analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

KatyushaRansomware.exe

Full analysis: https://app.any.run/tasks/cfc5d597-a6fb-4cd3-9b15-f4e6c960889d
Verdict: Malicious activity
Analysis date: January 15, 2022, 01:15:07
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: MS-DOS executable, MZ for MS-DOS
MD5:

7F87DB33980C0099739DE40D1B725500

SHA1:

F0626999B7F730F9003AC1389D3060C50068DA5A

SHA256:

D00EE0E6EAB686424F8D383E151D22005F19ADBDA5B380A75669629E32FE12A6

SSDEEP:

49152:tzlhgyBIjVpPZHZlPpLPk0vglJIAc/8KYBsxdO0G7x+dP1Y+U:zy9jRZlFknvzcEKY8dOD7x8NYl

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • KatyushaRansomware.exe (PID: 3816)
      • zkts.exe (PID: 2736)

    • Application was dropped or rewritten from another process

      • zkts.exe (PID: 2736)
      • ktsi.exe (PID: 2424)
      • m32.exe (PID: 4048)

    • Deletes shadow copies

      • cmd.exe (PID: 3956)

  • SUSPICIOUS

    • Checks supported languages

      • cmd.exe (PID: 3684)
      • KatyushaRansomware.exe (PID: 3816)
      • zkts.exe (PID: 2736)
      • cmd.exe (PID: 3280)
      • cmd.exe (PID: 3056)
      • ktsi.exe (PID: 2424)
      • m32.exe (PID: 4048)
      • cmd.exe (PID: 3988)
      • cmd.exe (PID: 3544)
      • cmd.exe (PID: 3948)
      • cmd.exe (PID: 848)
      • cmd.exe (PID: 2296)
      • cmd.exe (PID: 2664)
      • cmd.exe (PID: 1368)
      • cmd.exe (PID: 2360)
      • cmd.exe (PID: 1236)
      • cmd.exe (PID: 2112)
      • cmd.exe (PID: 3720)
      • cmd.exe (PID: 3564)
      • cmd.exe (PID: 3148)
      • cmd.exe (PID: 3956)

    • Executable content was dropped or overwritten

      • KatyushaRansomware.exe (PID: 3816)
      • zkts.exe (PID: 2736)

    • Starts CMD.EXE for commands execution

      • KatyushaRansomware.exe (PID: 3816)
      • ktsi.exe (PID: 2424)

    • Creates files in the Windows directory

      • KatyushaRansomware.exe (PID: 3816)
      • zkts.exe (PID: 2736)

    • Drops a file with too old compile date

      • zkts.exe (PID: 2736)

    • Removes files from Windows directory

      • KatyushaRansomware.exe (PID: 3816)

    • Reads the computer name

      • m32.exe (PID: 4048)
      • KatyushaRansomware.exe (PID: 3816)
      • ktsi.exe (PID: 2424)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 3988)
      • cmd.exe (PID: 3056)
      • cmd.exe (PID: 3544)
      • cmd.exe (PID: 3948)
      • cmd.exe (PID: 848)
      • cmd.exe (PID: 1368)
      • cmd.exe (PID: 2296)
      • cmd.exe (PID: 2664)
      • cmd.exe (PID: 2360)
      • cmd.exe (PID: 1236)
      • cmd.exe (PID: 2112)
      • cmd.exe (PID: 3720)
      • cmd.exe (PID: 3564)
      • cmd.exe (PID: 3148)

    • Creates files in the program directory

      • ktsi.exe (PID: 2424)

    • Starts Internet Explorer

      • ktsi.exe (PID: 2424)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 1472)

  • INFO

    • Reads the computer name

      • taskkill.exe (PID: 2508)
      • taskkill.exe (PID: 1596)
      • taskkill.exe (PID: 3676)
      • taskkill.exe (PID: 4080)
      • taskkill.exe (PID: 2768)
      • taskkill.exe (PID: 3264)
      • taskkill.exe (PID: 2052)
      • taskkill.exe (PID: 1592)
      • taskkill.exe (PID: 2584)
      • taskkill.exe (PID: 976)
      • taskkill.exe (PID: 1128)
      • taskkill.exe (PID: 3848)
      • taskkill.exe (PID: 3684)
      • taskkill.exe (PID: 3596)
      • vssadmin.exe (PID: 804)
      • WINWORD.EXE (PID: 3840)
      • vssadmin.exe (PID: 3228)
      • iexplore.exe (PID: 1472)
      • iexplore.exe (PID: 2836)

    • Checks supported languages

      • taskkill.exe (PID: 1596)
      • taskkill.exe (PID: 2508)
      • taskkill.exe (PID: 3676)
      • taskkill.exe (PID: 2768)
      • taskkill.exe (PID: 4080)
      • taskkill.exe (PID: 2052)
      • taskkill.exe (PID: 1592)
      • taskkill.exe (PID: 3264)
      • taskkill.exe (PID: 3848)
      • taskkill.exe (PID: 976)
      • taskkill.exe (PID: 2584)
      • taskkill.exe (PID: 3596)
      • taskkill.exe (PID: 1128)
      • taskkill.exe (PID: 3684)
      • WINWORD.EXE (PID: 3840)
      • vssadmin.exe (PID: 804)
      • vssadmin.exe (PID: 3228)
      • iexplore.exe (PID: 2836)
      • iexplore.exe (PID: 1472)

    • Dropped object may contain Bitcoin addresses

      • ktsi.exe (PID: 2424)

    • Manual execution by user

      • WINWORD.EXE (PID: 3840)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3840)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2836)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 2836)

    • Application launched itself

      • iexplore.exe (PID: 2836)

    • Changes internet zones settings

      • iexplore.exe (PID: 2836)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2836)

    • Reads internet explorer settings

      • iexplore.exe (PID: 1472)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3840)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:10:14 17:23:06+02:00
PEType: PE32
LinkerVersion: 14
CodeSize: 586752
InitializedDataSize: 2508800
UninitializedDataSize: -
EntryPoint: 0x2f919d
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows command line

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date: 14-Oct-2018 15:23:06
Detected languages:
  • Chinese - PRC
  • English - United States

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0040
Pages in file: 0x0001
Relocations: 0x0000
Size of header: 0x0002
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0xB400
OEM information: 0xCD09
Address of NE header: 0x00000040

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 14-Oct-2018 15:23:06
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_DEBUG_STRIPPED
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.MPRESS1
0x00001000
0x002F8000
0x0025B800
IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.99993
.MPRESS2(\x0d
0x002F9000
0x00000D28
0x00000E00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.81229
.rsrc
0x002FA000
0x00000258
0x00000400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.24563

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.91161
381
UNKNOWN
English - United States
RT_MANIFEST
101
7.99977
1934640
UNKNOWN
Chinese - PRC
EXE
102
0
336384
UNKNOWN
Chinese - PRC
EXE

Imports

ADVAPI32.dll
IPHLPAPI.DLL
KERNEL32.DLL
SHELL32.dll
USER32.dll
WLDAP32.dll
WS2_32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
80
Monitored processes
40
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start katyusharansomware.exe cmd.exe no specs zkts.exe cmd.exe no specs m32.exe no specs ktsi.exe no specs cmd.exe no specs taskkill.exe no specs cmd.exe no specs taskkill.exe no specs cmd.exe no specs taskkill.exe no specs cmd.exe no specs taskkill.exe no specs cmd.exe no specs taskkill.exe no specs cmd.exe no specs taskkill.exe no specs cmd.exe no specs taskkill.exe no specs cmd.exe no specs taskkill.exe no specs cmd.exe no specs taskkill.exe no specs cmd.exe no specs taskkill.exe no specs cmd.exe no specs taskkill.exe no specs cmd.exe no specs taskkill.exe no specs cmd.exe no specs taskkill.exe no specs cmd.exe no specs taskkill.exe no specs cmd.exe no specs vssadmin.exe no specs vssadmin.exe no specs winword.exe no specs iexplore.exe iexplore.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3816"C:\Users\admin\AppData\Local\Temp\KatyushaRansomware.exe" C:\Users\admin\AppData\Local\Temp\KatyushaRansomware.exe
Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\temp\katyusharansomware.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3684C:\Windows\system32\cmd.exe /c c:/windows/temp/zkts.exeC:\Windows\system32\cmd.exe—KatyushaRansomware.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2736c:/windows/temp/zkts.exec:\windows\temp\zkts.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\windows\temp\zkts.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\shell32.dll
c:\windows\system32\user32.dll
c:\windows\system32\shlwapi.dll
3280C:\Windows\system32\cmd.exe /c c:/windows/temp/m32.exeC:\Windows\system32\cmd.exe—KatyushaRansomware.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
4048c:/windows/temp/m32.exec:\windows\temp\m32.exe—cmd.exe
User:
admin
Company:
gentilkiwi (Benjamin DELPY)
Integrity Level:
MEDIUM
Description:
mimikatz for Windows
Exit code:
0
Version:
2.1.1.0
Modules
Images
c:\windows\temp\m32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\crypt32.dll
2424"C:\Windows\temp\ktsi.exe" C:\Windows\temp\ktsi.exe—KatyushaRansomware.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\windows\temp\ktsi.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
3056C:\Windows\system32\cmd.exe /c taskkill /F /IM mysqld.exeC:\Windows\system32\cmd.exe—ktsi.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
128
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
2508taskkill /F /IM mysqld.exeC:\Windows\system32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
3988C:\Windows\system32\cmd.exe /c taskkill /F /IM httpd.exeC:\Windows\system32\cmd.exe—ktsi.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
128
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1596taskkill /F /IM httpd.exeC:\Windows\system32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\gdi32.dll
Total events
13 403
Read events
12 946
Write events
316
Delete events
141

Modification events

(PID) Process:(3816) KatyushaRansomware.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3816) KatyushaRansomware.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3816) KatyushaRansomware.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3816) KatyushaRansomware.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3840) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Operation:writeName:!1?
Value:
21313F00000F0000010000000000000000000000
(PID) Process:(3840) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(3840) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
Off
(PID) Process:(3840) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
Off
(PID) Process:(3840) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
Off
(PID) Process:(3840) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
Off
Executable files
24
Suspicious files
599
Text files
9
Unknown types
11

Dropped files

PID
Process
Filename
Type
3816KatyushaRansomware.exeC:\windows\temp\ktsi.exeexecutable
MD5:DD2E5FD5109C54CC90B30B88EC0C585A
SHA256:A3DABB63F11E208A0D1D9B43B3D2575E2DC2A7D87C14EB654D3062F3BC0AD12D
2736zkts.exeC:\windows\temp\katyusha.dllexecutable
MD5:94BD92AD65EE59117DB13EAB0D40AE21
SHA256:AD8008D02B66AD40ACB6389E51AEE351363968DA5A6B7DC4AC293AF354AF738F
2736zkts.exeC:\windows\temp\svchostp.exeexecutable
MD5:0E2D6BE0556D0A1EC47A934DA3244FC0
SHA256:FA2A5DB45A4808A3D087BB9CF807C5672BE9E856166A049D15997B56C4626AF4
2736zkts.exeC:\windows\temp\m32.exeexecutable
MD5:0B5469B69A0D2E205640B78157CA225A
SHA256:4179A1BFF4C698EA6958BACB1F1734B9AB804CEF35ECAF0E2A2B4B2EADF8E935
2736zkts.exeC:\windows\temp\svchostb.exeexecutable
MD5:292C31454D142FCE23F6DFAF921FBD08
SHA256:22501DA84C7604912D730681DE696F9D60C04E81C12F3641F306449474C299EA
2736zkts.exeC:\windows\temp\svchostb.xmlxml
MD5:F56025565DE4F53F5771D4966C2B5555
SHA256:EA7CAA08E115DBB438E29DA46B47F54C62C29697617BAE44464A9B63D9BDDF18
2736zkts.exeC:\windows\temp\KillDuplicate.cmdtext
MD5:68CECDF24AA2FD011ECE466F00EF8450
SHA256:64929489DC8A0D66EA95113D4E676368EDB576EA85D23564D53346B21C202770
3816KatyushaRansomware.exeC:\windows\temp\zkts.exeexecutable
MD5:5D74E736C5C4224B813BEA351093C27F
SHA256:7F5F134FD3EC2C14956ACD7362C76E66759B8ECC51F986EF80BBF9F7F94B89FE
2736zkts.exeC:\windows\temp\svchostbs.exeexecutable
MD5:AE802629233BC39C66C7F136CB10A939
SHA256:C8AF5ABB931257AEC0F33ECBE8CB1731DBC1695369C800810CAD2FB1CC004B08
2736zkts.exeC:\windows\temp\svchostbs.xmlxml
MD5:09D45AE26830115FD8D9CDC2AA640CA5
SHA256:CF33A92A05BA3C807447A5F6B7E45577ED53174699241DA360876D4F4A2EB2DE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
143
DNS requests
9
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2836
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
2836
iexplore.exe
GET
200
2.16.106.171:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?87fa8657099d92a8
unknown
compressed
4.70 Kb
whitelisted
2836
iexplore.exe
GET
200
2.16.106.171:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5aa5c0d7a2939da8
unknown
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.1:445
—
—
—
unknown
—
—
192.168.100.1:8008
—
—
—
unknown
—
—
192.168.100.1:777
—
—
—
unknown
—
—
192.168.100.1:90
—
—
—
unknown
—
—
192.168.100.1:8020
—
—
—
unknown
—
—
192.168.100.1:8181
—
—
—
unknown
—
—
192.168.100.1:8060
—
—
—
unknown
—
—
192.168.100.1:9000
—
—
—
unknown
—
—
192.168.100.1:7080
—
—
—
unknown
—
—
192.168.100.1:8082
—
—
—
unknown

DNS requests

Domain
IP
Reputation
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ctldl.windowsupdate.com
  • 2.16.106.171
  • 2.16.106.186
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted

Threats

PID
Process
Class
Message
—
—
Generic Protocol Command Decode
SURICATA HTTP Unexpected Request body
—
—
Generic Protocol Command Decode
SURICATA HTTP Unexpected Request body
—
—
Generic Protocol Command Decode
SURICATA HTTP Unexpected Request body
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
KatyushaRansomware.exe