File name:

lockscreen_8527822f2dc12a1db55b9cd3abacbe0add435e73.7z

Full analysis: https://app.any.run/tasks/6d5e3c48-07fe-42f4-bc0a-eb14510aaf82
Verdict: Malicious activity
Analysis date: May 15, 2025, 18:54:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
arch-exec
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

F952DA903FC579416379878D1352210B

SHA1:

EF585BFAC4D28DE8DE1AF9E2C5713AB8AA3DEBA8

SHA256:

0D732B5B253EA5DC33D642338BA5EAAA769266025B4FD475CE69CD3C8D868994

SSDEEP:

1536:3wndSIQC7Rfy6bM5A5/G1u719feDhARNIsSqM0zhPFmQ:3qSTMRf9M5Aqu7f0h6K5qp9PF3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 2624)

    • Changes the autorun value in the registry

      • lockscreen_8527822f2dc12a1db55b9cd3abacbe0add435e73.exe (PID: 3140)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • lockscreen_8527822f2dc12a1db55b9cd3abacbe0add435e73.exe (PID: 3140)

    • Starts CMD.EXE for commands execution

      • lockscreen_8527822f2dc12a1db55b9cd3abacbe0add435e73.exe (PID: 3140)

    • Reads the Internet Settings

      • lockscreen_8527822f2dc12a1db55b9cd3abacbe0add435e73.exe (PID: 3140)
      • firefox.exe (PID: 1504)

    • Starts itself from another location

      • lockscreen_8527822f2dc12a1db55b9cd3abacbe0add435e73.exe (PID: 3140)

    • Executing commands from a ".bat" file

      • lockscreen_8527822f2dc12a1db55b9cd3abacbe0add435e73.exe (PID: 3140)

    • Reads security settings of Internet Explorer

      • lockscreen_8527822f2dc12a1db55b9cd3abacbe0add435e73.exe (PID: 3140)
      • firefox.exe (PID: 1504)

    • There is functionality for taking screenshot (YARA)

      • firefox.exe (PID: 1504)

  • INFO

    • Manual execution by a user

      • lockscreen_8527822f2dc12a1db55b9cd3abacbe0add435e73.exe (PID: 3140)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2624)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 2624)
      • lockscreen_8527822f2dc12a1db55b9cd3abacbe0add435e73.exe (PID: 3140)

    • Reads the computer name

      • lockscreen_8527822f2dc12a1db55b9cd3abacbe0add435e73.exe (PID: 3140)
      • firefox.exe (PID: 1504)

    • Checks supported languages

      • firefox.exe (PID: 1504)
      • lockscreen_8527822f2dc12a1db55b9cd3abacbe0add435e73.exe (PID: 3140)

    • Checks proxy server information

      • firefox.exe (PID: 1504)

    • Reads the machine GUID from the registry

      • firefox.exe (PID: 1504)

    • Creates files or folders in the user directory

      • lockscreen_8527822f2dc12a1db55b9cd3abacbe0add435e73.exe (PID: 3140)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
ModifyDate: 2011:02:25 05:19:30+00:00
ArchivedFileName: lockscreen_8527822f2dc12a1db55b9cd3abacbe0add435e73.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe lockscreen_8527822f2dc12a1db55b9cd3abacbe0add435e73.exe cmd.exe no specs firefox.exe

Process information

PID
CMD
Path
Indicators
Parent process
1504"C:\Users\admin\AppData\Roaming\Mozilla\Firefox\firefox.exe" C:\Users\admin\AppData\Roaming\Mozilla\Firefox\firefox.exe
lockscreen_8527822f2dc12a1db55b9cd3abacbe0add435e73.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\roaming\mozilla\firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2100C:\Windows\system32\cmd.exe /c ""C:\Users\admin\Desktop\clear.bat" "C:\Windows\System32\cmd.exe—lockscreen_8527822f2dc12a1db55b9cd3abacbe0add435e73.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2624"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\lockscreen_8527822f2dc12a1db55b9cd3abacbe0add435e73.7zC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3140"C:\Users\admin\Desktop\lockscreen_8527822f2dc12a1db55b9cd3abacbe0add435e73.exe" C:\Users\admin\Desktop\lockscreen_8527822f2dc12a1db55b9cd3abacbe0add435e73.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\lockscreen_8527822f2dc12a1db55b9cd3abacbe0add435e73.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
4 037
Read events
3 979
Write events
52
Delete events
6

Modification events

(PID) Process:(2624) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2624) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2624) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2624) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2624) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\lockscreen_8527822f2dc12a1db55b9cd3abacbe0add435e73.7z
(PID) Process:(2624) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2624) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2624) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2624) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2624) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
Executable files
2
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3140lockscreen_8527822f2dc12a1db55b9cd3abacbe0add435e73.exeC:\Users\admin\Desktop\clear.battext
MD5:B6594D0E5A769149D556D392056C33DE
SHA256:91F9B9F18DDA5496EC8D8E75CC1B14FBD7CE3ACF6CE9832DF65BBCBEA2FBF7EB
3140lockscreen_8527822f2dc12a1db55b9cd3abacbe0add435e73.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\firefox.exeexecutable
MD5:EEE591F8DD317BB7E2F8A1FBF971601B
SHA256:C24B9564C6D41747FB61B9904987E3DB4178C33726CA2048B4DB243FA7F603F7
2624WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2624.7182\lockscreen_8527822f2dc12a1db55b9cd3abacbe0add435e73.exeexecutable
MD5:EEE591F8DD317BB7E2F8A1FBF971601B
SHA256:C24B9564C6D41747FB61B9904987E3DB4178C33726CA2048B4DB243FA7F603F7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
12
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1504
firefox.exe
POST
404
49.13.77.253:80
http://mpriagribik.com/
unknown
—
—
unknown
1504
firefox.exe
POST
404
49.13.77.253:80
http://widowylucenti.info/
unknown
—
—
unknown
1504
firefox.exe
POST
404
49.13.77.253:80
http://ilanjihaemta.info/
unknown
—
—
unknown
1504
firefox.exe
POST
404
49.13.77.253:80
http://fowdensuljo.info/
unknown
—
—
unknown
1504
firefox.exe
POST
404
49.13.77.253:80
http://thijmsmawworm.info/
unknown
—
—
unknown
1504
firefox.exe
POST
404
49.13.77.253:80
http://saynerclecak.info/
unknown
—
—
unknown
1504
firefox.exe
POST
404
49.13.77.253:80
http://pilbeamcanar.info/
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1504
firefox.exe
49.13.77.253:80
mpriagribik.com
Hetzner Online GmbH
DE
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.78
whitelisted
mpriagribik.com
  • 49.13.77.253
unknown
widowylucenti.info
  • 49.13.77.253
unknown
thijmsmawworm.info
  • 49.13.77.253
unknown
pilbeamcanar.info
  • 49.13.77.253
unknown
ilanjihaemta.info
  • 49.13.77.253
unknown
fowdensuljo.info
  • 49.13.77.253
unknown
saynerclecak.info
  • 49.13.77.253
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
lockscreen_8527822f2dc12a1db55b9cd3abacbe0add435e73.7z