analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

GandCrab 5.0.3 downloader.js

Full analysis: https://app.any.run/tasks/e39a3493-8474-4540-ad51-7ce71a933caa
Verdict: Malicious activity
Threats:

GandCrab is probably one of the most famous Ransomware. A Ransomware is a malware that asks the victim to pay money in order to restore access to encrypted files. If the user does not cooperate the files are forever lost.

Malware Trends Tracker     >>>
Analysis date: May 24, 2019, 13:03:41
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
gandcrab
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines, with CRLF line terminators
MD5:

595A31A4913951D3EB7211618AE75DEA

SHA1:

16DBFE657AC36A8D84AF411F13EBFF1CCC5E56AD

SHA256:

BE6A4997FDF6EA0D74A973AE0A361EBCC4CBBC74A5801E75A76BB52A2B424E34

SSDEEP:

12288:lNelh1RLsMUu8HRCTEr45VYYtkG8eAVIsNOd:lNelh1RLsMUu8HRCR3UeAVIsNs

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • dsoyaltj.exe (PID: 2844)

    • GandCrab keys found

      • wermgr.exe (PID: 3612)

    • Writes file to Word startup folder

      • wermgr.exe (PID: 3612)

    • Dropped file may contain instructions of ransomware

      • wermgr.exe (PID: 3612)

    • Actions looks like stealing of personal data

      • wermgr.exe (PID: 3612)

    • Renames files like Ransomware

      • wermgr.exe (PID: 3612)

    • Deletes shadow copies

      • wermgr.exe (PID: 3612)

    • GANDCRAB detected

      • wermgr.exe (PID: 3612)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WScript.exe (PID: 2716)

    • Reads the cookies of Mozilla Firefox

      • wermgr.exe (PID: 3612)

    • Creates files like Ransomware instruction

      • wermgr.exe (PID: 3612)

    • Creates files in the user directory

      • wermgr.exe (PID: 3612)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • wermgr.exe (PID: 3612)

    • Dropped object may contain TOR URL's

      • wermgr.exe (PID: 3612)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start wscript.exe dsoyaltj.exe no specs #GANDCRAB wermgr.exe wmic.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2716"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\GandCrab 5.0.3 downloader.js"C:\Windows\System32\WScript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2844"C:\Users\admin\dsoyaltj.exe" C:\Users\admin\dsoyaltj.exe—WScript.exe
User:
admin
Company:
www.sopcast.com
Integrity Level:
MEDIUM
Description:
SopCast Main Application
Exit code:
0
Version:
4.2.0.800
3612"C:\Windows\System32\wermgr.exe"C:\Windows\System32\wermgr.exe
dsoyaltj.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2108"C:\Windows\system32\wbem\wmic.exe" shadowcopy deleteC:\Windows\system32\wbem\wmic.exe—wermgr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
2147749908
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
508
Read events
473
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
278
Text files
203
Unknown types
8

Dropped files

PID
Process
Filename
Type
2844dsoyaltj.exeC:\Users\admin\AppData\Local\Temp\Liebert.bmp —
MD5:—
SHA256:—
3612wermgr.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamp —
MD5:—
SHA256:—
3612wermgr.exeC:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData —
MD5:—
SHA256:—
3612wermgr.exeC:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings —
MD5:—
SHA256:—
3612wermgr.exeC:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata —
MD5:—
SHA256:—
3612wermgr.exeC:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl —
MD5:—
SHA256:—
3612wermgr.exeC:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl —
MD5:—
SHA256:—
3612wermgr.exeC:\Users\admin\.oracle_jre_usage\QARXII-DECRYPT.txttext
MD5:34169F8BC44BA939E7FFB33AC71CD1FE
SHA256:89A3BB0CF25D04B8C9A2526889ECA9EEE25F9B9F2A22FC742E938F39AF019A52
3612wermgr.exeC:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\QARXII-DECRYPT.txttext
MD5:34169F8BC44BA939E7FFB33AC71CD1FE
SHA256:89A3BB0CF25D04B8C9A2526889ECA9EEE25F9B9F2A22FC742E938F39AF019A52
3612wermgr.exeC:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\QARXII-DECRYPT.txttext
MD5:34169F8BC44BA939E7FFB33AC71CD1FE
SHA256:89A3BB0CF25D04B8C9A2526889ECA9EEE25F9B9F2A22FC742E938F39AF019A52
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
10
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3612
wermgr.exe
GET
200
93.184.221.240:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
56.1 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3612
wermgr.exe
78.46.77.98:443
www.2mmotorsport.biz
Hetzner Online GmbH
DE
suspicious
3612
wermgr.exe
136.243.13.215:443
www.holzbock.biz
Hetzner Online GmbH
DE
suspicious
3612
wermgr.exe
74.220.199.8:443
www.bizziniinfissi.com
Unified Layer
US
malicious
3612
wermgr.exe
217.26.53.161:443
www.haargenau.biz
Hostpoint AG
CH
malicious
3612
wermgr.exe
93.184.221.240:80
www.download.windowsupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3612
wermgr.exe
185.52.2.154:443
www.fliptray.biz
RouteLabel V.O.F.
NL
suspicious
3612
wermgr.exe
192.185.159.253:443
www.pizcam.com
CyrusOne LLC
US
malicious

DNS requests

Domain
IP
Reputation
www.2mmotorsport.biz
  • 78.46.77.98
unknown
www.haargenau.biz
  • 217.26.53.161
unknown
www.bizziniinfissi.com
  • 74.220.199.8
malicious
www.download.windowsupdate.com
  • 93.184.221.240
whitelisted
www.holzbock.biz
  • 136.243.13.215
unknown
www.fliptray.biz
  • 185.52.2.154
malicious
www.pizcam.com
  • 192.185.159.253
unknown

Threats

PID
Process
Class
Message
3612
wermgr.exe
Potential Corporate Privacy Violation
ET POLICY Self Signed SSL Certificate (SomeOrganizationalUnit)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
GandCrab 5.0.3 downloader.js