File name:

GandCrab 5.0.3 downloader.js

Full analysis: https://app.any.run/tasks/5c1bed7b-40e0-4619-b6a5-5cc89a754c27
Verdict: Malicious activity
Threats:

GandCrab is probably one of the most famous Ransomware. A Ransomware is a malware that asks the victim to pay money in order to restore access to encrypted files. If the user does not cooperate the files are forever lost.

Malware Trends Tracker     >>>
Analysis date: October 10, 2018, 10:13:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
gandcrab
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines, with CRLF line terminators
MD5:

595A31A4913951D3EB7211618AE75DEA

SHA1:

16DBFE657AC36A8D84AF411F13EBFF1CCC5E56AD

SHA256:

BE6A4997FDF6EA0D74A973AE0A361EBCC4CBBC74A5801E75A76BB52A2B424E34

SSDEEP:

12288:lNelh1RLsMUu8HRCTEr45VYYtkG8eAVIsNOd:lNelh1RLsMUu8HRCR3UeAVIsNs

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • dsoyaltj.exe (PID: 3420)

    • Dropped file may contain instructions of ransomware

      • wermgr.exe (PID: 2772)

    • GandCrab keys found

      • wermgr.exe (PID: 2772)

    • Actions looks like stealing of personal data

      • wermgr.exe (PID: 2772)

    • Writes file to Word startup folder

      • wermgr.exe (PID: 2772)

    • Renames files like Ransomware

      • wermgr.exe (PID: 2772)

    • Deletes shadow copies

      • wermgr.exe (PID: 2772)

  • SUSPICIOUS

    • Creates files like Ransomware instruction

      • wermgr.exe (PID: 2772)

    • Executable content was dropped or overwritten

      • WScript.exe (PID: 2816)

    • Starts CMD.EXE for commands execution

      • wermgr.exe (PID: 2772)

    • Reads Internet Cache Settings

      • wermgr.exe (PID: 2772)

    • Creates files in the user directory

      • wermgr.exe (PID: 2772)

  • INFO

    • Dropped object may contain TOR URL's

      • wermgr.exe (PID: 2772)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start wscript.exe dsoyaltj.exe no specs #GANDCRAB wermgr.exe wmic.exe no specs cmd.exe no specs timeout.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2816"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\GandCrab 5.0.3 downloader.js"C:\Windows\System32\WScript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3420"C:\Users\admin\dsoyaltj.exe" C:\Users\admin\dsoyaltj.exe—WScript.exe
User:
admin
Company:
www.sopcast.com
Integrity Level:
MEDIUM
Description:
SopCast Main Application
Exit code:
0
Version:
4.2.0.800
2772"C:\Windows\System32\wermgr.exe"C:\Windows\System32\wermgr.exe
dsoyaltj.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
116"C:\Windows\system32\wbem\wmic.exe" shadowcopy deleteC:\Windows\system32\wbem\wmic.exe—wermgr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
2147749908
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3432"C:\Windows\System32\cmd.exe" /c timeout -c 5 & del "C:\Windows\System32\wermgr.exe" /f /qC:\Windows\System32\cmd.exe—wermgr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3888timeout -c 5 C:\Windows\system32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
568
Read events
533
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
265
Text files
221
Unknown types
10

Dropped files

PID
Process
Filename
Type
3420dsoyaltj.exeC:\Users\admin\AppData\Local\Temp\Liebert.bmp —
MD5:—
SHA256:—
2772wermgr.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamp —
MD5:—
SHA256:—
2772wermgr.exeC:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData —
MD5:—
SHA256:—
2772wermgr.exeC:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings —
MD5:—
SHA256:—
2772wermgr.exeC:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata —
MD5:—
SHA256:—
2772wermgr.exeC:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl —
MD5:—
SHA256:—
2772wermgr.exeC:\Users\admin\AppData\Roaming\Adobe\XHAUN-DECRYPT.txttext
MD5:7D10EC9B55C69E9C43B68C98D05025DE
SHA256:BACAC2216C222B7D430760FE0F54A7A864FCC6097B184D199C1B0418ABF9C8D8
2772wermgr.exeC:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\XHAUN-DECRYPT.txttext
MD5:7D10EC9B55C69E9C43B68C98D05025DE
SHA256:BACAC2216C222B7D430760FE0F54A7A864FCC6097B184D199C1B0418ABF9C8D8
2772wermgr.exeC:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\XHAUN-DECRYPT.txttext
MD5:7D10EC9B55C69E9C43B68C98D05025DE
SHA256:BACAC2216C222B7D430760FE0F54A7A864FCC6097B184D199C1B0418ABF9C8D8
2772wermgr.exeC:\Users\admin\AppData\XHAUN-DECRYPT.txttext
MD5:7D10EC9B55C69E9C43B68C98D05025DE
SHA256:BACAC2216C222B7D430760FE0F54A7A864FCC6097B184D199C1B0418ABF9C8D8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
127
TCP/UDP connections
119
DNS requests
110
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2772
wermgr.exe
POST
—
212.59.186.61:443
https://www.hotelweisshorn.com/includes/pics/kemezumo.jpg
CH
—
—
malicious
2772
wermgr.exe
POST
404
192.185.159.253:443
https://www.pizcam.com/wp-content/tmp/sodake.jpg
US
html
22.7 Kb
malicious
2772
wermgr.exe
POST
404
217.26.53.161:443
https://www.haargenau.biz/content/assets/soamzukamo.png
CH
xml
981 b
malicious
2772
wermgr.exe
POST
404
104.24.23.22:443
https://www.belvedere-locarno.com/wp-content/images/keesdekemo.jpg
US
html
16.1 Kb
malicious
2772
wermgr.exe
POST
404
217.26.55.5:443
https://www.aubergemontblanc.com/news/pics/fumoke.bmp
CH
xml
988 b
malicious
2772
wermgr.exe
POST
404
74.220.215.73:443
https://www.bizziniinfissi.com/content/image/sethmoso.png
US
html
2.61 Kb
malicious
2772
wermgr.exe
POST
510
136.243.13.215:443
https://www.holzbock.biz/data/images/sezu.png
DE
html
740 b
malicious
2772
wermgr.exe
POST
—
212.59.186.61:443
https://www.morcote-residenza.com/news/pictures/sekazu.png
CH
—
—
malicious
2772
wermgr.exe
POST
510
78.46.98.73:443
https://www.2mmotorsport.biz/content/imgs/imzuim.gif
DE
html
757 b
malicious
2772
wermgr.exe
POST
404
80.244.187.247:443
https://www.hotelfarinet.com/content/pictures/darues.png
GB
html
20.1 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2772
wermgr.exe
217.26.53.37:443
www.hrk-ramoz.com
Hostpoint AG
CH
malicious
2772
wermgr.exe
136.243.13.215:443
www.holzbock.biz
Hetzner Online GmbH
DE
suspicious
2772
wermgr.exe
78.46.98.73:443
www.2mmotorsport.biz
Hetzner Online GmbH
DE
unknown
2772
wermgr.exe
46.30.45.85:443
www.fliptray.biz
Webzilla B.V.
RU
suspicious
2772
wermgr.exe
93.88.241.198:443
www.torhotel.com
Infomaniak Network SA
CH
malicious
2772
wermgr.exe
104.24.23.22:443
www.belvedere-locarno.com
Cloudflare Inc
US
shared
2772
wermgr.exe
192.185.159.253:443
www.pizcam.com
CyrusOne LLC
US
malicious
2772
wermgr.exe
83.138.82.107:443
www.swisswellness.com
hostNET Medien GmbH
DE
suspicious
2772
wermgr.exe
217.26.55.5:443
www.aubergemontblanc.com
Hostpoint AG
CH
malicious
2772
wermgr.exe
217.26.53.161:443
www.haargenau.biz
Hostpoint AG
CH
malicious

DNS requests

Domain
IP
Reputation
www.2mmotorsport.biz
  • 78.46.98.73
malicious
www.haargenau.biz
  • 217.26.53.161
malicious
www.bizziniinfissi.com
  • 74.220.215.73
malicious
www.holzbock.biz
  • 136.243.13.215
malicious
www.fliptray.biz
  • 46.30.45.85
malicious
www.pizcam.com
  • 192.185.159.253
malicious
www.swisswellness.com
  • 83.138.82.107
whitelisted
www.hotelweisshorn.com
  • 212.59.186.61
malicious
www.whitepod.com
  • 83.166.138.7
whitelisted
www.hardrockhoteldavos.com
  • 69.16.175.10
  • 69.16.175.42
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2023 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
GandCrab 5.0.3 downloader.js