File name:

HEUR-Trojan-Ransom.Win32.Locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.7z

Full analysis: https://app.any.run/tasks/c7b1e047-3ab6-4f8b-ab14-1d8d4022b16e
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: May 02, 2025, 17:36:15
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
arch-exec
ransomware
troldesh
shade
upx
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

AAD38EE225623DDBC9C6FF0D3297F08B

SHA1:

92D808B96C97E3E3BD15F8C689B7B779E302F301

SHA256:

324A8624A8707D65994AFD0E0B68E4D79934575CA574EBC84CBEAFA07EFA34B2

SSDEEP:

49152:L/e1rI4LskMGm/7SoHzRdnzQCfXFnHpIHwqyzuYKot339KcM+it1Js5uf6Q4I1h6:L/YrI4wkdgSoHzRdnzQwVnHCqzuytH91

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 372)

    • Troldesh is detected

      • HEUR-Trojan-Ransom.Win32.Locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.exe (PID: 1268)

    • Changes the autorun value in the registry

      • HEUR-Trojan-Ransom.Win32.Locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.exe (PID: 1268)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • HEUR-Trojan-Ransom.Win32.Locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.exe (PID: 2412)

    • Executable content was dropped or overwritten

      • HEUR-Trojan-Ransom.Win32.Locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.exe (PID: 2412)
      • HEUR-Trojan-Ransom.Win32.Locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.exe (PID: 1268)

    • The process creates files with name similar to system file names

      • HEUR-Trojan-Ransom.Win32.Locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.exe (PID: 2412)
      • HEUR-Trojan-Ransom.Win32.Locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.exe (PID: 1268)

    • Application launched itself

      • HEUR-Trojan-Ransom.Win32.Locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.exe (PID: 2412)

    • Connects to unusual port

      • HEUR-Trojan-Ransom.Win32.Locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.exe (PID: 1268)

  • INFO

    • Reads the computer name

      • HEUR-Trojan-Ransom.Win32.Locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.exe (PID: 2412)
      • HEUR-Trojan-Ransom.Win32.Locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.exe (PID: 1268)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 372)

    • Checks supported languages

      • HEUR-Trojan-Ransom.Win32.Locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.exe (PID: 2412)
      • HEUR-Trojan-Ransom.Win32.Locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.exe (PID: 1268)

    • The sample compiled with korean language support

      • WinRAR.exe (PID: 372)
      • HEUR-Trojan-Ransom.Win32.Locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.exe (PID: 1268)

    • Manual execution by a user

      • HEUR-Trojan-Ransom.Win32.Locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.exe (PID: 2412)

    • Create files in a temporary directory

      • HEUR-Trojan-Ransom.Win32.Locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.exe (PID: 2412)
      • HEUR-Trojan-Ransom.Win32.Locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.exe (PID: 1268)

    • Reads the machine GUID from the registry

      • HEUR-Trojan-Ransom.Win32.Locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.exe (PID: 2412)
      • HEUR-Trojan-Ransom.Win32.Locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.exe (PID: 1268)

    • Creates files in the program directory

      • HEUR-Trojan-Ransom.Win32.Locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.exe (PID: 1268)

    • UPX packer has been detected

      • HEUR-Trojan-Ransom.Win32.Locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.exe (PID: 1268)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
ModifyDate: 2018:07:14 02:36:42+00:00
ArchivedFileName: HEUR-Trojan-Ransom.Win32.Locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe heur-trojan-ransom.win32.locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.exe #TROLDESH heur-trojan-ransom.win32.locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.exe

Process information

PID
CMD
Path
Indicators
Parent process
372"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\HEUR-Trojan-Ransom.Win32.Locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.7zC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1268"C:\Users\admin\Desktop\HEUR-Trojan-Ransom.Win32.Locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.exe" C:\Users\admin\Desktop\HEUR-Trojan-Ransom.Win32.Locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.exe
HEUR-Trojan-Ransom.Win32.Locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.exe
User:
admin
Company:
MediaArea.net
Integrity Level:
HIGH
Description:
All about your audio and video files
Version:
0.7.90.0
Modules
Images
c:\users\admin\desktop\heur-trojan-ransom.win32.locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
2412"C:\Users\admin\Desktop\HEUR-Trojan-Ransom.Win32.Locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.exe" C:\Users\admin\Desktop\HEUR-Trojan-Ransom.Win32.Locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.exe
explorer.exe
User:
admin
Company:
MediaArea.net
Integrity Level:
HIGH
Description:
All about your audio and video files
Exit code:
0
Version:
0.7.90.0
Modules
Images
c:\users\admin\desktop\heur-trojan-ransom.win32.locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
Total events
2 992
Read events
2 965
Write events
27
Delete events
0

Modification events

(PID) Process:(372) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(372) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(372) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(372) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(372) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(372) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(372) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\HEUR-Trojan-Ransom.Win32.Locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.7z
(PID) Process:(372) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(372) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(372) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
3
Suspicious files
3
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
2412HEUR-Trojan-Ransom.Win32.Locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.exeC:\Users\admin\AppData\Local\Temp\nsxAB41.tmp\System.dllexecutable
MD5:A4DD044BCD94E9B3370CCF095B31F896
SHA256:2E226715419A5882E2E14278940EE8EF0AA648A3EF7AF5B3DC252674111962BC
2412HEUR-Trojan-Ransom.Win32.Locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.exeC:\Users\admin\AppData\Local\Temp\nspA554.tmpbinary
MD5:069B9C39BD14E44951F4547B205FA490
SHA256:9D8926D6DB45806B568CD5077FB83C6EB1BD6D40540E8713F0ACF93184423E55
2412HEUR-Trojan-Ransom.Win32.Locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.exeC:\Users\admin\AppData\Local\Temp\rails.jubinary
MD5:1C3278E87F8429F363C223C4CB3D7068
SHA256:F5C14DEBCCC1F7BA158C4C05CD1577751A787EC9BF83A98CFC07BBE074FE7353
2412HEUR-Trojan-Ransom.Win32.Locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.exeC:\Users\admin\AppData\Local\Temp\portdetect.jsbinary
MD5:CC6B5A3DAA07AF172F6C7491A51E7538
SHA256:B229BD5E04F6B5A99177CD9CA418F8753412B83FE1A591C62C9B7AA7CB6A2BB7
1268HEUR-Trojan-Ransom.Win32.Locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.exeC:\ProgramData\Windows\csrss.exeexecutable
MD5:9536EE1EEC864611D658686457C94F2F
SHA256:88226FA42C43EF6B2668E0C28034C20B73D3D9148C3E68441CA3ABDDF7D47EB7
1268HEUR-Trojan-Ransom.Win32.Locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.exeC:\Users\admin\AppData\Local\Temp\6893A5D897\statetext
MD5:003C44045AAF5D7CBA2F2B1589AF3A8F
SHA256:8835FF51C2E777C805DBB9674F73E90C09C6D58F5C0DF7A8FEBCCB7EC694B560
2412HEUR-Trojan-Ransom.Win32.Locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.exeC:\Users\admin\AppData\Local\Temp\btn_calendar_prev2.gifimage
MD5:14192A201D0AD50DE339A017A69C7FF6
SHA256:C6335D51BB335104BB4F3805E5D15EE9933CF6B450EA2908A5C43C129CF6CC7D
372WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb372.20134\HEUR-Trojan-Ransom.Win32.Locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.exeexecutable
MD5:9536EE1EEC864611D658686457C94F2F
SHA256:88226FA42C43EF6B2668E0C28034C20B73D3D9148C3E68441CA3ABDDF7D47EB7
1268HEUR-Trojan-Ransom.Win32.Locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.exeC:\Users\admin\AppData\Local\Temp\6893A5D897\state.tmptext
MD5:003C44045AAF5D7CBA2F2B1589AF3A8F
SHA256:8835FF51C2E777C805DBB9674F73E90C09C6D58F5C0DF7A8FEBCCB7EC694B560
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
1268
HEUR-Trojan-Ransom.Win32.Locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.exe
76.73.17.194:9090
—
NAVER BUSINESS PLATFORM ASIA PACIFIC PTE. LTD.
US
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.142
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
HEUR-Trojan-Ransom.Win32.Locky.gen-88226fa42c43ef6b2668e0c28034c20b73d3d9148c3e68441ca3abddf7d47eb7.7z