analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

299bebcb18e218254960ef96c2e65a4dc1945dcdfe9fc68550022f99a474f56d.exe.z

Full analysis: https://app.any.run/tasks/736c579b-dc12-44ae-a206-53fd9246f9f3
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: November 08, 2018, 14:04:18
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
ransomware
hidden-tear
Indicators:
MIME: application/gzip
File info: gzip compressed data, max compression, from Unix
MD5:

09BE31DC0BB34C0EA39DAABE1ABA0052

SHA1:

07AB7577C312A11AFD2D4462316DC27EE90B7D59

SHA256:

F8AA958A03FDC3004F37AB982C0F2C6DC12B4819DB47F5A1757B93C2917B6756

SSDEEP:

1536:yrGAKjPk5OXl6rqSqgfwjXPr7AAQBvux4MNuvZZWIdy33quP:yrGAKjk5gMqemgAQBWSMQTWIdEXP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 299bebcb18e218254960ef96c2e65a4dc1945dcdfe9fc68550022f99a474f56d.exe (PID: 2748)

    • Connects to CnC server

      • 299bebcb18e218254960ef96c2e65a4dc1945dcdfe9fc68550022f99a474f56d.exe (PID: 2748)

    • HIDDEN-TEAR was detected

      • 299bebcb18e218254960ef96c2e65a4dc1945dcdfe9fc68550022f99a474f56d.exe (PID: 2748)

    • Changes the autorun value in the registry

      • 299bebcb18e218254960ef96c2e65a4dc1945dcdfe9fc68550022f99a474f56d.exe (PID: 2748)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • 299bebcb18e218254960ef96c2e65a4dc1945dcdfe9fc68550022f99a474f56d.exe (PID: 2748)

    • Changes tracing settings of the file or console

      • 299bebcb18e218254960ef96c2e65a4dc1945dcdfe9fc68550022f99a474f56d.exe (PID: 2748)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3324)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.z/gz/gzip | GZipped data (100)

EXIF

ZIP

OperatingSystem: Unix
ExtraFlags: Maximum Compression
ModifyDate: 0000:00:00 00:00:00
Flags: (none)
Compression: Deflated
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
5
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe #HIDDEN-TEAR 299bebcb18e218254960ef96c2e65a4dc1945dcdfe9fc68550022f99a474f56d.exe cmd.exe no specs timeout.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3324"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\299bebcb18e218254960ef96c2e65a4dc1945dcdfe9fc68550022f99a474f56d.exe.z"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2748"C:\Users\admin\Desktop\299bebcb18e218254960ef96c2e65a4dc1945dcdfe9fc68550022f99a474f56d.exe" C:\Users\admin\Desktop\299bebcb18e218254960ef96c2e65a4dc1945dcdfe9fc68550022f99a474f56d.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Shiva
Exit code:
0
Version:
1.0.0.0
3616"C:\Windows\System32\cmd.exe" /C timeout 3 && notepad C:\HOW_TO_RECOVER_FILES.txtC:\Windows\System32\cmd.exe—299bebcb18e218254960ef96c2e65a4dc1945dcdfe9fc68550022f99a474f56d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1392timeout 3 C:\Windows\system32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
664notepad C:\HOW_TO_RECOVER_FILES.txtC:\Windows\system32\notepad.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Notepad
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
555
Read events
517
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
2
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
2748299bebcb18e218254960ef96c2e65a4dc1945dcdfe9fc68550022f99a474f56d.exeC:\autoexec.bat —
MD5:—
SHA256:—
2748299bebcb18e218254960ef96c2e65a4dc1945dcdfe9fc68550022f99a474f56d.exeC:\config.sys —
MD5:—
SHA256:—
2748299bebcb18e218254960ef96c2e65a4dc1945dcdfe9fc68550022f99a474f56d.exeC:\config.sys.goodbinary
MD5:44F6D8BA44662C2A75CB0A32990E8439
SHA256:B900B88D27BFF1F3E8A1C91749413D6B34E8990A34C071EFD1CD966521E50F8E
3324WinRAR.exeC:\Users\admin\Desktop\299bebcb18e218254960ef96c2e65a4dc1945dcdfe9fc68550022f99a474f56d.exeexecutable
MD5:AEC9092976156C8F134B60C72FAEE308
SHA256:299BEBCB18E218254960EF96C2E65A4DC1945DCDFE9FC68550022F99A474F56D
2748299bebcb18e218254960ef96c2e65a4dc1945dcdfe9fc68550022f99a474f56d.exeC:\HOW_TO_RECOVER_FILES.txttext
MD5:03B93815A17F8D02D484791051210A36
SHA256:AC466398279B09599B436014B9B7E6499C2C5DBF961FED062CDCDB8A38A54148
2748299bebcb18e218254960ef96c2e65a4dc1945dcdfe9fc68550022f99a474f56d.exeC:\autoexec.bat.goodbinary
MD5:EA707CEF06FECA95A15D123FBF3C5638
SHA256:17A44AD9B8799EBA479F5F06DAA84953D91E4D98773EAB00733B0D25F228F155
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
0
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2748
299bebcb18e218254960ef96c2e65a4dc1945dcdfe9fc68550022f99a474f56d.exe
GET
200
195.189.17.172:80
http://195.189.17.172/write.php?info=PC-H51WQ%20InfPTjRcRYqsvk8j273yNqX8Q+YP41E7KEZ2B7H2JH8=
RU
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2748
299bebcb18e218254960ef96c2e65a4dc1945dcdfe9fc68550022f99a474f56d.exe
195.189.17.172:80
—
Chiliy Valery Mykhaylovych PE
RU
malicious

DNS requests

No data

Threats

PID
Process
Class
Message
2748
299bebcb18e218254960ef96c2e65a4dc1945dcdfe9fc68550022f99a474f56d.exe
A Network Trojan was detected
MALWARE [PTsecurity] Hidden-Tear Ransomware
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
299bebcb18e218254960ef96c2e65a4dc1945dcdfe9fc68550022f99a474f56d.exe.z