File name:

Trojan-Ransom.Win32.Encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.7z

Full analysis: https://app.any.run/tasks/939f8445-9012-410f-8aec-2ff605e71770
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: April 02, 2025, 11:27:12
OS: Windows 11 Professional (build: 22000, 64 bit)
Tags:
ransomware
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

224D394EB338113E46F4415658400FC7

SHA1:

0CC1FA9A71259202389E6493E1ADF3AF8487CB4F

SHA256:

06B2C3A89B524FE2D2217E9284AF3B8B3F78DD97B09FC4DDE2C72885DDF1C2F2

SSDEEP:

98304:Mq+f2pHct9GY3K9KuJ2DrPsYooCwtbEY7Oz9MZT7aNcnXgJ/frNLtWi0CjZ4PJVf:AfffAkFz4t8

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Renames files like ransomware

      • Trojan-Ransom.Win32.Encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.exe (PID: 4368)

    • RANSOMWARE has been detected

      • Trojan-Ransom.Win32.Encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.exe (PID: 4368)

  • SUSPICIOUS

    • The process drops C-runtime libraries

      • Trojan-Ransom.Win32.Encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.exe (PID: 364)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 4568)

    • Executable content was dropped or overwritten

      • Trojan-Ransom.Win32.Encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.exe (PID: 364)

    • Process drops python dynamic module

      • Trojan-Ransom.Win32.Encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.exe (PID: 364)

    • Process drops legitimate windows executable

      • Trojan-Ransom.Win32.Encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.exe (PID: 364)

    • Application launched itself

      • Trojan-Ransom.Win32.Encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.exe (PID: 364)

  • INFO

    • Reads the computer name

      • Trojan-Ransom.Win32.Encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.exe (PID: 364)
      • Trojan-Ransom.Win32.Encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.exe (PID: 4368)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4568)

    • Checks supported languages

      • Trojan-Ransom.Win32.Encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.exe (PID: 364)
      • Trojan-Ransom.Win32.Encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.exe (PID: 4368)

    • Drops a (possible) Coronavirus decoy

      • Trojan-Ransom.Win32.Encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.exe (PID: 4368)

    • Create files in a temporary directory

      • Trojan-Ransom.Win32.Encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.exe (PID: 364)

    • The sample compiled with english language support

      • Trojan-Ransom.Win32.Encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.exe (PID: 364)

    • Reads the machine GUID from the registry

      • Trojan-Ransom.Win32.Encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.exe (PID: 4368)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
ModifyDate: 2021:07:24 12:10:48+00:00
ArchivedFileName: Trojan-Ransom.Win32.Encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
101
Monitored processes
3
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe trojan-ransom.win32.encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.exe THREAT trojan-ransom.win32.encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
364"C:\Users\admin\AppData\Local\Temp\Rar$EXb4568.5619\Trojan-Ransom.Win32.Encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb4568.5619\Trojan-Ransom.Win32.Encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb4568.5619\trojan-ransom.win32.encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64base.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64con.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
4368"C:\Users\admin\AppData\Local\Temp\Rar$EXb4568.5619\Trojan-Ransom.Win32.Encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb4568.5619\Trojan-Ransom.Win32.Encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.exe
Trojan-Ransom.Win32.Encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb4568.5619\trojan-ransom.win32.encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64base.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64con.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
4568"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\Trojan-Ransom.Win32.Encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.7zC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
1 729
Read events
1 711
Write events
18
Delete events
0

Modification events

(PID) Process:(4568) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(4568) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(4568) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(4568) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(4568) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Trojan-Ransom.Win32.Encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.7z
(PID) Process:(4568) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4568) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4568) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4568) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4568) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
Executable files
18
Suspicious files
0
Text files
118
Unknown types
0

Dropped files

PID
Process
Filename
Type
364Trojan-Ransom.Win32.Encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.exeC:\Users\admin\AppData\Local\Temp\_MEI3642\msvcp90.dllexecutable
MD5:881A8EDAEB32D7C4C1DBE2C9DC58B030
SHA256:A6FF2EA5937A1052065EC594C36F0B3DD573BFD5A39F7160E36A7018608CC267
364Trojan-Ransom.Win32.Encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.exeC:\Users\admin\AppData\Local\Temp\_MEI3642\_socket.pydexecutable
MD5:0A75385123D11BB9A3231155B6FA35E1
SHA256:ECF37713A38E5EB5A32E872249A3018EDA2A8EAD91C73B01EDBA762385E3716E
364Trojan-Ransom.Win32.Encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.exeC:\Users\admin\AppData\Local\Temp\_MEI3642\cryptography.hazmat.bindings._padding.pydexecutable
MD5:E24FB22D82E60E9103D4C80811A899E5
SHA256:7C49D4827EE8F1E8E46833FC64D40A084157BF368AE501115295DCAFBBF13A90
364Trojan-Ransom.Win32.Encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.exeC:\Users\admin\AppData\Local\Temp\_MEI3642\Microsoft.VC90.CRT.manifestxml
MD5:EEB871034BB1FA5F1050F9E4FA87F872
SHA256:9B591FFB7C62F0D4CCB43634BB1F29F653979AF4BF326DBC2DB0C5DECB88D1A7
364Trojan-Ransom.Win32.Encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.exeC:\Users\admin\AppData\Local\Temp\_MEI3642\msvcm90.dllexecutable
MD5:DA1D9FA2EAECC0C625F63CAF7F89A4C5
SHA256:ED6A085A1A482323ED6E1A75C9FC8541C47207A486434A769B3F0C596D3C111F
364Trojan-Ransom.Win32.Encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.exeC:\Users\admin\AppData\Local\Temp\_MEI3642\_ssl.pydexecutable
MD5:1984F73F94D11E197EFAEC2DC41232F5
SHA256:BCAD190AB35F96A8F360131C0B7138DCD826BA8A903679510FFB34CA4F73CC77
364Trojan-Ransom.Win32.Encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.exeC:\Users\admin\AppData\Local\Temp\_MEI3642\msvcr90.dllexecutable
MD5:1B5C42A4E92703D7F1C85B6D0B8F1C34
SHA256:2E13FA6FEAA89396A67FB0C1C32924D2019236D34B6F97CF13287CC7D7395149
364Trojan-Ransom.Win32.Encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.exeC:\Users\admin\AppData\Local\Temp\_MEI3642\python27.dllexecutable
MD5:90409863E2E20E257E4FA5233F08FE41
SHA256:D692013F1D2B9BEE0BC01B3B445448DE3C4B84B307E53952FCD625A235A8FE37
364Trojan-Ransom.Win32.Encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.exeC:\Users\admin\AppData\Local\Temp\_MEI3642\select.pydexecutable
MD5:62BA9D94EDA05433731615614E4B9E1D
SHA256:E8CB36CF6B46881D5DCA66F9B1074E68148CD464F065BED7D89E6E5FCDCAF00D
4568WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb4568.5619\Trojan-Ransom.Win32.Encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.exeexecutable
MD5:E0EE0907D0E2C4ED30D39D30DC66A985
SHA256:6D42326A77499DF71B235C63703B0D4F4E77DB09360C715F8F4312ACF000A9B2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
12
DNS requests
7
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2352
smartscreen.exe
GET
200
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1204dd0d726a570f
unknown
—
—
whitelisted
2352
smartscreen.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
3640
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1352
svchost.exe
GET
200
23.53.42.66:80
http://www.msftconnecttest.com/connecttest.txt
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1352
svchost.exe
23.53.42.64:80
—
Akamai International B.V.
DE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
2352
smartscreen.exe
48.209.144.71:443
checkappexec.microsoft.com
—
US
whitelisted
2352
smartscreen.exe
199.232.214.172:80
ctldl.windowsupdate.com
FASTLY
US
whitelisted
2352
smartscreen.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
4976
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3640
svchost.exe
40.126.32.138:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3640
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
4976
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2776
svchost.exe
20.42.72.131:443
v10.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
checkappexec.microsoft.com
  • 48.209.144.71
whitelisted
ctldl.windowsupdate.com
  • 199.232.214.172
  • 199.232.210.172
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
whitelisted
login.live.com
  • 40.126.32.138
  • 40.126.32.133
  • 40.126.32.134
  • 40.126.32.140
  • 20.190.160.22
  • 20.190.160.5
  • 20.190.160.14
  • 20.190.160.67
whitelisted
v10.events.data.microsoft.com
  • 20.42.72.131
whitelisted

Threats

PID
Process
Class
Message
1352
svchost.exe
Misc activity
ET INFO Microsoft Connection Test
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Trojan-Ransom.Win32.Encoder.ndq-6d42326a77499df71b235c63703b0d4f4e77db09360c715f8f4312acf000a9b2.7z