| File name: | Crypted.exe |
| Full analysis: | https://app.any.run/tasks/c60a202f-ece9-4b88-8d6e-fb3a0cf78349 |
| Verdict: | Malicious activity |
| Threats: | Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying. |
| Analysis date: | April 19, 2024, 09:18:33 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
| MD5: | CB0834500D41A3889339DD468E97D9EE |
| SHA1: | 2A9FD429B66B934B0F6B75ED8C755D7B770B7EA4 |
| SHA256: | E226D8BF3151D4BF8F87223A358F735F16CC5902CE3DE1435D3D473F52BDED1A |
| SSDEEP: | 98304:NZjQEAame2Zv+ibzd/KVBjiym+f+GRAOW0h5WPWqx9szI7VYtC9+0mpsu6QIqQWi:IYWDp |
MALICIOUS
Drops the executable file immediately after the start
- Crypted.exe (PID: 3768)
- tmpE154.tmp.exe (PID: 2880)
- 生家顾是她官商孙.exe (PID: 3584)
Writes a file to the Word startup folder
- tmpE154.tmp.exe (PID: 2880)
Modifies files in the Chrome extension folder
- tmpE154.tmp.exe (PID: 2880)
Wannacry exe files
- @WanaDecryptor@.exe (PID: 1992)
Actions looks like stealing of personal data
- tmpE154.tmp.exe (PID: 2880)
SUSPICIOUS
Executable content was dropped or overwritten
- Crypted.exe (PID: 3768)
- 生家顾是她官商孙.exe (PID: 3584)
- tmpE154.tmp.exe (PID: 2880)
Reads the Internet Settings
- Crypted.exe (PID: 3768)
- Crypted.exe (PID: 3080)
- 生家顾是她官商孙.exe (PID: 3584)
Reads security settings of Internet Explorer
- Crypted.exe (PID: 3768)
- 生家顾是她官商孙.exe (PID: 3584)
- Crypted.exe (PID: 3080)
Process drops legitimate windows executable
- 生家顾是她官商孙.exe (PID: 3584)
- tmpE154.tmp.exe (PID: 2880)
Starts a Microsoft application from unusual location
- tmpE154.tmp.exe (PID: 2880)
- taskdl.exe (PID: 696)
- @WanaDecryptor@.exe (PID: 1992)
- taskdl.exe (PID: 3412)
Uses ICACLS.EXE to modify access control lists
- tmpE154.tmp.exe (PID: 2880)
Executing commands from a ".bat" file
- tmpE154.tmp.exe (PID: 2880)
Uses ATTRIB.EXE to modify file attributes
- tmpE154.tmp.exe (PID: 2880)
Starts CMD.EXE for commands execution
- tmpE154.tmp.exe (PID: 2880)
The process executes VB scripts
- cmd.exe (PID: 864)
Creates files like ransomware instruction
- tmpE154.tmp.exe (PID: 2880)
Starts itself from another location
- Crypted.exe (PID: 3080)
- Crypted.exe (PID: 3768)
INFO
Reads the computer name
- Crypted.exe (PID: 3768)
- 生家顾是她官商孙.exe (PID: 3584)
- tmpE154.tmp.exe (PID: 2880)
- Crypted.exe (PID: 3080)
- 生家顾是她官商孙.exe (PID: 3796)
Checks supported languages
- Crypted.exe (PID: 3768)
- MSBuild.exe (PID: 1424)
- tmpE154.tmp.exe (PID: 2880)
- taskdl.exe (PID: 696)
- Crypted.exe (PID: 3080)
- 生家顾是她官商孙.exe (PID: 3796)
- MSBuild.exe (PID: 1768)
- taskdl.exe (PID: 3412)
- @WanaDecryptor@.exe (PID: 1992)
- 生家顾是她官商孙.exe (PID: 3584)
Reads the machine GUID from the registry
- Crypted.exe (PID: 3768)
- tmpE154.tmp.exe (PID: 2880)
- Crypted.exe (PID: 3080)
- 生家顾是她官商孙.exe (PID: 3796)
- 生家顾是她官商孙.exe (PID: 3584)
Create files in a temporary directory
- 生家顾是她官商孙.exe (PID: 3584)
- tmpE154.tmp.exe (PID: 2880)
- cscript.exe (PID: 2756)
- Crypted.exe (PID: 3080)
- Crypted.exe (PID: 3768)
Dropped object may contain TOR URL's
- tmpE154.tmp.exe (PID: 2880)
The dropped object may contain a URL to Tor Browser
- tmpE154.tmp.exe (PID: 2880)
Reads security settings of Internet Explorer
- cscript.exe (PID: 2756)
Creates files or folders in the user directory
- tmpE154.tmp.exe (PID: 2880)
Creates files in the program directory
- tmpE154.tmp.exe (PID: 2880)
Manual execution by a user
- Crypted.exe (PID: 3080)
- @WanaDecryptor@.exe (PID: 1992)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (82.9) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (7.4) |
| .exe | | | Win32 Executable (generic) (5.1) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2024:04:19 08:50:08+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 11 |
| CodeSize: | 4515840 |
| InitializedDataSize: | 2560 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x45075e |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 3.2.0.3 |
| ProductVersionNumber: | 3.2.0.3 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | 的族太物希希首 顾司顾首公生 |
| CompanyName: | 顾的她执司族太 希首官成物的太公 |
| FileDescription: | 的首族孙席氏 的的行生的希顾族城 |
| FileVersion: | 3.2.0.3 |
| InternalName: | Crypted.exe |
| LegalCopyright: | 顾氏族城行孙 泽族她物顾 |
| LegalTrademarks: | 太太首顾公 顾家家的是 |
| OriginalFileName: | Crypted.exe |
| ProductName: | 顾首孙孙顾孙首 席望物望望氏顾顾的 |
| ProductVersion: | 3.2.0.3 |
| AssemblyVersion: | 0.0.0.0 |
Total processes
56
Monitored processes
14
Malicious processes
4
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 696 | taskdl.exe | C:\Users\admin\AppData\Local\Temp\taskdl.exe | — | tmpE154.tmp.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: SQL Client Configuration Utility EXE Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 864 | C:\Windows\system32\cmd.exe /c 119131713518327.bat | C:\Windows\System32\cmd.exe | — | tmpE154.tmp.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 1028 | icacls . /grant Everyone:F /T /C /Q | C:\Windows\System32\icacls.exe | — | tmpE154.tmp.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1424 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | 生家顾是她官商孙.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: MSBuild.exe Exit code: 3221225477 Version: 4.8.3761.0 built by: NET48REL1 Modules
| |||||||||||||||
| 1768 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | 生家顾是她官商孙.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: MSBuild.exe Exit code: 3221225477 Version: 4.8.3761.0 built by: NET48REL1 Modules
| |||||||||||||||
| 1992 | "C:\Users\admin\Desktop\@WanaDecryptor@.exe" | C:\Users\admin\Desktop\@WanaDecryptor@.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Load PerfMon Counters Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2756 | cscript.exe //nologo m.vbs | C:\Windows\System32\cscript.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Console Based Script Host Exit code: 0 Version: 5.8.7600.16385 Modules
| |||||||||||||||
| 2880 | "C:\Users\admin\AppData\Local\Temp\tmpE154.tmp.exe" | C:\Users\admin\AppData\Local\Temp\tmpE154.tmp.exe | 生家顾是她官商孙.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: DiskPart Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 3080 | "C:\Users\admin\Desktop\Crypted.exe" | C:\Users\admin\Desktop\Crypted.exe | — | explorer.exe | |||||||||||
User: admin Company: 顾的她执司族太 希首官成物的太公 Integrity Level: MEDIUM Description: 的首族孙席氏 的的行生的希顾族城 Exit code: 0 Version: 3.2.0.3 Modules
| |||||||||||||||
| 3244 | attrib +h . | C:\Windows\System32\attrib.exe | — | tmpE154.tmp.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Attribute Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
11 044
Read events
11 017
Write events
27
Delete events
0
Modification events
| (PID) Process: | (3768) Crypted.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\Run\CurrentVersion |
| Operation: | write | Name: | 生家顾是她官商孙.exe |
Value: C:\Users\admin\AppData\Local\Temp\生家顾是她官商孙.exe | |||
| (PID) Process: | (3768) Crypted.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (3768) Crypted.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (3768) Crypted.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (3768) Crypted.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (3584) 生家顾是她官商孙.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (3584) 生家顾是她官商孙.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (3584) 生家顾是她官商孙.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (3584) 生家顾是她官商孙.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (2880) tmpE154.tmp.exe | Key: | HKEY_CURRENT_USER\Software\WanaCrypt0r |
| Operation: | write | Name: | wd |
Value: C:\Users\admin\AppData\Local\Temp | |||
Executable files
10
Suspicious files
410
Text files
48
Unknown types
304
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2880 | tmpE154.tmp.exe | C:\Users\admin\AppData\Local\Temp\msg\m_bulgarian.wnry | text | |
MD5:95673B0F968C0F55B32204361940D184 | SHA256:40B37E7B80CF678D7DD302AAF41B88135ADE6DDF44D89BDBA19CF171564444BD | |||
| 3768 | Crypted.exe | C:\Users\admin\AppData\Local\Temp\生家顾是她官商孙.exe | executable | |
MD5:CB0834500D41A3889339DD468E97D9EE | SHA256:E226D8BF3151D4BF8F87223A358F735F16CC5902CE3DE1435D3D473F52BDED1A | |||
| 2880 | tmpE154.tmp.exe | C:\Users\admin\AppData\Local\Temp\b.wnry | image | |
MD5:C17170262312F3BE7027BC2CA825BF0C | SHA256:D5E0E8694DDC0548D8E6B87C83D50F4AB85C1DEBADB106D6A6A794C3E746F4FA | |||
| 2880 | tmpE154.tmp.exe | C:\Users\admin\AppData\Local\Temp\msg\m_croatian.wnry | text | |
MD5:17194003FA70CE477326CE2F6DEEB270 | SHA256:3F33734B2D34CCE83936CE99C3494CD845F1D2C02D7F6DA31D42DFC1CA15A171 | |||
| 2880 | tmpE154.tmp.exe | C:\Users\admin\AppData\Local\Temp\msg\m_filipino.wnry | text | |
MD5:08B9E69B57E4C9B966664F8E1C27AB09 | SHA256:D8489F8C16318E524B45DE8B35D7E2C3CD8ED4821C136F12F5EF3C9FC3321324 | |||
| 2880 | tmpE154.tmp.exe | C:\Users\admin\AppData\Local\Temp\msg\m_chinese (simplified).wnry | text | |
MD5:0252D45CA21C8E43C9742285C48E91AD | SHA256:845D0E178AEEBD6C7E2A2E9697B2BF6CF02028C50C288B3BA88FE2918EA2834A | |||
| 2880 | tmpE154.tmp.exe | C:\Users\admin\AppData\Local\Temp\msg\m_chinese (traditional).wnry | text | |
MD5:2EFC3690D67CD073A9406A25005F7CEA | SHA256:5C7F6AD1EC4BC2C8E2C9C126633215DABA7DE731AC8B12BE10CA157417C97F3A | |||
| 2880 | tmpE154.tmp.exe | C:\Users\admin\AppData\Local\Temp\msg\m_czech.wnry | text | |
MD5:537EFEECDFA94CC421E58FD82A58BA9E | SHA256:5AFA4753AFA048C6D6C39327CE674F27F5F6E5D3F2A060B7A8AED61725481150 | |||
| 2880 | tmpE154.tmp.exe | C:\Users\admin\AppData\Local\Temp\msg\m_danish.wnry | text | |
MD5:2C5A3B81D5C4715B7BEA01033367FCB5 | SHA256:A75BB44284B9DB8D702692F84909A7E23F21141866ADF3DB888042E9109A1CB6 | |||
| 3584 | 生家顾是她官商孙.exe | C:\Users\admin\AppData\Local\Temp\tmpE154.tmp.exe | executable | |
MD5:84C82835A5D21BBCF75A61706D8AB549 | SHA256:ED01EBFBC9EB5BBEA545AF4D01BF5F1071661840480439C6E5BABE8E080E41AA | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 224.0.0.252:5355 | — | — | — | unknown |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |