File name:

GandCrab.exe

Full analysis: https://app.any.run/tasks/f9851327-2654-42b5-91b9-23b0d9ba5576
Verdict: Malicious activity
Threats:

GandCrab is probably one of the most famous Ransomware. A Ransomware is a malware that asks the victim to pay money in order to restore access to encrypted files. If the user does not cooperate the files are forever lost.

Malware Trends Tracker     >>>
Analysis date: May 16, 2025, 16:25:26
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
ransomware
gandcrab
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 9 sections
MD5:

E6B43B1028B6000009253344632E69C4

SHA1:

E536B70E3FFE309F7AE59918DA471D7BF4CADD1C

SHA256:

BFB9DB791B8250FFA8EBC48295C5DBBCA757A5ED3BBB01DE12A871B5CD9AFD5A

SSDEEP:

6144:nSRCSpUtLz+/enihebWBUOP3yIhLVMmi0CtG7go+Iq:SUOEnNnHbmP3yIE3tGXs

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GANDCRAB mutex has been found

      • GandCrab.exe (PID: 4896)

    • Writes a file to the Word startup folder

      • GandCrab.exe (PID: 4896)

    • RANSOMWARE has been detected

      • GandCrab.exe (PID: 4896)

  • SUSPICIOUS

    • Creates file in the systems drive root

      • GandCrab.exe (PID: 4896)

    • There is functionality for taking screenshot (YARA)

      • GandCrab.exe (PID: 4896)

  • INFO

    • Creates files or folders in the user directory

      • GandCrab.exe (PID: 4896)

    • Failed to create an executable file in Windows directory

      • GandCrab.exe (PID: 4896)

    • Reads the machine GUID from the registry

      • GandCrab.exe (PID: 4896)

    • Reads the computer name

      • GandCrab.exe (PID: 4896)

    • Checks supported languages

      • GandCrab.exe (PID: 4896)

    • Reads CPU info

      • GandCrab.exe (PID: 4896)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:04:28 17:40:56+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 129536
InitializedDataSize: 82364928
UninitializedDataSize: -
EntryPoint: 0x2cfb
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
126
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #GANDCRAB gandcrab.exe sppextcomobj.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
4172"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4896"C:\Users\admin\AppData\Local\Temp\GandCrab.exe" C:\Users\admin\AppData\Local\Temp\GandCrab.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\gandcrab.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
5344C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
Total events
9 292
Read events
9 292
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
597
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
4896GandCrab.exeC:\bootTel.datbinary
MD5:8A67132C62DA26F7AFB1A4B63AFB02B0
SHA256:9E6B017D4F52D6C02AD9323F3B50176BFB249E33463334C3ACFEDE226D17A69C
4896GandCrab.exeC:\Users\admin\AppData\ENRNMB-MANUAL.txtbinary
MD5:E94D09152285C9A2840CADAE75899B1A
SHA256:6B01C292195920EE0A1039ED2718A677B71FA1A2E4E78A9AE47D9322EC93AB85
4896GandCrab.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files (x86)\ENRNMB-MANUAL.txttext
MD5:E94D09152285C9A2840CADAE75899B1A
SHA256:6B01C292195920EE0A1039ED2718A677B71FA1A2E4E78A9AE47D9322EC93AB85
4896GandCrab.exeC:\Users\admin\ENRNMB-MANUAL.txtbinary
MD5:E94D09152285C9A2840CADAE75899B1A
SHA256:6B01C292195920EE0A1039ED2718A677B71FA1A2E4E78A9AE47D9322EC93AB85
4896GandCrab.exeC:\Users\admin\AppData\Roaming\ENRNMB-MANUAL.txtbinary
MD5:E94D09152285C9A2840CADAE75899B1A
SHA256:6B01C292195920EE0A1039ED2718A677B71FA1A2E4E78A9AE47D9322EC93AB85
4896GandCrab.exeC:\bootTel.dat.enrnmbbinary
MD5:8A67132C62DA26F7AFB1A4B63AFB02B0
SHA256:9E6B017D4F52D6C02AD9323F3B50176BFB249E33463334C3ACFEDE226D17A69C
4896GandCrab.exeC:\Users\admin\.ms-ad\ENRNMB-MANUAL.txtbinary
MD5:E94D09152285C9A2840CADAE75899B1A
SHA256:6B01C292195920EE0A1039ED2718A677B71FA1A2E4E78A9AE47D9322EC93AB85
4896GandCrab.exeC:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\ENRNMB-MANUAL.txtbinary
MD5:E94D09152285C9A2840CADAE75899B1A
SHA256:6B01C292195920EE0A1039ED2718A677B71FA1A2E4E78A9AE47D9322EC93AB85
4896GandCrab.exeC:\Users\admin\AppData\Roaming\Adobe\Acrobat\ENRNMB-MANUAL.txtbinary
MD5:E94D09152285C9A2840CADAE75899B1A
SHA256:6B01C292195920EE0A1039ED2718A677B71FA1A2E4E78A9AE47D9322EC93AB85
4896GandCrab.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\ENRNMB-MANUAL.txtbinary
MD5:E94D09152285C9A2840CADAE75899B1A
SHA256:6B01C292195920EE0A1039ED2718A677B71FA1A2E4E78A9AE47D9322EC93AB85
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
20
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
google.com
  • 142.250.186.142
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
GandCrab.exe