| File name: | Trojan-Ransom.Win32.Agent.auwv-eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.7z |
| Full analysis: | https://app.any.run/tasks/fac1fa95-4df2-4889-a6f4-2ec2b72bf34d |
| Verdict: | Malicious activity |
| Threats: | Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying. |
| Analysis date: | April 17, 2025, 20:07:16 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-7z-compressed |
| File info: | 7-zip archive data, version 0.4 |
| MD5: | 500069B33DB34DB4A2A3994DD50BD373 |
| SHA1: | E9D1FFFEE127918656DDD335E42F224BA2D3A97F |
| SHA256: | 1DC2B639FA4741E65DA89DA4FA3C7516EB58F1D43EBE82019346DF5A5EE3F606 |
| SSDEEP: | 12288:E953ekvc17VgvWfDAykSON0VXtV8cyjiezY0viuDoRs3ECEaZyW:E95ukvc1hSW79kSONGXtV8cKiiY0viYn |
MALICIOUS
Generic archive extractor
- WinRAR.exe (PID: 7528)
Signed with known abused certificate
- Trojan-Ransom.Win32.Agent.auwv-eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe (PID: 7444)
- yxugwjud5487.exe (PID: 7488)
RANSOMWARE has been detected
- yxugwjud5487.exe (PID: 7272)
SUSPICIOUS
Starts itself from another location
- Trojan-Ransom.Win32.Agent.auwv-eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe (PID: 7444)
Executable content was dropped or overwritten
- cmd.exe (PID: 2320)
- yxugwjud5487.exe (PID: 6872)
- yxugwjud5487.exe (PID: 7272)
- yxugwjud5487.exe (PID: 5576)
- yxugwjud5487.exe (PID: 6068)
- yxugwjud5487.exe (PID: 1188)
- yxugwjud5487.exe (PID: 3100)
Starts CMD.EXE for commands execution
- Trojan-Ransom.Win32.Agent.auwv-eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe (PID: 7444)
Creates file in the systems drive root
- yxugwjud5487.exe (PID: 7488)
Application launched itself
- yxugwjud5487.exe (PID: 7488)
Process drops legitimate windows executable
- yxugwjud5487.exe (PID: 6068)
- yxugwjud5487.exe (PID: 1188)
- yxugwjud5487.exe (PID: 3100)
Likely accesses (executes) a file from the Public directory
- notepad.exe (PID: 5556)
INFO
Executable content was dropped or overwritten
- WinRAR.exe (PID: 7528)
Drops encrypted JS script (Microsoft Script Encoder)
- Trojan-Ransom.Win32.Agent.auwv-eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe (PID: 7444)
Checks supported languages
- Trojan-Ransom.Win32.Agent.auwv-eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe (PID: 7444)
- yxugwjud5487.exe (PID: 7488)
- yxugwjud5487.exe (PID: 6068)
- yxugwjud5487.exe (PID: 1912)
- yxugwjud5487.exe (PID: 7272)
- yxugwjud5487.exe (PID: 7296)
- yxugwjud5487.exe (PID: 5576)
- yxugwjud5487.exe (PID: 7280)
- yxugwjud5487.exe (PID: 4688)
- yxugwjud5487.exe (PID: 6872)
- yxugwjud5487.exe (PID: 1188)
- yxugwjud5487.exe (PID: 3100)
- yxugwjud5487.exe (PID: 1180)
- yxugwjud5487.exe (PID: 4696)
- yxugwjud5487.exe (PID: 4892)
Reads the machine GUID from the registry
- Trojan-Ransom.Win32.Agent.auwv-eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe (PID: 7444)
- yxugwjud5487.exe (PID: 7488)
- yxugwjud5487.exe (PID: 1912)
- yxugwjud5487.exe (PID: 6068)
- yxugwjud5487.exe (PID: 7272)
- yxugwjud5487.exe (PID: 7280)
- yxugwjud5487.exe (PID: 7296)
- yxugwjud5487.exe (PID: 5576)
- yxugwjud5487.exe (PID: 4688)
- yxugwjud5487.exe (PID: 6872)
- yxugwjud5487.exe (PID: 1180)
- yxugwjud5487.exe (PID: 3100)
- yxugwjud5487.exe (PID: 1188)
- yxugwjud5487.exe (PID: 4696)
- yxugwjud5487.exe (PID: 4892)
Manual execution by a user
- Trojan-Ransom.Win32.Agent.auwv-eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe (PID: 7444)
- notepad.exe (PID: 5556)
Reads the computer name
- yxugwjud5487.exe (PID: 7488)
- Trojan-Ransom.Win32.Agent.auwv-eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe (PID: 7444)
- yxugwjud5487.exe (PID: 1912)
- yxugwjud5487.exe (PID: 5576)
- yxugwjud5487.exe (PID: 7280)
- yxugwjud5487.exe (PID: 7272)
- yxugwjud5487.exe (PID: 7296)
- yxugwjud5487.exe (PID: 6068)
- yxugwjud5487.exe (PID: 4688)
- yxugwjud5487.exe (PID: 6872)
- yxugwjud5487.exe (PID: 1180)
- yxugwjud5487.exe (PID: 4696)
- yxugwjud5487.exe (PID: 1188)
- yxugwjud5487.exe (PID: 3100)
The sample compiled with spanish language support
- yxugwjud5487.exe (PID: 6068)
The sample compiled with russian language support
- yxugwjud5487.exe (PID: 6872)
- yxugwjud5487.exe (PID: 7272)
Reads security settings of Internet Explorer
- notepad.exe (PID: 5556)
The sample compiled with portuguese language support
- yxugwjud5487.exe (PID: 1188)
- yxugwjud5487.exe (PID: 3100)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .7z | | | 7-Zip compressed archive (v0.4) (57.1) |
|---|---|---|
| .7z | | | 7-Zip compressed archive (gen) (42.8) |
EXIF
ZIP
| FileVersion: | 7z v0.04 |
|---|---|
| ModifyDate: | 2019:05:10 23:33:10+00:00 |
| ArchivedFileName: | Trojan-Ransom.Win32.Agent.auwv-eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe |
Total processes
146
Monitored processes
21
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1180 | C:\Users\admin\AppData\Local\Temp\yxugwjud5487.exe -i Global\SM-yxugwjud -s | C:\Users\admin\AppData\Local\Temp\yxugwjud5487.exe | — | yxugwjud5487.exe | |||||||||||
User: admin Company: ALISA LTD Integrity Level: HIGH Description: Background Tasks Host Version: 1.3.2.0 Modules
| |||||||||||||||
| 1188 | C:\Users\admin\AppData\Local\Temp\yxugwjud5487.exe -i Global\SM-yxugwjud -s | C:\Users\admin\AppData\Local\Temp\yxugwjud5487.exe | yxugwjud5487.exe | ||||||||||||
User: admin Company: ALISA LTD Integrity Level: HIGH Description: Background Tasks Host Exit code: 0 Version: 1.3.2.0 Modules
| |||||||||||||||
| 1912 | C:\Users\admin\AppData\Local\Temp\yxugwjud5487.exe -i Global\SM-yxugwjud -s | C:\Users\admin\AppData\Local\Temp\yxugwjud5487.exe | — | yxugwjud5487.exe | |||||||||||
User: admin Company: ALISA LTD Integrity Level: HIGH Description: Background Tasks Host Version: 1.3.2.0 Modules
| |||||||||||||||
| 2320 | C:\WINDOWS\system32\cmd.exe /c move /y C:\Users\admin\Desktop\Trojan-Ransom.Win32.Agent.auwv-eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe C:\Users\admin\AppData\Local\Temp\yxugwjud5487.exe | C:\Windows\System32\cmd.exe | Trojan-Ransom.Win32.Agent.auwv-eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2384 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3100 | C:\Users\admin\AppData\Local\Temp\yxugwjud5487.exe -i Global\SM-yxugwjud -s | C:\Users\admin\AppData\Local\Temp\yxugwjud5487.exe | yxugwjud5487.exe | ||||||||||||
User: admin Company: ALISA LTD Integrity Level: HIGH Description: Background Tasks Host Exit code: 0 Version: 1.3.2.0 Modules
| |||||||||||||||
| 4688 | C:\Users\admin\AppData\Local\Temp\yxugwjud5487.exe -i Global\SM-yxugwjud -s | C:\Users\admin\AppData\Local\Temp\yxugwjud5487.exe | — | yxugwjud5487.exe | |||||||||||
User: admin Company: ALISA LTD Integrity Level: HIGH Description: Background Tasks Host Exit code: 0 Version: 1.3.2.0 Modules
| |||||||||||||||
| 4696 | C:\Users\admin\AppData\Local\Temp\yxugwjud5487.exe -i Global\SM-yxugwjud -s | C:\Users\admin\AppData\Local\Temp\yxugwjud5487.exe | — | yxugwjud5487.exe | |||||||||||
User: admin Company: ALISA LTD Integrity Level: HIGH Description: Background Tasks Host Version: 1.3.2.0 Modules
| |||||||||||||||
| 4892 | C:\Users\admin\AppData\Local\Temp\yxugwjud5487.exe -i Global\SM-yxugwjud -s | C:\Users\admin\AppData\Local\Temp\yxugwjud5487.exe | — | yxugwjud5487.exe | |||||||||||
User: admin Company: ALISA LTD Integrity Level: HIGH Description: Background Tasks Host Version: 1.3.2.0 Modules
| |||||||||||||||
| 5556 | "C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\README_LOCKED.txt | C:\Windows\System32\notepad.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Notepad Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
7 542
Read events
6 658
Write events
544
Delete events
340
Modification events
| (PID) Process: | (7528) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\preferences.zip | |||
| (PID) Process: | (7528) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\chromium_ext.zip | |||
| (PID) Process: | (7528) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (7528) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\Trojan-Ransom.Win32.Agent.auwv-eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.7z | |||
| (PID) Process: | (7528) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (7528) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (7528) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (7528) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (7528) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface |
| Operation: | write | Name: | ShowPassword |
Value: 0 | |||
| (PID) Process: | (7528) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin |
| Operation: | write | Name: | Placement |
Value: 2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000 | |||
Executable files
8
Suspicious files
83
Text files
20
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1912 | yxugwjud5487.exe | C:\$WinREAgent\Scratch\update.wim.locked | — | |
MD5:— | SHA256:— | |||
| 7296 | yxugwjud5487.exe | C:\$WinREAgent\Backup\Winre.wim.locked | — | |
MD5:— | SHA256:— | |||
| 7272 | yxugwjud5487.exe | C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\cef_200_percent.pak.locked | — | |
MD5:— | SHA256:— | |||
| 7272 | yxugwjud5487.exe | C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\resources.pak.locked | — | |
MD5:— | SHA256:— | |||
| 7528 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb7528.25480\Trojan-Ransom.Win32.Agent.auwv-eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0.exe | executable | |
MD5:16BCC3B7F32C41E7C7222BF37FE39FE6 | SHA256:EDA26A1CD80AAC1C42CDBBA9AF813D9C4BC81F6052080BC33435D1E076E75AA0 | |||
| 2320 | cmd.exe | C:\Users\admin\AppData\Local\Temp\yxugwjud5487.exe | executable | |
MD5:16BCC3B7F32C41E7C7222BF37FE39FE6 | SHA256:EDA26A1CD80AAC1C42CDBBA9AF813D9C4BC81F6052080BC33435D1E076E75AA0 | |||
| 7272 | yxugwjud5487.exe | C:\$WinREAgent\Backup\boot.sdi.locked | binary | |
MD5:22D9945B4AAE36DD59620A918F2E65F4 | SHA256:CD2C00CE027687CE4A8BDC967F26A8AB82F651C9BECD703658BA282EC49702BD | |||
| 5576 | yxugwjud5487.exe | C:\found.000\file00000003.chk.locked | binary | |
MD5:4513CFDD698564B304B15AEA3F058C92 | SHA256:D4F988BC2FF9DA0C4ABFABDFB89615C429F9092065E63D31CF4FFEB4556B730A | |||
| 6068 | yxugwjud5487.exe | C:\found.000\dir0000.chk\UpdateSessionOrchestration.058.etl.locked | binary | |
MD5:389F45A91E7FFC038CCCDB460AAD253D | SHA256:7C38AD8787A332AB2026A1C7516B5502842F8946E1D706ACCB9523BF6210F639 | |||
| 5576 | yxugwjud5487.exe | C:\found.000\dir0000.chk\UpdateSessionOrchestration.055.etl.locked | binary | |
MD5:4162A859FDD5D7C2488C0625DA25AB24 | SHA256:99168B0BFEC28E29FD3D0B3F3E160B724E6B6479522166FE9A0ADC0F3ED01FAB | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
12
DNS requests
7
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.216.77.12:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 23.216.77.12:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3216 | svchost.exe | 172.211.123.248:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
6544 | svchost.exe | 40.126.31.67:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
2104 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |