File name:

2025-03-24_718a7257330a93842860530d60ff5005_gandcrab

Full analysis: https://app.any.run/tasks/3ba42644-6a7b-40f8-b39c-0aae9af25e7d
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: March 24, 2025, 15:17:05
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
grandcrab
ransomware
evasion
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

718A7257330A93842860530D60FF5005

SHA1:

3C63ABD34D0B350C306336E1C40CCCE42C172595

SHA256:

FE70B485BA651A385B47F7B434BA9BCFE1F9DFE8A1018F924ABB010C798F4906

SSDEEP:

768:nm5MpFvK8LmFDEuE0umZhfH+dRehemCMG5W/UMlaxvKop2hKjeT2FvpDcziq/pEP:5pF3mBbfedUhemCMGg/iZaqvtEU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GRANDCRAB mutex has been found

      • 2025-03-24_718a7257330a93842860530d60ff5005_gandcrab.exe (PID: 7296)

    • Changes the autorun value in the registry

      • 2025-03-24_718a7257330a93842860530d60ff5005_gandcrab.exe (PID: 7296)

  • SUSPICIOUS

    • Executes application which crashes

      • 2025-03-24_718a7257330a93842860530d60ff5005_gandcrab.exe (PID: 7296)

    • Executable content was dropped or overwritten

      • 2025-03-24_718a7257330a93842860530d60ff5005_gandcrab.exe (PID: 7296)

    • Reads security settings of Internet Explorer

      • 2025-03-24_718a7257330a93842860530d60ff5005_gandcrab.exe (PID: 7296)

    • Checks for external IP

      • svchost.exe (PID: 2196)

  • INFO

    • Reads CPU info

      • 2025-03-24_718a7257330a93842860530d60ff5005_gandcrab.exe (PID: 7296)

    • Creates files or folders in the user directory

      • 2025-03-24_718a7257330a93842860530d60ff5005_gandcrab.exe (PID: 7296)
      • WerFault.exe (PID: 7464)

    • Checks supported languages

      • 2025-03-24_718a7257330a93842860530d60ff5005_gandcrab.exe (PID: 7296)

    • Reads the machine GUID from the registry

      • 2025-03-24_718a7257330a93842860530d60ff5005_gandcrab.exe (PID: 7296)

    • Reads the computer name

      • 2025-03-24_718a7257330a93842860530d60ff5005_gandcrab.exe (PID: 7296)

    • Checks proxy server information

      • 2025-03-24_718a7257330a93842860530d60ff5005_gandcrab.exe (PID: 7296)
      • slui.exe (PID: 7720)

    • Reads the software policy settings

      • slui.exe (PID: 7720)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:03:04 18:10:15+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 34304
InitializedDataSize: 36352
UninitializedDataSize: -
EntryPoint: 0x4b20
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
125
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 2025-03-24_718a7257330a93842860530d60ff5005_gandcrab.exe werfault.exe no specs svchost.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
7296"C:\Users\admin\Desktop\2025-03-24_718a7257330a93842860530d60ff5005_gandcrab.exe" C:\Users\admin\Desktop\2025-03-24_718a7257330a93842860530d60ff5005_gandcrab.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\desktop\2025-03-24_718a7257330a93842860530d60ff5005_gandcrab.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7464C:\WINDOWS\SysWOW64\WerFault.exe -u -p 7296 -s 1364C:\Windows\SysWOW64\WerFault.exe—2025-03-24_718a7257330a93842860530d60ff5005_gandcrab.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
7720C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
5 497
Read events
5 496
Write events
1
Delete events
0

Modification events

(PID) Process:(7296) 2025-03-24_718a7257330a93842860530d60ff5005_gandcrab.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:mhopfynorxh
Value:
"C:\Users\admin\AppData\Roaming\Microsoft\szfwrt.exe"
Executable files
1
Suspicious files
4
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
7464WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_2025-03-24_718a7_4964a314e0d3acd3d95abf56773a9bbcfa7e8564_a8e12259_59187cb7-0662-41ef-bb3f-2de57b056d59\Report.wer —
MD5:—
SHA256:—
72962025-03-24_718a7257330a93842860530d60ff5005_gandcrab.exeC:\Users\admin\AppData\Roaming\Microsoft\szfwrt.exeexecutable
MD5:F61E4BCF18017A7A18E6EB19F746923B
SHA256:731013EE39DF61669B6CF404241D99ECBB5198B0199FBF6B278107B1BC4A953F
72962025-03-24_718a7257330a93842860530d60ff5005_gandcrab.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1693682860-607145093-2874071422-1001\0f5007522459c86e95ffcc62f32308f1_bb926e54-e3ca-40fd-ae90-2764341e7792binary
MD5:D898504A722BFF1524134C6AB6A5EAA5
SHA256:878F32F76B159494F5A39F9321616C6068CDB82E88DF89BCC739BBC1EA78E1F9
7464WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERDF96.tmp.xmlxml
MD5:63CC1C9F75294ADA13DA3B07C4004B4A
SHA256:8D7F7CBE45BC7328F425A1829B8941ED335E69EB746D439122FF8A86DDD15306
7464WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERDDEE.tmp.dmpbinary
MD5:34CED361501DB8AEB17EE49B32234BC2
SHA256:43C62BE963A9B0AE80AFE8C28BB924633835139F490C714A9B8391A57E418657
7464WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERDF47.tmp.WERInternalMetadata.xmlbinary
MD5:81E84643BEA284F95BB3620E35AB62EE
SHA256:F4A70F4F44F9D6B984DE15917B65E0F3C50F6D3ABB0840CF69DAF427D6F2C0BB
7464WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\2025-03-24_718a7257330a93842860530d60ff5005_gandcrab.exe.7296.dmpbinary
MD5:48F64E15DA31B7415A78E6ED558FCF10
SHA256:955A53A4149CA8B836403C111E234F53427EB6346B07ACAC89B0DFE357B0A020
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
21
DNS requests
4
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2320
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7720
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.78
whitelisted
ipv4bot.whatismyipaddress.com
  • —
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (whatismyipaddress .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-03-24_718a7257330a93842860530d60ff5005_gandcrab