File name:

HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.7z

Full analysis: https://app.any.run/tasks/502fcd83-d9c9-4dab-9796-2e9b7eb527d3
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: March 22, 2025, 00:20:27
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
stealer
evasion
discord
exfiltration
ransomware
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

0291A07BDE34DBECC6B14A6C5021CC96

SHA1:

50AEB195851C1C0D1ECDC9290DA3E77E975722B1

SHA256:

15248FEE2DF4C96F4272298B2A718F44E27D6A7FB7200803B22ECAC49D933159

SSDEEP:

768:JbdniBmrQ9SXuC+3wl9mitNkjGMca0ihk+J/kf:b9qSXuC+3Kmi/kiMcHihk+J6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 680)

    • RANSOMWARE has been detected

      • HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.exe (PID: 2088)

    • Changes the autorun value in the registry

      • HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.exe (PID: 2088)

    • Actions looks like stealing of personal data

      • HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.exe (PID: 2088)

    • Steals credentials from Web Browsers

      • HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.exe (PID: 2088)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.exe (PID: 2088)

    • Accesses product unique identifier via WMI (SCRIPT)

      • WMIC.exe (PID: 7540)

    • The process connected to a server suspected of theft

      • HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.exe (PID: 2088)

    • Checks for external IP

      • HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.exe (PID: 2088)

    • Starts CMD.EXE for commands execution

      • HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.exe (PID: 2088)

    • Uses WMIC.EXE to obtain Windows Installer data

      • cmd.exe (PID: 7208)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 680)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 1812)
      • HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.exe (PID: 2088)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 7188)
      • BackgroundTransferHost.exe (PID: 1812)
      • BackgroundTransferHost.exe (PID: 3100)
      • BackgroundTransferHost.exe (PID: 7772)
      • WMIC.exe (PID: 7540)
      • BackgroundTransferHost.exe (PID: 7616)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 1812)
      • HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.exe (PID: 2088)

    • Checks supported languages

      • HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.exe (PID: 2088)

    • Reads the computer name

      • HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.exe (PID: 2088)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 1812)
      • HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.exe (PID: 2088)

    • Create files in a temporary directory

      • HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.exe (PID: 2088)

    • Manual execution by a user

      • HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.exe (PID: 2088)

    • Disables trace logs

      • HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.exe (PID: 2088)

    • Reads the machine GUID from the registry

      • HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.exe (PID: 2088)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
ModifyDate: 2021:07:24 12:16:34+00:00
ArchivedFileName: HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
148
Monitored processes
12
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe THREAT heur-trojan-ransom.win32.generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.exe backgroundtransferhost.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
680"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.7zC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
728\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1812"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
2088"C:\Users\admin\Desktop\HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.exe" C:\Users\admin\Desktop\HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
NitroRansomware
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\heur-trojan-ransom.win32.generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
3100"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
7188"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
7208"cmd.exe"C:\Windows\SysWOW64\cmd.exe—HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7280C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7312"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7540wmic csproduct get uuidC:\Windows\SysWOW64\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
3 970
Read events
3 921
Write events
49
Delete events
0

Modification events

(PID) Process:(680) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(680) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(680) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(680) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.7z
(PID) Process:(680) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(680) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(680) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(680) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(680) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(680) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
Executable files
2
Suspicious files
45
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
1812BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\fcc3b3bd-74df-4113-acc6-bd8e9fee3c9b.down_data —
MD5:—
SHA256:—
1812BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\fcc3b3bd-74df-4113-acc6-bd8e9fee3c9b.1261a8c0-5dca-4a55-837d-cc9351a9ed99.down_metabinary
MD5:255C8C100389A5AC5698EBD23796AD9D
SHA256:BA3C5BB9C254C2A1B7FA6343761626B4CDBF09A680B8659EB808AD224BB029C4
680WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb680.14323\HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.exeexecutable
MD5:6BB07E39B4D4E9BFBB9E54E258DF3A69
SHA256:243CCA1B7D2EFE5E5D22CF1FCD5E3B93F048D82851ED4CE5DA03A575E70346F9
1812BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:B97E400964900BC2D8274B887D5AA1F4
SHA256:9EE0020FE1FECDEEE0309A80F5EB6BC02AF0793E11C4A230C7931D4C6BC662ED
1812BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\7e5536dd-799c-4621-97c1-4a86e4d6490e.1261a8c0-5dca-4a55-837d-cc9351a9ed99.down_metabinary
MD5:255C8C100389A5AC5698EBD23796AD9D
SHA256:BA3C5BB9C254C2A1B7FA6343761626B4CDBF09A680B8659EB808AD224BB029C4
2088HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.exeC:\Users\admin\Pictures\againstadult.png.givemenitrobinary
MD5:9B8ED7B3CDBE3BF9698342AD353EC62B
SHA256:8138A2269A75DD91650C3B7793DFA7887E64ECF5FDD39216B5153845B3F7E944
2088HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.exeC:\Users\admin\Desktop\balleffective.png.givemenitrobinary
MD5:8CF32B15ACB0A255E1D0EEC2DC669C35
SHA256:A98D19184CB900370499AE38267ED0BF315AA9CB750D893E2DD26A121745C8F2
2088HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.exeC:\Users\admin\Desktop\desktop.ini.givemenitrobinary
MD5:487772C1F52F8DF73FBA32B941714C6B
SHA256:D7E72E065F9685811745B070F30DCB5739D4216AFFA1D7D3C29B7047E9E1631F
2088HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.exeC:\Users\admin\Pictures\angelesfemale.png.givemenitrobinary
MD5:BD2D2ECA4E02C7123E707C6DC763DBDE
SHA256:AE53500210C093DA77928298EEA1A31C904AB4501893457F2A842E9B69F89C0D
2088HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.exeC:\Users\admin\Desktop\HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.7z.givemenitrobinary
MD5:2F3B0372279CBB2237A0E8BD4893AD56
SHA256:05437C01122CB39D2A62B2EC97912292758BDD2F973642C2BB0A611A8F9B8825
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
30
DNS requests
16
Threats
15

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7384
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
8068
SIHClient.exe
GET
200
104.119.109.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1812
BackgroundTransferHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
8068
SIHClient.exe
GET
200
104.119.109.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6480
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.160.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.142
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
login.live.com
  • 20.190.160.128
  • 20.190.160.66
  • 40.126.32.133
  • 40.126.32.138
  • 20.190.160.4
  • 20.190.160.131
  • 40.126.32.136
  • 20.190.160.20
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted
www.bing.com
  • 104.126.37.153
  • 104.126.37.171
  • 104.126.37.139
  • 104.126.37.155
  • 104.126.37.147
  • 104.126.37.137
  • 104.126.37.162
  • 104.126.37.176
  • 104.126.37.136
whitelisted
api.ipify.org
  • 104.26.12.205
  • 172.67.74.152
  • 104.26.13.205
shared
discord.com
  • 162.159.128.233
  • 162.159.137.232
  • 162.159.136.232
  • 162.159.135.232
  • 162.159.138.232
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
2088
HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.exe
Misc activity
ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
2196
svchost.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
2088
HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
2196
svchost.exe
Misc activity
ET INFO Discord Chat Service Domain in DNS Lookup (discord .com)
2088
HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.exe
Successful Credential Theft Detected
STEALER [ANY.RUN] Attempt to exfiltrate via Discord
2088
HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.exe
Misc activity
ET INFO Observed Discord Service Domain (discord .com) in TLS SNI
2088
HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
2088
HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.exe
Misc activity
ET INFO Observed Discord Service Domain (discord .com) in TLS SNI
2088
HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
HEUR-Trojan-Ransom.Win32.Generic-243cca1b7d2efe5e5d22cf1fcd5e3b93f048d82851ed4ce5da03a575e70346f9.7z