File name:

wormlocker.zip

Full analysis: https://app.any.run/tasks/d7a96923-30e2-4768-953e-5d94285c0945
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: April 25, 2025, 03:20:52
OS: Windows 11 Professional (build: 22000, 64 bit)
Tags:
wormlocker
ransomware
ransomware
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

91CF2586B60B7D7B93C42E71877868EC

SHA1:

64FC3726753697A379C6B9CE3C60312C5F174AEA

SHA256:

15C7AEA528C2C94D585217EC6C0C78CB388053378606E3883E428CBD2D2BD595

SSDEEP:

6144:9+M2MW5bZwOkxUdhm1nEES8SlqTqqdm685BINYrPis2ZG1848A:9HIZwOHdwnEEj4qoF5eePyZG1+A

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Disables task manager

      • worm.exe (PID: 5872)

    • WORMLOCKER has been detected (YARA)

      • worm.exe (PID: 5872)

    • WORMLOCKER has been detected

      • worm.exe (PID: 5872)

    • Changes the login/logoff helper path in the registry

      • WormLocker2.0.exe (PID: 3620)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • worm.exe (PID: 5872)
      • WormLocker2.0.exe (PID: 3620)

    • Reads the Internet Settings

      • worm.exe (PID: 5872)
      • WormLocker2.0.exe (PID: 3620)
      • OpenWith.exe (PID: 4132)
      • wscript.exe (PID: 5872)

    • Starts CMD.EXE for commands execution

      • worm.exe (PID: 5872)

    • Reads security settings of Internet Explorer

      • worm.exe (PID: 5872)
      • WormLocker2.0.exe (PID: 3620)

    • Takes ownership (TAKEOWN.EXE)

      • cmd.exe (PID: 5780)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 5780)

    • The process checks if it is being run in the virtual environment

      • icacls.exe (PID: 2472)

    • Executable content was dropped or overwritten

      • worm.exe (PID: 5872)

    • Process drops legitimate windows executable

      • worm.exe (PID: 5872)

    • The process executes VB scripts

      • WormLocker2.0.exe (PID: 3620)

  • INFO

    • Manual execution by a user

      • worm.exe (PID: 4780)
      • worm.exe (PID: 5872)
      • OpenWith.exe (PID: 4132)
      • rundll32.exe (PID: 1916)
      • rundll32.exe (PID: 1800)
      • rundll32.exe (PID: 5344)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1340)

    • Reads the computer name

      • worm.exe (PID: 5872)
      • WormLocker2.0.exe (PID: 3620)

    • Reads the machine GUID from the registry

      • worm.exe (PID: 5872)
      • WormLocker2.0.exe (PID: 3620)

    • Checks supported languages

      • worm.exe (PID: 5872)
      • WormLocker2.0.exe (PID: 3620)

    • Creates files or folders in the user directory

      • worm.exe (PID: 5872)

    • The sample compiled with english language support

      • worm.exe (PID: 5872)

    • Reads security settings of Internet Explorer

      • OpenWith.exe (PID: 4132)

    • Reads Microsoft Office registry keys

      • OpenWith.exe (PID: 4132)
      • WormLocker2.0.exe (PID: 3620)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0009
ZipCompression: Unknown (99)
ZipModifyDate: 2025:04:23 00:27:08
ZipCRC: 0xd8423c30
ZipCompressedSize: 204427
ZipUncompressedSize: 321536
ZipFileName: worm.bin
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
117
Monitored processes
13
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe worm.exe no specs #WORMLOCKER worm.exe cmd.exe no specs conhost.exe no specs takeown.exe no specs icacls.exe no specs wormlocker2.0.exe openwith.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs wscript.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1340"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\wormlocker.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1800"C:\Windows\System32\rundll32.exe" "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\admin\Downloads\sourcesfloor.jpgC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcp_win.dll
1916"C:\Windows\System32\rundll32.exe" "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\admin\Downloads\hostingpricing.pngC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcp_win.dll
2472icacls C:\Windows\System32 /grant "admin:F"C:\Windows\System32\icacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
0
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ntmarta.dll
3620"C:\Windows\System32\WormLocker2.0.exe" C:\Windows\System32\WormLocker2.0.exe
worm.exe
User:
admin
Integrity Level:
HIGH
Description:
WormLocker2.0
Version:
1.0.0.0
Modules
Images
c:\windows\system32\wormlocker2.0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
4032takeown /f C:\Windows\System32 C:\Windows\System32\takeown.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Takes ownership of a file
Exit code:
0
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\takeown.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
4132"C:\Windows\System32\OpenWith.exe" C:\Users\admin\Downloads\worm_tool.sysC:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
2147943623
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4780"C:\Users\admin\Desktop\worm.exe" C:\Users\admin\Desktop\worm.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
SysWOW64
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\worm.exe
c:\windows\system32\ntdll.dll
5344"C:\Windows\System32\rundll32.exe" "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\admin\Downloads\yorkanti.jpgC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcp_win.dll
5780"C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "%username%:F"C:\Windows\System32\cmd.exe—worm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
Total events
7 939
Read events
7 702
Write events
237
Delete events
0

Modification events

(PID) Process:(1340) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1340) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1340) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(1340) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(1340) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\wormlocker.zip
(PID) Process:(1340) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1340) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1340) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1340) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1340) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
Executable files
5
Suspicious files
13
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
5872worm.exeC:\Windows\System32\LogonUIinf.exeexecutable
MD5:31618202EB911F6606405D237E098AD0
SHA256:7944285565408818FAE6F861D45D7A722F5AC630DA98FB762826F061831E46F4
3620WormLocker2.0.exeC:\Users\admin\Downloads\worm_tool.systext
MD5:5031E9989AE1AB3BA509B7D4220C0DDF
SHA256:954D1BB83D80BB6F6E746B28F0DE3EC4C4ED980CFE67ED23A9159CD464FF339A
5872worm.exeC:\Windows\System32\LogonUI.exeexecutable
MD5:31618202EB911F6606405D237E098AD0
SHA256:7944285565408818FAE6F861D45D7A722F5AC630DA98FB762826F061831E46F4
5872worm.exeC:\Windows\System32\ransom_voice.vbstext
MD5:C1F9613622F740C2F00C2FA8881BA7BA
SHA256:D200A1E942B8CFDCD8190D1AD59F92E27E39B919BA230F2DD88D70C3DF428C7B
3620WormLocker2.0.exeC:\Users\admin\Downloads\sourcesfloor.jpgbinary
MD5:D1C913D81C11E785ECC1A62EF5BDA08A
SHA256:DA2EE5B851438CE5009785E6B1B008E686A62D1BF5F17FB55DAC3786AB050347
3620WormLocker2.0.exeC:\Users\admin\Desktop\stonesmall.rtfbinary
MD5:A01841D35E8F86B3DEE91211F10D2426
SHA256:B2DFB5C0D0816FD9B65EF33BA687AC29868388D43946BD2461EEF8B2C512E7F4
3620WormLocker2.0.exeC:\Users\admin\Desktop\pokerclothing.jpgbinary
MD5:90C5C7172BF2460015E22B67B505917F
SHA256:8367C194D34F47AB487E21B9EF691EBCFF291DC3FD07F4454CFBB6CDB3533A9F
3620WormLocker2.0.exeC:\Users\admin\Desktop\justkitchen.jpgbinary
MD5:A7648A404268E0E40F4A6702FAC300D3
SHA256:5D64C62B5203908752E9EEA9A2195187A810E36107B52B3E81790F619D6FB1E8
1340WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1340.7972\worm.binexecutable
MD5:625B3BC77882BF44C130764523809880
SHA256:E669612603FF42188ED3356DA7DD568550E61EC6B9B69992DE371B4317C9E068
3620WormLocker2.0.exeC:\Users\admin\Downloads\hostingpricing.pngbinary
MD5:D11B2549F406A5F52624061FF6A0474D
SHA256:0F651D459D2BF63362DF3A84354152F6064C72F83C5E46CC453A77C88CD276AA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
17
DNS requests
10
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2440
smartscreen.exe
GET
200
208.89.74.31:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?4860b3a47440b4af
unknown
—
—
whitelisted
2440
smartscreen.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
2768
svchost.exe
GET
200
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?cd93d97035913c62
unknown
—
—
whitelisted
2768
svchost.exe
GET
200
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?966e481a9fe01acd
unknown
—
—
whitelisted
2768
svchost.exe
GET
200
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?ec355da27201ae0c
unknown
—
—
whitelisted
1352
svchost.exe
GET
200
23.32.239.82:80
http://www.msftconnecttest.com/connecttest.txt
unknown
—
—
whitelisted
2768
svchost.exe
GET
200
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?96d7e1e649d02ef8
unknown
—
—
whitelisted
3640
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2988
OfficeClickToRun.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1352
svchost.exe
23.32.239.16:80
—
Akamai International B.V.
DE
unknown
—
—
239.255.255.250:1900
—
—
—
whitelisted
2440
smartscreen.exe
48.209.144.71:443
checkappexec.microsoft.com
—
US
whitelisted
2440
smartscreen.exe
208.89.74.31:80
ctldl.windowsupdate.com
—
US
whitelisted
2440
smartscreen.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
3560
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3640
svchost.exe
20.190.160.65:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3640
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
5136
svchost.exe
23.197.142.186:443
fs.microsoft.com
Akamai International B.V.
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.78
whitelisted
checkappexec.microsoft.com
  • 48.209.144.71
whitelisted
ctldl.windowsupdate.com
  • 208.89.74.31
  • 208.89.74.21
  • 208.89.74.19
  • 208.89.74.27
  • 208.89.74.29
  • 208.89.74.23
  • 208.89.74.17
  • 199.232.214.172
  • 199.232.210.172
whitelisted
ocsp.digicert.com
  • 184.30.131.245
  • 2.23.77.188
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
login.live.com
  • 20.190.160.65
  • 20.190.160.14
  • 40.126.32.72
  • 20.190.160.3
  • 40.126.32.136
  • 20.190.160.67
  • 20.190.160.20
  • 20.190.160.2
whitelisted
fs.microsoft.com
  • 23.197.142.186
whitelisted
self.events.data.microsoft.com
  • 52.168.117.168
whitelisted

Threats

PID
Process
Class
Message
1352
svchost.exe
Misc activity
ET INFO Microsoft Connection Test
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
wormlocker.zip