File name:

Trojan-Ransom.Win32.Encoder.mbm-9e4addf136a3502fabc6a54723f08dc3e3ba50f5116e25a9027aef140788eb92.7z

Full analysis: https://app.any.run/tasks/92505abb-e114-4d3f-a04c-4dc20ae84a9e
Verdict: Malicious activity
Analysis date: May 09, 2025, 22:03:42
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
confuser
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

D39AFE32E790967049E41F9CF966AA3E

SHA1:

26D1812CEA0D62C0E139EE908E3DB5676A4A4402

SHA256:

01E1F555BF9998FCB443C2CEFE38DE9485A86C02C99E498B3F49B477313608A2

SSDEEP:

6144:1r+mzGxjxTBREcg5BJuQsnmFGAW0HqiVPPo07y:1tz8fEcIBmQKMHP7y

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 6620)

    • Modifies files in the Chrome extension folder

      • Trojan-Ransom.Win32.Encoder.mbm-9e4addf136a3502fabc6a54723f08dc3e3ba50f5116e25a9027aef140788eb92.exe (PID: 7748)

  • SUSPICIOUS

    • Write to the desktop.ini file (may be used to cloak folders)

      • Trojan-Ransom.Win32.Encoder.mbm-9e4addf136a3502fabc6a54723f08dc3e3ba50f5116e25a9027aef140788eb92.exe (PID: 7748)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6620)

    • Checks supported languages

      • Trojan-Ransom.Win32.Encoder.mbm-9e4addf136a3502fabc6a54723f08dc3e3ba50f5116e25a9027aef140788eb92.exe (PID: 7748)

    • Manual execution by a user

      • Trojan-Ransom.Win32.Encoder.mbm-9e4addf136a3502fabc6a54723f08dc3e3ba50f5116e25a9027aef140788eb92.exe (PID: 7748)

    • Reads the software policy settings

      • slui.exe (PID: 7264)

    • Confuser has been detected (YARA)

      • Trojan-Ransom.Win32.Encoder.mbm-9e4addf136a3502fabc6a54723f08dc3e3ba50f5116e25a9027aef140788eb92.exe (PID: 7748)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
ModifyDate: 2021:04:25 12:16:46+00:00
ArchivedFileName: Trojan-Ransom.Win32.Encoder.mbm-9e4addf136a3502fabc6a54723f08dc3e3ba50f5116e25a9027aef140788eb92.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
5
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe trojan-ransom.win32.encoder.mbm-9e4addf136a3502fabc6a54723f08dc3e3ba50f5116e25a9027aef140788eb92.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
6620"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\Trojan-Ransom.Win32.Encoder.mbm-9e4addf136a3502fabc6a54723f08dc3e3ba50f5116e25a9027aef140788eb92.7zC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6640C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7232C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7264"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7748"C:\Users\admin\Desktop\Trojan-Ransom.Win32.Encoder.mbm-9e4addf136a3502fabc6a54723f08dc3e3ba50f5116e25a9027aef140788eb92.exe" C:\Users\admin\Desktop\Trojan-Ransom.Win32.Encoder.mbm-9e4addf136a3502fabc6a54723f08dc3e3ba50f5116e25a9027aef140788eb92.exe
explorer.exe
User:
admin
Company:
Microsoft
Integrity Level:
HIGH
Description:
Fatura Bilgilendirme
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\trojan-ransom.win32.encoder.mbm-9e4addf136a3502fabc6a54723f08dc3e3ba50f5116e25a9027aef140788eb92.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
1 912
Read events
1 893
Write events
19
Delete events
0

Modification events

(PID) Process:(6620) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6620) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6620) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6620) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Trojan-Ransom.Win32.Encoder.mbm-9e4addf136a3502fabc6a54723f08dc3e3ba50f5116e25a9027aef140788eb92.7z
(PID) Process:(6620) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6620) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6620) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6620) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6620) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(6620) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
Executable files
1
Suspicious files
951
Text files
270
Unknown types
0

Dropped files

PID
Process
Filename
Type
7748Trojan-Ransom.Win32.Encoder.mbm-9e4addf136a3502fabc6a54723f08dc3e3ba50f5116e25a9027aef140788eb92.exeC:\Users\admin\AppData\Local\{C310C6EF-5667-4A0B-A41F-7B94CE3E6917}.partially.aes —
MD5:—
SHA256:—
7748Trojan-Ransom.Win32.Encoder.mbm-9e4addf136a3502fabc6a54723f08dc3e3ba50f5116e25a9027aef140788eb92.exeC:\Users\admin\ntuser.initext
MD5:EFD9121D80003301D45F8483868A1AAD
SHA256:B4E1470ECAF8FAE01A6DEA7CB6BEC04B59F133AC032C6DB741768D9D80B181E8
7748Trojan-Ransom.Win32.Encoder.mbm-9e4addf136a3502fabc6a54723f08dc3e3ba50f5116e25a9027aef140788eb92.exeC:\Users\admin\ntuser.ini.partially.aestext
MD5:EFD9121D80003301D45F8483868A1AAD
SHA256:B4E1470ECAF8FAE01A6DEA7CB6BEC04B59F133AC032C6DB741768D9D80B181E8
7748Trojan-Ransom.Win32.Encoder.mbm-9e4addf136a3502fabc6a54723f08dc3e3ba50f5116e25a9027aef140788eb92.exeC:\Users\admin\AppData\Local\IconCache.db.partially.aesbinary
MD5:B5FD82F8E79B919F8A5E29A4C80C0B6B
SHA256:1146D4ED087D99CD7140C0C4CE6BF554FDB7669FCAA2EDE1649EFD87567C109C
7748Trojan-Ransom.Win32.Encoder.mbm-9e4addf136a3502fabc6a54723f08dc3e3ba50f5116e25a9027aef140788eb92.exeC:\Users\admin\3D Objects\desktop.initext
MD5:6D109DD841A32A58C64857FD36B61F9D
SHA256:42F178353D4D8916264618E8EBF7343E3165F3AE9A4C846AADEE71D637C35D31
7748Trojan-Ransom.Win32.Encoder.mbm-9e4addf136a3502fabc6a54723f08dc3e3ba50f5116e25a9027aef140788eb92.exeC:\Users\admin\AppData\Local\IconCache.dbbinary
MD5:B5FD82F8E79B919F8A5E29A4C80C0B6B
SHA256:1146D4ED087D99CD7140C0C4CE6BF554FDB7669FCAA2EDE1649EFD87567C109C
6620WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6620.4221\Trojan-Ransom.Win32.Encoder.mbm-9e4addf136a3502fabc6a54723f08dc3e3ba50f5116e25a9027aef140788eb92.exeexecutable
MD5:C875BE51B4BB589AFAFF277C2EEDEEA9
SHA256:9E4ADDF136A3502FABC6A54723F08DC3E3BA50F5116E25A9027AEF140788EB92
7748Trojan-Ransom.Win32.Encoder.mbm-9e4addf136a3502fabc6a54723f08dc3e3ba50f5116e25a9027aef140788eb92.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lstbinary
MD5:ECF4B9C335EA52C73F417BD8FE97A3CE
SHA256:EA99A87A0357E4069E2A32FD3AAD1A2554A4AC263DF31BD395F419811830E549
7748Trojan-Ransom.Win32.Encoder.mbm-9e4addf136a3502fabc6a54723f08dc3e3ba50f5116e25a9027aef140788eb92.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents.partially.aesbinary
MD5:65419F90023A5A4305058B1607952564
SHA256:FF4FE76DA87EEDC353E83CCD841DCBAB4E668749BB8CF6E5D9F0E4274F2B9421
7748Trojan-Ransom.Win32.Encoder.mbm-9e4addf136a3502fabc6a54723f08dc3e3ba50f5116e25a9027aef140788eb92.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst.partially.aesbinary
MD5:0291E108006026923F78F5900BFB3361
SHA256:569CF5C90529F9B04742F5668FC4DCF7E6569D025B436DEC2A12CB4373DF9CCB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
20
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
8056
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8056
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.16.168.124:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 2.16.168.124
  • 2.16.168.114
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 184.30.21.171
whitelisted
google.com
  • 142.250.181.238
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 40.126.31.130
  • 40.126.31.71
  • 40.126.31.2
  • 20.190.159.75
  • 20.190.159.128
  • 20.190.159.4
  • 20.190.159.129
  • 20.190.159.0
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Trojan-Ransom.Win32.Encoder.mbm-9e4addf136a3502fabc6a54723f08dc3e3ba50f5116e25a9027aef140788eb92.7z