chrome.exe (PID: 3128)
- chrome.exe (PID: 3236)
Reads settings of System Certificates
- chrome.exe (PID: 4084)
- chrome.exe (PID: 1348)
Reads the computer name
- chrome.exe (PID: 4084)
- chrome.exe (PID: 2396)
- chrome.exe (PID: 4044)
- chrome.exe (PID: 416)
- chrome.exe (PID: 3500)
- chrome.exe (PID: 2640)
- chrome.exe (PID: 2276)
- vssadmin.exe (PID: 2640)
- vssvc.exe (PID: 3968)
- vssadmin.exe (PID: 2112)
- vssadmin.exe (PID: 308)
- chrome.exe (PID: 1128)
- chrome.exe (PID: 1348)
- chrome.exe (PID: 3384)
- chrome.exe (PID: 3236)
Reads the hosts file
- chrome.exe (PID: 4084)
- chrome.exe (PID: 2396)
- chrome.exe (PID: 1128)
- chrome.exe (PID: 1348)
Application launched itself
- chrome.exe (PID: 2396)
- chrome.exe (PID: 1128)
Manual execution by user
- WinRAR.exe (PID: 3028)
- [email protected] (PID: 1908)
- [email protected] (PID: 1004)
- [email protected] (PID: 3392)
- [email protected] (PID: 3028)
- [email protected] (PID: 2280)
- [email protected] (PID: 1584)
- javacpl.exe (PID: 2852)
- [email protected] (PID: 2348)
- notepad.exe (PID: 1436)
- rundll32.exe (PID: 2984)
- chrome.exe (PID: 1128)
Dropped object may contain Bitcoin addresses
- [email protected] (PID: 1908)
- [email protected] (PID: 2348)
Dropped object may contain URL to Tor Browser
- [email protected] (PID: 1908)
Dropped object may contain TOR URL's
- [email protected] (PID: 1908)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
105
Monitored processes
42
Malicious processes
10
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 2396 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --disk-cache-dir=null --disk-cache-size=1 --media-cache-size=1 --disable-gpu-shader-disk-cache --disable-background-networking "https://github.com/Endermanch/MalwareDatabase/blob/master/ransomwares/NoMoreRansom.zip?raw=true" | C:\Program Files\Google\Chrome\Application\chrome.exe | Explorer.EXE | |
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 3221225547 Version: 86.0.4240.198 | ||||
| 3508 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=86.0.4240.198 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x6e7ed988,0x6e7ed998,0x6e7ed9a4 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 | ||||
| 4044 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1040,8965102213299568019,9844806936835758437,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgACAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1056 /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 | ||||
| 4084 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1040,8965102213299568019,9844806936835758437,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1320 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe | |
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 | ||||
| 2408 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,8965102213299568019,9844806936835758437,131072 --enable-features=PasswordImport --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1612 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 | ||||
| 2188 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,8965102213299568019,9844806936835758437,131072 --enable-features=PasswordImport --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1864 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 | ||||
| 2852 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,8965102213299568019,9844806936835758437,131072 --enable-features=PasswordImport --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2168 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 | ||||
| 416 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1040,8965102213299568019,9844806936835758437,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgACAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1072 /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 | ||||
| 1780 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1040,8965102213299568019,9844806936835758437,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 | ||||
| 3500 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1040,8965102213299568019,9844806936835758437,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3320 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe |
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 | ||||
Total events
17 687
Read events
17 535
Write events
150
Delete events
2
Modification events
| (PID) Process: | (2396) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (2396) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
| (PID) Process: | (2396) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: | |||
| (PID) Process: | (2396) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: 01000000 | |||
| (PID) Process: | (2396) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 1 | |||
| (PID) Process: | (2396) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
| Operation: | write | Name: | dr |
Value: 1 | |||
| (PID) Process: | (2396) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome |
| Operation: | write | Name: | UsageStatsInSample |
Value: 0 | |||
| (PID) Process: | (2396) chrome.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96} |
| Operation: | write | Name: | usagestats |
Value: 0 | |||
| (PID) Process: | (2396) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
| Operation: | write | Name: | metricsid |
Value: | |||
| (PID) Process: | (2396) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
| Operation: | write | Name: | metricsid_installdate |
Value: 0 | |||
Executable files
2
Suspicious files
1 468
Text files
160
Unknown types
58
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2396 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-61EF602B-95C.pma | — | |
MD5:— | SHA256:— | |||
| 2396 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Preferences | text | |
MD5:56C77375B12AFCCF20E7A2BCE9D604C3 | SHA256:D7E4996482C76FE8155DABAEFECBBE7138E6D9F8BAC0DF512065C46B7DDA15C7 | |||
| 2396 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\b5cb2a09-53ba-4aed-ba25-44e6f5dd738a.tmp | text | |
MD5:56C77375B12AFCCF20E7A2BCE9D604C3 | SHA256:D7E4996482C76FE8155DABAEFECBBE7138E6D9F8BAC0DF512065C46B7DDA15C7 | |||
| 3508 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics.pma | binary | |
MD5:03C4F648043A88675A920425D824E1B3 | SHA256:F91DBB7C64B4582F529C968C480D2DCE1C8727390482F31E4355A27BB3D9B450 | |||
| 2396 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old | text | |
MD5:8FF312A95D60ED89857FEB720D80D4E1 | SHA256:946A57FAFDD28C3164D5AB8AB4971B21BD5EC5BFFF7554DBF832CB58CC37700B | |||
| 2396 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.old~RF1132e4.TMP | text | |
MD5:B628564B8042F6E2CC2F53710AAECDC0 | SHA256:1D3B022BDEE9F48D79E3EC1E93F519036003642D3D72D10B05CFD47F43EFBF13 | |||
| 2396 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Last Version | text | |
MD5:00046F773EFDD3C8F8F6D0F87A2B93DC | SHA256:593EDE11D17AF7F016828068BCA2E93CF240417563FB06DC8A579110AEF81731 | |||
| 2396 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old | text | |
MD5:7721CDA9F5B73CE8A135471EB53B4E0E | SHA256:DD730C576766A46FFC84E682123248ECE1FF1887EC0ACAB22A5CE93A450F4500 | |||
| 2396 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\pkedcjkdefgpdelpbcmbmeomcjbeemfm\LOG.old | text | |
MD5:5202CA4D6AF0C37DAEC0D528CC7F2986 | SHA256:8F5B8FF94B14C36EA0CBE8FA0A4D165A632B45F834BBB7239E1A6CF6685F256C | |||
| 2396 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\LOG.old~RF113303.TMP | text | |
MD5:109A25C32EE1132ECD6D9F3ED9ADF01A | SHA256:DA6028DB9485C65E683643658326F02B1D0A1566DE14914EF28E5248EB94F0DD | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
26
DNS requests
13
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4084 | chrome.exe | 142.250.186.35:443 | ssl.gstatic.com | Google Inc. | US | whitelisted |
4084 | chrome.exe | 142.250.186.142:443 | sb-ssl.google.com | Google Inc. | US | whitelisted |
1348 | chrome.exe | 142.250.186.100:443 | www.google.com | Google Inc. | US | whitelisted |
4084 | chrome.exe | 185.199.108.133:443 | raw.githubusercontent.com | GitHub, Inc. | NL | malicious |
4084 | chrome.exe | 142.250.186.77:443 | accounts.google.com | Google Inc. | US | suspicious |
1348 | chrome.exe | 142.250.185.67:443 | clientservices.googleapis.com | Google Inc. | US | whitelisted |
1908 | 86.59.21.38:443 | — | Tele2 Telecommunication GmbH | AT | malicious | |
4084 | chrome.exe | 142.250.179.142:443 | clients2.google.com | Google Inc. | US | whitelisted |
1908 | 109.105.109.162:60784 | — | NORDUnet | SE | suspicious | |
4084 | chrome.exe | 140.82.121.4:443 | github.com | — | US | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
clients2.google.com |
| whitelisted |
accounts.google.com |
| shared |
github.com |
| shared |
raw.githubusercontent.com |
| shared |
sb-ssl.google.com |
| whitelisted |
ssl.gstatic.com |
| whitelisted |
clientservices.googleapis.com |
| whitelisted |
www.google.com |
| whitelisted |
fonts.googleapis.com |
| whitelisted |
www.gstatic.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
1908 | Misc Attack | ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 295 | |
1908 | Misc activity | ET POLICY TLS possible TOR SSL traffic | |
1908 | Misc Attack | ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 870 | |
1908 | Misc Attack | ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 265 | |
1908 | Misc Attack | ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 919 | |
1908 | Misc Attack | ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 201 | |
1908 | Misc activity | ET POLICY TLS possible TOR SSL traffic | |
1908 | Misc activity | ET POLICY TLS possible TOR SSL traffic | |
1908 | Misc activity | ET POLICY TLS possible TOR SSL traffic |