File name:

AntiRecuvaDB.exe

Full analysis: https://app.any.run/tasks/20a7858e-4486-4c9f-9136-b995257fadc9
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Analysis date: January 05, 2024, 13:04:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

34590105AD4B09C19F1646A61265BF2D

SHA1:

0C73200795B175D04673DEC8844C0B1D8FB434C1

SHA256:

7B3A46605B831ACEDD7DE5FA78C4145C8D052BDDE3693ABE8D8319CB80CD365B

SSDEEP:

1536:RymNrLwC/WPYQ3CUXekpkAUcPSBr71xffe/XRXQ:Rymdw49Q3te0HUcqBrBx2XV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Create files in the Startup directory

      • AntiRecuvaDB.exe (PID: 2016)
    • Changes the autorun value in the registry

      • AntiRecuvaDB.exe (PID: 2044)
    • Using BCDEDIT.EXE to modify recovery options

      • cmd.exe (PID: 268)
    • Renames files like ransomware

      • AntiRecuvaDB.exe (PID: 2016)
    • Deletes shadow copies

      • cmd.exe (PID: 268)
    • Actions looks like stealing of personal data

      • AntiRecuvaDB.exe (PID: 2016)
  • SUSPICIOUS

    • Uses NETSH.EXE to change the status of the firewall

      • cmd.exe (PID: 668)
    • Reads browser cookies

      • AntiRecuvaDB.exe (PID: 2016)
    • Reads the Internet Settings

      • AntiRecuvaDB.exe (PID: 2036)
      • WMIC.exe (PID: 452)
    • Starts CMD.EXE for commands execution

      • AntiRecuvaDB.exe (PID: 2016)
    • Write to the desktop.ini file (may be used to cloak folders)

      • AntiRecuvaDB.exe (PID: 2016)
  • INFO

    • Drops the executable file immediately after the start

      • AntiRecuvaDB.exe (PID: 2044)
      • AntiRecuvaDB.exe (PID: 2016)
    • Reads the computer name

      • AntiRecuvaDB.exe (PID: 2036)
      • AntiRecuvaDB.exe (PID: 2016)
      • AntiRecuvaDB.exe (PID: 2044)
    • Application launched itself

      • AntiRecuvaDB.exe (PID: 2036)
      • AntiRecuvaDB.exe (PID: 2044)
    • Checks supported languages

      • AntiRecuvaDB.exe (PID: 2016)
      • AntiRecuvaDB.exe (PID: 2044)
      • AntiRecuvaDB.exe (PID: 2036)
    • Executes as Windows Service

      • VSSVC.exe (PID: 1576)
      • wbengine.exe (PID: 1268)
      • vds.exe (PID: 2292)
    • Creates files in the program directory

      • AntiRecuvaDB.exe (PID: 2016)
    • Creates files or folders in the user directory

      • AntiRecuvaDB.exe (PID: 2016)
    • Process drops legitimate windows executable

      • AntiRecuvaDB.exe (PID: 2016)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:03:31 16:17:25+02:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 34304
InitializedDataSize: 15872
UninitializedDataSize: -
EntryPoint: 0x2fa7
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
56
Monitored processes
16
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start antirecuvadb.exe antirecuvadb.exe no specs antirecuvadb.exe cmd.exe no specs cmd.exe no specs vssadmin.exe no specs netsh.exe no specs vssvc.exe no specs netsh.exe no specs wmic.exe no specs bcdedit.exe no specs bcdedit.exe no specs wbadmin.exe no specs wbengine.exe no specs vdsldr.exe no specs vds.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
268"C:\Windows\system32\cmd.exe"C:\Windows\System32\cmd.exeAntiRecuvaDB.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
452wmic shadowcopy deleteC:\Windows\System32\wbem\WMIC.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
668"C:\Windows\system32\cmd.exe"C:\Windows\System32\cmd.exeAntiRecuvaDB.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1236netsh advfirewall set currentprofile state offC:\Windows\System32\netsh.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1268"C:\Windows\system32\wbengine.exe"C:\Windows\System32\wbengine.exeservices.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Block Level Backup Engine Service EXE
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbengine.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1316vssadmin delete shadows /all /quietC:\Windows\System32\vssadmin.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1576C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exeservices.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2016"C:\Users\admin\AppData\Local\Temp\AntiRecuvaDB.exe" C:\Users\admin\AppData\Local\Temp\AntiRecuvaDB.exe
AntiRecuvaDB.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\antirecuvadb.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
2036C:\Users\admin\AppData\Local\Temp\AntiRecuvaDB.exeC:\Users\admin\AppData\Local\Temp\AntiRecuvaDB.exeAntiRecuvaDB.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\antirecuvadb.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
2044"C:\Users\admin\AppData\Local\Temp\AntiRecuvaDB.exe" C:\Users\admin\AppData\Local\Temp\AntiRecuvaDB.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\antirecuvadb.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
Total events
2 139
Read events
2 036
Write events
103
Delete events
0

Modification events

(PID) Process:(2036) AntiRecuvaDB.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2036) AntiRecuvaDB.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2036) AntiRecuvaDB.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2036) AntiRecuvaDB.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1236) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2168) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2044) AntiRecuvaDB.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:AntiRecuvaDB
Value:
C:\Users\admin\AppData\Local\AntiRecuvaDB.exe
(PID) Process:(2044) AntiRecuvaDB.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:AntiRecuvaDB
Value:
C:\Users\admin\AppData\Local\AntiRecuvaDB.exe
(PID) Process:(2568) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{345b46fd-a9f9-11e7-a83c-e8a4f72b1d33}\Elements\16000009
Operation:writeName:Element
Value:
01
Executable files
87
Suspicious files
902
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2016AntiRecuvaDB.exeC:\MSOCache\All Users\{90140000-0015-0407-0000-0000000FF1CE}-C\AccLR.cab.id[C4BA3647-3511].[[email protected]].jopanaxye
MD5:
SHA256:
2016AntiRecuvaDB.exeC:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-500\desktop.ini.id[C4BA3647-3511].[[email protected]].jopanaxyebinary
MD5:86CFD046FF43E45BC7A5359BCA156130
SHA256:C9C2A71BB808D7630B803FA18E0699D2293A1C9D20452530F86D34A070EF4427
2016AntiRecuvaDB.exeC:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\AntiRecuvaDB.exeexecutable
MD5:34590105AD4B09C19F1646A61265BF2D
SHA256:7B3A46605B831ACEDD7DE5FA78C4145C8D052BDDE3693ABE8D8319CB80CD365B
2016AntiRecuvaDB.exeC:\MSOCache\All Users\{90140000-0015-040C-0000-0000000FF1CE}-C\AccLR.cab.id[C4BA3647-3511].[[email protected]].jopanaxye
MD5:
SHA256:
2016AntiRecuvaDB.exeC:\MSOCache\All Users\{90140000-0015-0407-0000-0000000FF1CE}-C\AccessMUI.xmlbinary
MD5:278E85328AD89ECA970B57B7B6F49A7E
SHA256:0B1415236F8FFDA94E2BE983D68E4D6173588BD429FB48907E9264BD0EE1C604
2016AntiRecuvaDB.exeC:\MSOCache\All Users\{90140000-0015-0407-0000-0000000FF1CE}-C\AccessMUI.msi.id[C4BA3647-3511].[[email protected]].jopanaxyeexecutable
MD5:B68BD80A5A3B703BABC7FB19BAF104AB
SHA256:1CB1E08D560E9E6C62A7E48680A218D022F0D331EB52F3CE66504A167FAD652F
2016AntiRecuvaDB.exeC:\MSOCache\All Users\{90140000-0015-0407-0000-0000000FF1CE}-C\Setup.xmlbinary
MD5:84394A82FD108DA0EC5311D1924F4DE4
SHA256:382E008E5BC647359ED6F41CB932F732B000A96C6048EDD3CAE85E65DF04C175
2016AntiRecuvaDB.exeC:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\desktop.inibinary
MD5:5F54D1240735D46980B776AF554F44D3
SHA256:2C80619D7E7C58257293CDA3A878C13E5856F4E06F6F90601276F7B9179C9E07
2016AntiRecuvaDB.exeC:\autoexec.batbinary
MD5:1681FFC6E046C7AF98C9E6C232A3FE0A
SHA256:9D908ECFB6B256DEF8B49A7C504E6C889C4B0E41FE6CE3E01863DD7B61A20AA0
2016AntiRecuvaDB.exeC:\MSOCache\All Users\{90140000-0015-040C-0000-0000000FF1CE}-C\AccessMUI.xml.id[C4BA3647-3511].[[email protected]].jopanaxyebinary
MD5:BE73B53C169766EA3F85A2EE91E3A6E1
SHA256:06255305F784671D49C705F449A7A3474A1838572170695E9D2E1F2FEA98763B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
unknown
4
System
192.168.100.255:138
unknown

DNS requests

No data

Threats

No threats detected
No debug info