File name:

45c317200e27e5c5692c59d06768ca2e7eeb446d6d495084f414d0f261f75315.7z

Full analysis: https://app.any.run/tasks/f487196a-9a8b-4f3e-95b1-c1f65bf59de4
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: December 01, 2023, 19:24:40
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

4DB4BD0030F473332E93C68A55E0D5AF

SHA1:

B195FC8FF8CA0141B992D09EA742E6299D51E4CB

SHA256:

0045EF27812AB121324497770A831F393D7817948B194A4042221C8A2811B64B

SSDEEP:

3072:nUsEN5ouIl4PhvYLtPlHnJF7XTfSwg+sR3N6q:IN5gyhYtPJnJpXQ+a3V

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Known privilege escalation attack

      • dllhost.exe (PID: 3336)

    • Drops the executable file immediately after the start

      • 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe (PID: 2112)

    • Renames files like ransomware

      • 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe (PID: 2112)

  • SUSPICIOUS

    • Starts application with an unusual extension

      • 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe (PID: 2112)

    • Write to the desktop.ini file (may be used to cloak folders)

      • 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe (PID: 2112)

    • Creates files like ransomware instruction

      • 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe (PID: 2112)

    • Changes the desktop background image

      • 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe (PID: 2112)

  • INFO

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3060)
      • WinRAR.exe (PID: 3084)
      • WinRAR.exe (PID: 3936)
      • WinRAR.exe (PID: 4020)
      • WinRAR.exe (PID: 3668)

    • Manual execution by a user

      • 45c317200e27e5c5692c59d06768ca2e7eeb446d6d495084f414d0f261f75315.exe (PID: 3264)
      • wmpnscfg.exe (PID: 1560)
      • WinRAR.exe (PID: 3084)
      • WinRAR.exe (PID: 4020)
      • 80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ce.exe (PID: 3652)
      • WinRAR.exe (PID: 3936)
      • WinRAR.exe (PID: 3668)
      • 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe (PID: 2924)

    • Reads the machine GUID from the registry

      • 45c317200e27e5c5692c59d06768ca2e7eeb446d6d495084f414d0f261f75315.exe (PID: 3264)
      • 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe (PID: 2112)
      • 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe (PID: 2924)

    • Reads the computer name

      • 45c317200e27e5c5692c59d06768ca2e7eeb446d6d495084f414d0f261f75315.exe (PID: 3264)
      • wmpnscfg.exe (PID: 1560)
      • 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe (PID: 2112)
      • 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe (PID: 2924)

    • Checks supported languages

      • 45c317200e27e5c5692c59d06768ca2e7eeb446d6d495084f414d0f261f75315.exe (PID: 3264)
      • wmpnscfg.exe (PID: 1560)
      • 80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ce.exe (PID: 3652)
      • 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe (PID: 2924)
      • 578B.tmp (PID: 3196)
      • 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe (PID: 2112)

    • Checks transactions between databases Windows and Oracle

      • 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe (PID: 2924)

    • Creates files in the program directory

      • 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe (PID: 2112)

    • Dropped object may contain TOR URL's

      • 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe (PID: 2112)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
68
Monitored processes
12
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs 45c317200e27e5c5692c59d06768ca2e7eeb446d6d495084f414d0f261f75315.exe wmpnscfg.exe no specs winrar.exe no specs winrar.exe no specs winrar.exe no specs winrar.exe no specs 80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ce.exe 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe no specs CMSTPLUA no specs 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe no specs 578b.tmp no specs

Process information

PID
CMD
Path
Indicators
Parent process
1560"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2112"C:\Users\admin\Desktop\87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe" C:\Users\admin\Desktop\87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe—dllhost.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
2924"C:\Users\admin\Desktop\87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe" C:\Users\admin\Desktop\87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
3060"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\45c317200e27e5c5692c59d06768ca2e7eeb446d6d495084f414d0f261f75315.7z"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3084"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ce.7z" C:\Users\admin\Desktop\C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3196"C:\ProgramData\578B.tmp"C:\ProgramData\578B.tmp—87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\programdata\578b.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
3264"C:\Users\admin\Desktop\45c317200e27e5c5692c59d06768ca2e7eeb446d6d495084f414d0f261f75315.exe" C:\Users\admin\Desktop\45c317200e27e5c5692c59d06768ca2e7eeb446d6d495084f414d0f261f75315.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\45c317200e27e5c5692c59d06768ca2e7eeb446d6d495084f414d0f261f75315.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
3336C:\Windows\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3652"C:\Users\admin\Desktop\80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ce.exe" C:\Users\admin\Desktop\80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ce.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\desktop\80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ce.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
3668"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\506f3b12853375a1fbbf85c82ddf13341cf941c5acd4a39a51d6addf145a7a51.7z" C:\Users\admin\Desktop\C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
2 940
Read events
1 910
Write events
1 029
Delete events
1

Modification events

(PID) Process:(3060) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
(PID) Process:(3060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\Desktop
Executable files
8
Suspicious files
213
Text files
97
Unknown types
0

Dropped files

PID
Process
Filename
Type
211287b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exeC:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\BBBBBBBBBBBbinary
MD5:2947C2FEB8C3BF946A554ADA5BA70564
SHA256:D929B54F5B49C9B50FB7891C71E23D235928E59349ED78B0ED52A37664646B5C
211287b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exeC:\Users\47IsP2Rni.README.txttext
MD5:572B3B754209A8F915E2C1F38224EFA2
SHA256:4D35D6DC7E6E288B9AFE6E5A9568A7E218DE9F266AD61992712EA1553976C17B
211287b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exeC:\47IsP2Rni.README.txttext
MD5:572B3B754209A8F915E2C1F38224EFA2
SHA256:4D35D6DC7E6E288B9AFE6E5A9568A7E218DE9F266AD61992712EA1553976C17B
211287b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exeC:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\FFFFFFFFFFFbinary
MD5:2947C2FEB8C3BF946A554ADA5BA70564
SHA256:D929B54F5B49C9B50FB7891C71E23D235928E59349ED78B0ED52A37664646B5C
211287b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exeC:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\DDDDDDDDDDDbinary
MD5:2947C2FEB8C3BF946A554ADA5BA70564
SHA256:D929B54F5B49C9B50FB7891C71E23D235928E59349ED78B0ED52A37664646B5C
211287b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exeC:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\AAAAAAAAAAAbinary
MD5:2947C2FEB8C3BF946A554ADA5BA70564
SHA256:D929B54F5B49C9B50FB7891C71E23D235928E59349ED78B0ED52A37664646B5C
3668WinRAR.exeC:\Users\admin\Desktop\506f3b12853375a1fbbf85c82ddf13341cf941c5acd4a39a51d6addf145a7a51executable
MD5:7E37F198C71A81AF5384C480520EE36E
SHA256:506F3B12853375A1FBBF85C82DDF13341CF941C5ACD4A39A51D6ADDF145A7A51
211287b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exeC:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\desktop.inibinary
MD5:2947C2FEB8C3BF946A554ADA5BA70564
SHA256:D929B54F5B49C9B50FB7891C71E23D235928E59349ED78B0ED52A37664646B5C
211287b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exeC:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\CCCCCCCCCCCbinary
MD5:2947C2FEB8C3BF946A554ADA5BA70564
SHA256:D929B54F5B49C9B50FB7891C71E23D235928E59349ED78B0ED52A37664646B5C
211287b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exeC:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\EEEEEEEEEEEbinary
MD5:2947C2FEB8C3BF946A554ADA5BA70564
SHA256:D929B54F5B49C9B50FB7891C71E23D235928E59349ED78B0ED52A37664646B5C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
266
DNS requests
0
Threats
1

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
—
—
192.168.100.14:49211
—
—
—
unknown
—
—
192.168.100.14:49212
—
—
—
unknown
3264
45c317200e27e5c5692c59d06768ca2e7eeb446d6d495084f414d0f261f75315.exe
192.168.1.2:445
—
—
—
unknown
—
—
192.168.100.14:49214
—
—
—
unknown
—
—
192.168.100.14:49215
—
—
—
unknown
—
—
192.168.100.14:49216
—
—
—
unknown

DNS requests

No data

Threats

PID
Process
Class
Message
3264
45c317200e27e5c5692c59d06768ca2e7eeb446d6d495084f414d0f261f75315.exe
Misc activity
ET SCAN Behavioral Unusual Port 445 traffic Potential Scan or Infection
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
45c317200e27e5c5692c59d06768ca2e7eeb446d6d495084f414d0f261f75315.7z