analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.bin.gz

Full analysis: https://app.any.run/tasks/de956cf3-2a6e-44f1-8a88-8ebc4cbbb6b4
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: September 11, 2019, 10:09:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
Indicators:
MIME: application/gzip
File info: gzip compressed data, max compression, from Unix
MD5:

076F6F0671412893965F3E1353591A71

SHA1:

0B1ABAE89888D2464C4424C8F20238C3D2CA6948

SHA256:

8E80EE0259F7090BE58DA5D74178D56C4195620ECC4609D9873218727F70D918

SSDEEP:

1536:8SdsHV1rsrYxLYxaK8rRx8gvnqZnqyvNNTLxcvctdKH+f:9aarY1YA8gfGnrNNTLxuaGo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exe (PID: 3940)
      • 19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exe (PID: 3544)
      • 19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exe (PID: 2440)

    • Changes the autorun value in the registry

      • 19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exe (PID: 3544)
      • 19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exe (PID: 3940)

    • Writes to a start menu file

      • 19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exe (PID: 3544)
      • 19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exe (PID: 3940)

    • Runs app for hidden code execution

      • 19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exe (PID: 3940)

    • Turns off the firewall via NETSH.EXE

      • cmd.exe (PID: 2700)

    • Actions looks like stealing of personal data

      • 19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exe (PID: 3940)

    • Renames files like Ransomware

      • 19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exe (PID: 3940)

    • Modifies files in Chrome extension folder

      • 19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exe (PID: 3940)

  • SUSPICIOUS

    • Application launched itself

      • 19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exe (PID: 3544)
      • 19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exe (PID: 2440)

    • Creates files in the user directory

      • 19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exe (PID: 3544)
      • 19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exe (PID: 3940)

    • Executable content was dropped or overwritten

      • 19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exe (PID: 3544)
      • 19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exe (PID: 3940)

    • Starts CMD.EXE for commands execution

      • 19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exe (PID: 3940)

    • Uses NETSH.EXE for network configuration

      • cmd.exe (PID: 2700)

    • Reads the cookies of Mozilla Firefox

      • 19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exe (PID: 3940)

    • Reads the cookies of Google Chrome

      • 19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exe (PID: 3940)

    • Creates files in the program directory

      • 19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exe (PID: 3544)
      • 19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exe (PID: 3940)

  • INFO

    • Manual execution by user

      • 19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exe (PID: 3544)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.z/gz/gzip | GZipped data (100)

EXIF

ZIP

OperatingSystem: Unix
ExtraFlags: Maximum Compression
ModifyDate: 0000:00:00 00:00:00
Flags: (none)
Compression: Deflated
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
7
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start winrar.exe no specs 19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exe 19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exe no specs 19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exe cmd.exe no specs netsh.exe no specs netsh.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2944"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.bin.gz"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3544"C:\Users\admin\Desktop\19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exe" C:\Users\admin\Desktop\19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
2440C:\Users\admin\Desktop\19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exeC:\Users\admin\Desktop\19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exe—19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3940"C:\Users\admin\Desktop\19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exe" C:\Users\admin\Desktop\19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exe
19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exe
User:
admin
Integrity Level:
HIGH
2700"C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe—19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2260netsh advfirewall set currentprofile state offC:\Windows\system32\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3348netsh firewall set opmode mode=disableC:\Windows\system32\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
465
Read events
349
Write events
116
Delete events
0

Modification events

(PID) Process:(2944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2944) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\72\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.bin.gz
(PID) Process:(2944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2440) 19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2440) 19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
4
Suspicious files
1 042
Text files
4
Unknown types
53

Dropped files

PID
Process
Filename
Type
2944WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2944.8083\19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.bin —
MD5:—
SHA256:—
354419c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exeC:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exeexecutable
MD5:3C1F8811F2BED2B0737DA5CDBE5BEED1
SHA256:19C75381A91F336B6B8CA34AC5502D4A72709354B9F151175720184A1AA25116
354419c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exeC:\Users\admin\AppData\Local\19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exeexecutable
MD5:3C1F8811F2BED2B0737DA5CDBE5BEED1
SHA256:19C75381A91F336B6B8CA34AC5502D4A72709354B9F151175720184A1AA25116
354419c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat Reader DC\Reader\AcroApp\CAT\Combine_R_RHP.aapp.id[C4BA3647-2252].[[email protected]].adagebinary
MD5:57DAA6776F9C5309B099B127CC6ACA62
SHA256:6AA432DE7BBCA85D5025DDFA9A4628689E32AC75BBF6427753C23321D7BF9E2B
354419c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf.id[C4BA3647-2252].[[email protected]].adagebinary
MD5:90E0674AD337ED0A0D5903FE0FEB8F27
SHA256:61916AD5C4A088CCA63E4F9FA2B5296D854B976584201905C5596EB05D1C3DCA
354419c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat Reader DC\Benioku.htm.id[C4BA3647-2252].[[email protected]].adagebinary
MD5:14E80BB50FE9A7E5CDD765C247DC7150
SHA256:B51A1DB711D16FCA5FFAD28E4A7B31A44A90DEA1806FC1F5464CFD236E56EC22
354419c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat Reader DC\LeiaMe.htm.id[C4BA3647-2252].[[email protected]].adagebinary
MD5:DA14C76D71BD5BA7C2706EBF3BFAB988
SHA256:4A0596DFBD5ECC0D3660B843D6F595AD3B8E63BA9C3A57149011D90958D9FCD8
354419c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat Reader DC\Llegiu-me.htm.id[C4BA3647-2252].[[email protected]].adagebinary
MD5:676ABC1460A5CD96EE902BD535873582
SHA256:2EB89F204F8BD56A3FED414AD9D5ACE526610D9B9A8705183D682BF313ECEA2C
354419c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat Reader DC\LeesMij.htm.id[C4BA3647-2252].[[email protected]].adagebinary
MD5:7E026D7543A350693644F51412CA8216
SHA256:D9039DF7212FB1B37D703A2630EF8023552837B814F61D066F762054D63FAF27
354419c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat Reader DC\IrakHau.htm.id[C4BA3647-2252].[[email protected]].adagebinary
MD5:A6E8DC82163BD2F2FC1B2F3FB31A2337
SHA256:8B827A47ECB5FC99572BF1515424928974B7FE3D0C9C6833F02A11D335A9C734
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
19c75381a91f336b6b8ca34ac5502d4a72709354b9f151175720184a1aa25116.bin.gz