File name:

Endermanch@PolyRansom.exe

Full analysis: https://app.any.run/tasks/968fed01-5c7f-45df-80cb-7c8bb2b5a33d
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 21:25:16
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
virlock
ransomware
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 2 sections
MD5:

3ED3FB296A477156BC51ABA43D825FC0

SHA1:

9CAA5C658B1A88FEE149893D3A00B34A8BB8A1A6

SHA256:

1898F2CAE1E3824CB0F7FD5368171A33ABA179E63501E480B4DA9EA05EBF0423

SSDEEP:

3072:EJv/3Ppzq+M4Lh5VWK5qlYRV+hvuFiweXXbGgL90v5mq33Z3:8hzEA5GlYMWFBeXvx0c+3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • Endermanch@PolyRansom.exe (PID: 2600)
      • SwoYcckM.exe (PID: 6516)
      • XWAQAQUE.exe (PID: 5504)

    • VIRLOCK mutex has been found

      • SwoYcckM.exe (PID: 6516)
      • Endermanch@PolyRansom.exe (PID: 2600)
      • XWAQAQUE.exe (PID: 5504)
      • Endermanch@PolyRansom.exe (PID: 4880)
      • Endermanch@PolyRansom.exe (PID: 920)
      • Endermanch@PolyRansom.exe (PID: 5968)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • cscript.exe (PID: 4988)
      • cscript.exe (PID: 1764)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Endermanch@PolyRansom.exe (PID: 2600)
      • SwoYcckM.exe (PID: 6516)

    • The executable file from the user directory is run by the CMD process

      • Endermanch@PolyRansom.exe (PID: 4880)
      • Endermanch@PolyRansom.exe (PID: 920)
      • Endermanch@PolyRansom.exe (PID: 5968)

    • Uses REG/REGEDIT.EXE to modify registry

      • Endermanch@PolyRansom.exe (PID: 2600)
      • Endermanch@PolyRansom.exe (PID: 4880)
      • Endermanch@PolyRansom.exe (PID: 920)

    • Starts CMD.EXE for commands execution

      • Endermanch@PolyRansom.exe (PID: 2600)
      • Endermanch@PolyRansom.exe (PID: 4880)
      • Endermanch@PolyRansom.exe (PID: 920)

    • Executing commands from a ".bat" file

      • Endermanch@PolyRansom.exe (PID: 2600)
      • Endermanch@PolyRansom.exe (PID: 4880)

    • The process executes VB scripts

      • cmd.exe (PID: 6048)
      • cmd.exe (PID: 5556)

    • Connects to unusual port

      • SwoYcckM.exe (PID: 6516)
      • XWAQAQUE.exe (PID: 5504)

  • INFO

    • Creates files in the program directory

      • Endermanch@PolyRansom.exe (PID: 2600)
      • XWAQAQUE.exe (PID: 5504)

    • Checks supported languages

      • Endermanch@PolyRansom.exe (PID: 2600)
      • XWAQAQUE.exe (PID: 5504)
      • SwoYcckM.exe (PID: 6516)
      • Endermanch@PolyRansom.exe (PID: 4880)
      • Endermanch@PolyRansom.exe (PID: 920)
      • Endermanch@PolyRansom.exe (PID: 5968)

    • Reads the computer name

      • Endermanch@PolyRansom.exe (PID: 2600)
      • SwoYcckM.exe (PID: 6516)
      • XWAQAQUE.exe (PID: 5504)
      • Endermanch@PolyRansom.exe (PID: 4880)
      • Endermanch@PolyRansom.exe (PID: 920)
      • Endermanch@PolyRansom.exe (PID: 5968)

    • Create files in a temporary directory

      • Endermanch@PolyRansom.exe (PID: 2600)
      • Endermanch@PolyRansom.exe (PID: 4880)
      • Endermanch@PolyRansom.exe (PID: 920)
      • Endermanch@PolyRansom.exe (PID: 5968)

    • Reads security settings of Internet Explorer

      • cscript.exe (PID: 4988)
      • cscript.exe (PID: 1764)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1970:01:01 00:02:03+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 5.12
CodeSize: 220160
InitializedDataSize: 4608
UninitializedDataSize: -
EntryPoint: 0x328d9
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
2 563
Monitored processes
37
Malicious processes
13
Suspicious processes
5

Behavior graph

Click at the process to see the details
start #VIRLOCK endermanch@polyransom.exe #VIRLOCK swoycckm.exe #VIRLOCK xwaqaque.exe cmd.exe no specs conhost.exe no specs #VIRLOCK endermanch@polyransom.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK endermanch@polyransom.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs #VIRLOCK endermanch@polyransom.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs sppextcomobj.exe no specs rundll32.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
920C:\Users\admin\AppData\Local\Temp\Endermanch@PolyRansomC:\Users\admin\AppData\Local\Temp\Endermanch@PolyRansom.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\endermanch@polyransom.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\mpr.dll
1072\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—reg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1164C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
1764cscript C:\Users\admin\AppData\Local\Temp/file.vbsC:\Windows\SysWOW64\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\syswow64\cscript.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2432reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2C:\Windows\SysWOW64\reg.exe—Endermanch@PolyRansom.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2516\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—reg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2564reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /fC:\Windows\SysWOW64\reg.exe—Endermanch@PolyRansom.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2600"C:\Users\admin\AppData\Local\Temp\Endermanch@PolyRansom.exe" C:\Users\admin\AppData\Local\Temp\Endermanch@PolyRansom.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\endermanch@polyransom.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\mpr.dll
4452\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4652reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1C:\Windows\SysWOW64\reg.exe—Endermanch@PolyRansom.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
2 536
Read events
2 532
Write events
4
Delete events
0

Modification events

(PID) Process:(6516) SwoYcckM.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:SwoYcckM.exe
Value:
C:\Users\admin\lEMYkwoU\SwoYcckM.exe
(PID) Process:(2600) Endermanch@PolyRansom.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:SwoYcckM.exe
Value:
C:\Users\admin\lEMYkwoU\SwoYcckM.exe
(PID) Process:(2600) Endermanch@PolyRansom.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:XWAQAQUE.exe
Value:
C:\ProgramData\usAgAgoI\XWAQAQUE.exe
(PID) Process:(5504) XWAQAQUE.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:XWAQAQUE.exe
Value:
C:\ProgramData\usAgAgoI\XWAQAQUE.exe
Executable files
471
Suspicious files
3
Text files
133
Unknown types
0

Dropped files

PID
Process
Filename
Type
2600Endermanch@PolyRansom.exeC:\Users\admin\AppData\Local\Temp\lgoQskIE.battext
MD5:1AFCF9D56894549C9689A67FD2BEEDE5
SHA256:1DDE918DCCBBF0A1E1C5C773AE0A860425017CBD617143022C7B535A949F83E8
6048cmd.exeC:\Users\admin\AppData\Local\Temp\file.vbstext
MD5:4AFB5C4527091738FAF9CD4ADDF9D34E
SHA256:59D889A2BF392F4B117340832B4C73425A7FB1DE6C2F83A1AAA779D477C7C6CC
2600Endermanch@PolyRansom.exeC:\ProgramData\usAgAgoI\XWAQAQUE.exeexecutable
MD5:09634117F2F0AB1AF15721BEF3AB81E1
SHA256:944F69615E5A607AC736C8151EB027517ABBA4BDB208C23E9C3B685BECE47B84
6516SwoYcckM.exeC:\Users\admin\lEMYkwoU\SwoYcckM.infbinary
MD5:CC51A31497934A5962ACF3AB4E1C8A0F
SHA256:A72E7E77C926D0C23525494ECF8B8C4C8143D422DB064201F8FA66C78B6873B2
920Endermanch@PolyRansom.exeC:\Users\admin\AppData\Local\Temp\pMggskIE.battext
MD5:BAE1095F340720D965898063FEDE1273
SHA256:EE5E0A414167C2ACA961A616274767C4295659517A814D1428248BD53C6E829A
5504XWAQAQUE.exeC:\ProgramData\usAgAgoI\XWAQAQUE.infbinary
MD5:CC51A31497934A5962ACF3AB4E1C8A0F
SHA256:A72E7E77C926D0C23525494ECF8B8C4C8143D422DB064201F8FA66C78B6873B2
4880Endermanch@PolyRansom.exeC:\Users\admin\AppData\Local\Temp\IMsYskIE.battext
MD5:A9310601606CEEC1C8D556C2CAA7B804
SHA256:F82BFC818BC66346543F07F8D06A336A86C8C87CE16907156E72FC65B32B0338
5968Endermanch@PolyRansom.exeC:\Users\admin\AppData\Local\Temp\EaAoskIE.battext
MD5:BAE1095F340720D965898063FEDE1273
SHA256:EE5E0A414167C2ACA961A616274767C4295659517A814D1428248BD53C6E829A
6516SwoYcckM.exeC:\Users\admin\AppData\Local\VirtualStore\RCX23F.tmpexecutable
MD5:D0D9B527EB1164D49F0AA9AA8BB862BB
SHA256:70ACCF9524C87B5C795E6711B3DA02AE8DF3D126E1D16C3DB3B7E8BCE2766469
5968Endermanch@PolyRansom.exeC:\Users\admin\AppData\Local\Temp\SEogskIE.battext
MD5:3F03E19BF685B95F9E5FB274455AA0AA
SHA256:2585EDACD7F2A90214716C077999ADDF0CE2A7E379CD312891AC770B82AAB54D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
44
DNS requests
14
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6516
SwoYcckM.exe
GET
404
142.250.186.78:80
http://google.com/
unknown
—
—
whitelisted
5504
XWAQAQUE.exe
GET
404
142.250.186.78:80
http://google.com/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6516
SwoYcckM.exe
200.87.164.69:9999
—
Entel S.A. - EntelNet
BO
unknown
5504
XWAQAQUE.exe
200.87.164.69:9999
—
Entel S.A. - EntelNet
BO
unknown
6516
SwoYcckM.exe
142.250.186.78:80
google.com
GOOGLE
US
whitelisted
5504
XWAQAQUE.exe
142.250.186.78:80
google.com
GOOGLE
US
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.78
whitelisted
login.live.com
  • 20.190.160.20
  • 40.126.32.72
  • 20.190.160.4
  • 20.190.160.66
  • 40.126.32.133
  • 40.126.32.136
  • 40.126.32.138
  • 40.126.32.76
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
  • 2a01:111:f100:9001::1761:914d
whitelisted
15.164.165.52.in-addr.arpa
  • —
unknown
d.4.1.9.1.6.7.1.0.0.0.0.0.0.0.0.1.0.0.9.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa
  • —
unknown
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
nexusrules.officeapps.live.com
  • 52.111.236.23
whitelisted

Threats

PID
Process
Class
Message
5504
XWAQAQUE.exe
A Network Trojan was detected
ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check
6516
SwoYcckM.exe
A Network Trojan was detected
ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check
5504
XWAQAQUE.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Possible automated connectivity check (www.google.com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Endermanch@PolyRansom.exe