74f9b8d8...0196 | IOCs
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Wiper, Trojan

GottaCry.exe

Windows Exe (x86-32)

Created at 2019-05-25T08:39:00

...

Remarks (2/2)

(0x2000008): One or more processes crashed during the analysis. Analysis results may be incomplete.

(0x2000004): The operating system was rebooted during the analysis because the sample installed a startup script, task or application for persistence.

Indicators

File (51)
»
Filename Hash Operations Source
C:\Users\DontFuckMe - Access
C:\Users\FD1HVy\Desktop - Access
C:\Users\FD1HVy\Desktop\--L05hp3fv9.png - Access
C:\Users\FD1HVy\Desktop\1C43JvIy2z.avi - Access
C:\Users\FD1HVy\Desktop\4hFqVTgno3jT_N5-sB - Access
C:\Users\FD1HVy\Desktop\4hFqVTgno3jT_N5-sB\5pFwrOduO_s_E.jpg - Access
C:\Users\FD1HVy\Desktop\4hFqVTgno3jT_N5-sB\EKM1o2Ttc4D0Kn.flv - Access
C:\Users\FD1HVy\Desktop\4hFqVTgno3jT_N5-sB\gR5j2UyK7PW3S5L2SqLl.mp4 - Access
C:\Users\FD1HVy\Desktop\4hFqVTgno3jT_N5-sB\hnSVWIs8tNNZcPDxr.wav - Access
C:\Users\FD1HVy\Desktop\4hFqVTgno3jT_N5-sB\ki7IKF9ARfC_nN.m4a - Access
C:\Users\FD1HVy\Desktop\4hFqVTgno3jT_N5-sB\KpW aJ73U.gif - Access
C:\Users\FD1HVy\Desktop\4hFqVTgno3jT_N5-sB\ne81c0f.jpg - Access
C:\Users\FD1HVy\Desktop\4hFqVTgno3jT_N5-sB\PiOj6qcCI-47.doc - Access
C:\Users\FD1HVy\Desktop\4hFqVTgno3jT_N5-sB\QynV.flv - Access
C:\Users\FD1HVy\Desktop\4hFqVTgno3jT_N5-sB\SrQU6.bmp - Access
C:\Users\FD1HVy\Desktop\4hFqVTgno3jT_N5-sB\t1fGlG4Fb3whav_0E_.jpg - Access
C:\Users\FD1HVy\Desktop\4hFqVTgno3jT_N5-sB\VWcoZ4s.m4a - Access
C:\Users\FD1HVy\Desktop\4hFqVTgno3jT_N5-sB\W8 nshMTU_.m4a - Access
C:\Users\FD1HVy\Desktop\6IBxX2LNqhJFYXVQYS0W.bmp - Access
C:\Users\FD1HVy\Desktop\9N1u2btn9yPvOjA.m4a - Access
C:\Users\FD1HVy\Desktop\9nfD.gif - Access
C:\Users\FD1HVy\Desktop\CONgsjZCET.mp4 - Access
C:\Users\FD1HVy\Desktop\desktop.ini - Access
C:\Users\FD1HVy\Desktop\GottaCry.exe MD5: f7c18136d44ce6e56710016841ca8aa3
SHA1: 68994fa66e39ff9082f822e5a019b8bab4ec83af
SHA256: 74f9b8d8ad9cd5da148c4459560be843ee9443bf01e2bc7dff77fb333a470196
SSDeep: 3072:X7idbvXLQ666C66G666i666o666y666B66c666G66f666+666u6669p666366o60:md7XgXtwU3xvpOVKW6Q
ImpHash: None 		Access Sample File
C:\Users\FD1HVy\Desktop\GottaCry.exe.config - Access
C:\Users\FD1HVy\Desktop\HcPQ9aQ09Z3yq.mp4 - Access
C:\Users\FD1HVy\Desktop\JdOHkTwIW D- 2Su4U1X.flv - Access
C:\Users\FD1HVy\Desktop\jo51jZ-8ooS.jpg - Access
C:\Users\FD1HVy\Desktop\JQUOsla.gif - Access
C:\Users\FD1HVy\Desktop\kUyiUtgZT3aaZTCnGBG.wav - Access
C:\Users\FD1HVy\Desktop\LmFV6mZwywUte2Wx.mp3 - Access
C:\Users\FD1HVy\Desktop\LQ jOTd.mp3 - Access
C:\Users\FD1HVy\Desktop\LUepN7ov7Oz3L7J.mp3 - Access
C:\Users\FD1HVy\Desktop\m2XL.rtf - Access
C:\Users\FD1HVy\Desktop\nFaIgJNWTp4mMdZ.m4a - Access
C:\Users\FD1HVy\Desktop\NnSQ.mp3 - Access
C:\Users\FD1HVy\Desktop\O67RCTmouURcYS_.png - Access
C:\Users\FD1HVy\Desktop\r1t-hn57kceBTM0n.avi - Access
C:\Users\FD1HVy\Desktop\rDiKAyzeX.pptx - Access
C:\Users\FD1HVy\Desktop\rFDA42 soc19d.wav - Access
C:\Users\FD1HVy\Desktop\rR1ynxjK.wav - Access
C:\Users\FD1HVy\Desktop\S5R3CNV76ET.png - Access
C:\Users\FD1HVy\Desktop\sCti5J-zHdiT5J.pdf - Access
C:\Users\FD1HVy\Desktop\SvZdTz5uu_dcureKFHD.wav - Access
C:\Users\FD1HVy\Desktop\tZdJbSC_BxXs_dGdDs.jpg - Access
C:\Users\FD1HVy\Desktop\U uNu4WFx4W Q.wav - Access
C:\Users\FD1HVy\Desktop\uludpfxqYRGHOoD hz.bmp - Access
C:\Users\FD1HVy\Desktop\uoSLaSZ.ots - Access
C:\Users\FD1HVy\Desktop\XwLYw.mp4 - Access
C:\Users\FD1HVy\Desktop\YB67 4.wav - Access
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config - Access, Read
Registry (11)
»
Registry Key Name Operations
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Access
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GottaCry Read, Write
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main Access
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Anchor Underline Read
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings Access
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings\Anchor Color Read
HKEY_LOCAL_MACHINE Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\AppContext Access
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework Access
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\DbgJITDebugLaunchSetting Read
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\DbgManagedDebugger Read
Mutex (1)
»
Mutex Name Operations
Local\SM0:3848:120:WilError_01 Access, Delete
Export to TXT Export to JSON
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image