File name: | GCv5.2.zip |
Full analysis: | https://app.any.run/tasks/8679a172-db58-43e4-b4f1-77757c1603a8 |
Verdict: | Malicious activity |
Threats: | GandCrab is probably one of the most famous Ransomware. A Ransomware is a malware that asks the victim to pay money in order to restore access to encrypted files. If the user does not cooperate the files are forever lost. |
Analysis date: | July 16, 2019, 22:33:53 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | C61E0472DEAE85F11D904187064B3AF1 |
SHA1: | A52A841D0748A461B1F081C84DAD1F2B3D6857D6 |
SHA256: | 9321C8C7A08B90E9DD0FB7991BCDFE95B088EFF60E2FB0268411373DC5AB6243 |
SSDEEP: | 12288:PyNjzZYSdQjaAYBmmkFBOfTM9ooAbAxn3Cd:P2jzZtdAYreOL0ZRQ |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | New folder/33.bat |
---|---|
ZipUncompressedSize: | 27216000 |
ZipCompressedSize: | 66064 |
ZipCRC: | 0x9c2a6d3d |
ZipModifyDate: | 2019:02:28 04:42:15 |
ZipCompression: | Deflated |
ZipBitFlag: | - |
ZipRequiredVersion: | 20 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2848 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\GCv5.2.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
3044 | "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Rar$DIa2848.46073\c2.zip | C:\Program Files\WinRAR\WinRAR.exe | WinRAR.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
1864 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa3044.46849\c2.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa3044.46849\c2.exe | WinRAR.exe | |
User: admin Integrity Level: MEDIUM | ||||
124 | C:\Windows\Explorer.EXE | C:\Windows\explorer.exe | — | — |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2136 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1302019708-1500728564-335382590-10009_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1302019708-1500728564-335382590-10009 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1" | C:\Windows\system32\SearchProtocolHost.exe | — | SearchIndexer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Windows Search Protocol Host Version: 7.00.7600.16385 (win7_rtm.090713-1255) | ||||
1868 | C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} | C:\Windows\system32\DllHost.exe | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2096 | "C:\Windows\system32\wbem\wmic.exe" shadowcopy delete | C:\Windows\system32\wbem\wmic.exe | c2.exe | |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: WMI Commandline Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3552 | C:\Windows\system32\vssvc.exe | C:\Windows\system32\vssvc.exe | — | services.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft® Volume Shadow Copy Service Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1948 | taskeng.exe {5D27F6D9-1489-4C63-9AA3-61A9E7172AB6} | C:\Windows\System32\taskeng.exe | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Task Scheduler Engine Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1988 | "C:\Windows\system32\Dwm.exe" | C:\Windows\System32\dwm.exe | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Desktop Window Manager Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
1864 | c2.exe | C:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\boot.sdi | — | |
MD5:— | SHA256:— | |||
1864 | c2.exe | C:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\Winre.wim.qkowwdz | — | |
MD5:— | SHA256:— | |||
1864 | c2.exe | C:\System Volume Information\SPP\OnlineMetadataCache\{05ed3515-06b3-48f6-8cf2-bf24b1bf0727}_OnDiskSnapshotProp | — | |
MD5:— | SHA256:— | |||
1864 | c2.exe | C:\Users\QKOWWDZ-MANUAL.txt | text | |
MD5:78EC1A0A88B8076D08EA3E6556E58D42 | SHA256:6F50CC822985526CA7DF084722A23A12BEE795783C0A62A7EC3C9397421AA652 | |||
1864 | c2.exe | C:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\Winre.wim | — | |
MD5:— | SHA256:— | |||
1864 | c2.exe | C:\System Volume Information\SPP\OnlineMetadataCache\{14e6e058-39ee-43ce-ac15-7acb7d834dae}_OnDiskSnapshotProp | — | |
MD5:— | SHA256:— | |||
1864 | c2.exe | C:\System Volume Information\SPP\QKOWWDZ-MANUAL.txt | text | |
MD5:78EC1A0A88B8076D08EA3E6556E58D42 | SHA256:6F50CC822985526CA7DF084722A23A12BEE795783C0A62A7EC3C9397421AA652 | |||
1864 | c2.exe | C:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\QKOWWDZ-MANUAL.txt | text | |
MD5:78EC1A0A88B8076D08EA3E6556E58D42 | SHA256:6F50CC822985526CA7DF084722A23A12BEE795783C0A62A7EC3C9397421AA652 | |||
1864 | c2.exe | C:\Config.Msi\QKOWWDZ-MANUAL.txt | text | |
MD5:78EC1A0A88B8076D08EA3E6556E58D42 | SHA256:6F50CC822985526CA7DF084722A23A12BEE795783C0A62A7EC3C9397421AA652 | |||
1864 | c2.exe | C:\PerfLogs\QKOWWDZ-MANUAL.txt | text | |
MD5:78EC1A0A88B8076D08EA3E6556E58D42 | SHA256:6F50CC822985526CA7DF084722A23A12BEE795783C0A62A7EC3C9397421AA652 |
Domain | IP | Reputation |
---|---|---|
www.kakaocorp.link |
| malicious |