File name:

stretcher.exe

Full analysis: https://app.any.run/tasks/4e96692b-c743-4d94-8fd7-1205725a0b63
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: April 15, 2025, 17:17:45
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
ransomware
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64, for MS Windows, 19 sections
MD5:

DBDC0ECA0F8B2C5FDFB062622C99E3FD

SHA1:

B7FD9592CEFB8A05B50D8DC0321C4A1E28F5A147

SHA256:

164B01071C8ACBE4A3993CB9B55CF43E8BDF8CB1AADA020CE2D1090CADB492E5

SSDEEP:

49152:dspDMytgxyPJbzZ+pnfCM1FLZ8NaNC1+ZrS5huGNQ/EWhgLdT:dIDPOnJ/ZrS5huGNQ/EWhgLdT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • stretcher.exe (PID: 2136)
      • stretcher.exe (PID: 6476)

    • Deletes shadow copies

      • cmd.exe (PID: 4652)
      • cmd.exe (PID: 1676)

    • RANSOMWARE has been detected

      • stretcher.exe (PID: 2136)
      • stretcher.exe (PID: 6476)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • stretcher.exe (PID: 2136)
      • stretcher.exe (PID: 6476)

    • Hides command output

      • cmd.exe (PID: 4652)
      • cmd.exe (PID: 1676)

    • Write to the desktop.ini file (may be used to cloak folders)

      • stretcher.exe (PID: 2136)

    • Executes application which crashes

      • stretcher.exe (PID: 2136)
      • stretcher.exe (PID: 6476)

  • INFO

    • Checks supported languages

      • stretcher.exe (PID: 2136)
      • stretcher.exe (PID: 6476)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 1228)
      • WerFault.exe (PID: 1532)

    • Manual execution by a user

      • stretcher.exe (PID: 6476)
      • mspaint.exe (PID: 1184)
      • WINWORD.EXE (PID: 1532)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:04:15 17:17:18+00:00
ImageFileCharacteristics: Executable, No line numbers, Large address aware
PEType: PE32+
LinkerVersion: 2.44
CodeSize: 916480
InitializedDataSize: 236032
UninitializedDataSize: 3584
EntryPoint: 0x1125
OSVersion: 4
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
149
Monitored processes
17
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start THREAT stretcher.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs vssadmin.exe no specs werfault.exe no specs sppextcomobj.exe no specs slui.exe no specs THREAT stretcher.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs vssadmin.exe no specs werfault.exe no specs mspaint.exe no specs winword.exe ai.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
904\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1184"C:\WINDOWS\system32\mspaint.exe" "C:\Users\admin\Desktop\olderposted.jpg"C:\Windows\System32\mspaint.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Paint
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mspaint.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1228C:\WINDOWS\system32\WerFault.exe -u -p 2136 -s 72C:\Windows\System32\WerFault.exe—stretcher.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
1532C:\WINDOWS\system32\WerFault.exe -u -p 6476 -s 84C:\Windows\System32\WerFault.exe—stretcher.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\oleaut32.dll
1532"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\admin\Desktop\significantbill.rtf" /o ""C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
1676C:\WINDOWS\system32\cmd.exe /c vssadmin delete shadows /all /quiet >nul 2>&1C:\Windows\System32\cmd.exe—stretcher.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
2136"C:\Users\admin\Desktop\stretcher.exe" C:\Users\admin\Desktop\stretcher.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226505
Modules
Images
c:\users\admin\desktop\stretcher.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2552"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "7FC01B89-F46A-40C5-B502-FFBA432580FC" "FB0047DB-7DCC-46A6-B8AB-10C75ACF965B" "1532"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll
4120C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
4408"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
8 745
Read events
8 634
Write events
96
Delete events
15

Modification events

(PID) Process:(2136) stretcher.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:StretcherUpdate
Value:
C:\Users\admin\Desktop\stretcher.exe
(PID) Process:(6476) stretcher.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:StretcherUpdate
Value:
C:\Users\admin\Desktop\stretcher.exe
(PID) Process:(1184) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:WindowPlacement
Value:
2C00000000000000010000000000000000000000FFFFFFFFFFFFFFFF7F000000470000007F04000087020000
(PID) Process:(1184) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:ShowThumbnail
Value:
0
(PID) Process:(1184) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:BMPWidth
Value:
0
(PID) Process:(1184) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:BMPHeight
Value:
0
(PID) Process:(1184) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:ThumbXPos
Value:
0
(PID) Process:(1184) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:ThumbYPos
Value:
0
(PID) Process:(1184) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:ThumbWidth
Value:
0
(PID) Process:(1184) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:ThumbHeight
Value:
0
Executable files
2
Suspicious files
24
Text files
4
Unknown types
1

Dropped files

PID
Process
Filename
Type
1228WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_stretcher.exe_2db079223fbaf7a79c8ce1237d3719ea46d8d55_138749ae_ca8ae906-9c3a-40e8-953b-d776df582af8\Report.wer —
MD5:—
SHA256:—
1532WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_stretcher.exe_2db079223fbaf7a79c8ce1237d3719ea46d8d55_138749ae_a4e31525-b349-4fb0-8d2d-e9851f92aa30\Report.wer —
MD5:—
SHA256:—
1228WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERBD37.tmp.dmpbinary
MD5:7538955DF6A3340BB2366983F03B3848
SHA256:22E903C584907CBEB23D667C58C73DAFC477474957834AFDCCBCA3B48D610650
2136stretcher.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.ini.stretchedtext
MD5:B4A3082FC4AACCCBF5288CF374426A2E
SHA256:295D88E9A46D5750BF245E8EE7B46D859568C83AE97A086B94251931B15AFBA3
2136stretcher.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.initext
MD5:B4A3082FC4AACCCBF5288CF374426A2E
SHA256:295D88E9A46D5750BF245E8EE7B46D859568C83AE97A086B94251931B15AFBA3
1228WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\stretcher.exe.2136.dmpbinary
MD5:9854B1AB87EDC8ED17CE7A8A448F783B
SHA256:0A70DAC1ACED3EEC4C79C0D6093C287749AE0C9E2255B82BF6DB72D867CB898B
1228WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERBDC5.tmp.WERInternalMetadata.xmlbinary
MD5:0F3A47740C59DC0C00C8402DE3BE197B
SHA256:244EFCB1A0E81979600AB64A25FAB3263E0295A3148D0FF1DB717D2E5FF8504B
1228WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERBE24.tmp.xmlxml
MD5:77CBAA05A9209004AB3D6CB8ECA08505
SHA256:513D24C571018788F91B148CF88F401E158204F1530CF5537DF238D26CC15FDE
1532WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERDB5E.tmp.dmpbinary
MD5:FF10302390A3D1DE07C3E43C5E5CE248
SHA256:5C69E8B17880D61A715C5D9A1B48589F172B32E99D17604A895835FB0109B744
1532WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERDBAD.tmp.WERInternalMetadata.xmlbinary
MD5:FEF603C26C43B5E834790113A3B03F1F
SHA256:692E5E818E3A8B025A447CDF1FB66C310F95E521312E988CF84347D5BBA0EBDB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
17
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.179:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.48.23.179:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.67:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4244
SIHClient.exe
20.12.23.50:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1532
WINWORD.EXE
52.109.76.240:443
officeclient.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.48.23.179
  • 23.48.23.153
  • 23.48.23.174
  • 23.48.23.163
  • 23.48.23.150
  • 23.48.23.166
  • 23.48.23.162
  • 23.48.23.175
  • 23.48.23.177
whitelisted
google.com
  • 172.217.18.110
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 40.126.31.67
  • 40.126.31.131
  • 40.126.31.128
  • 40.126.31.130
  • 40.126.31.129
  • 20.190.159.75
  • 40.126.31.3
  • 40.126.31.71
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
officeclient.microsoft.com
  • 52.109.76.240
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
stretcher.exe