File name:

HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.7z

Full analysis: https://app.any.run/tasks/e440f27f-d9a8-4e0c-8b60-2aaeada46ca8
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 13:17:01
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
arch-exec
ransomware
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

A8C88FF940A7895C8D73EA27DB344DA4

SHA1:

58A9508DA9AD5B722D3B4BC737B11EA1F728AFEC

SHA256:

34A655545173EE1EAAF7563357D382F5B2D3BBCCD3A12001586291F6823287BE

SSDEEP:

768:cnPrFfU5iDj7527JZb/OzvCgEKFZdoBTJuUPiHBKAW2vtsWlSh3:aPrFfNjUZb/MtEKTW7ub4AW2vt9lS1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts Visual C# compiler

      • HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exe (PID: 2732)

  • SUSPICIOUS

    • Uses .NET C# to load dll

      • HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exe (PID: 2732)

    • Executable content was dropped or overwritten

      • csc.exe (PID: 2096)

    • Creates file in the systems drive root

      • HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exe (PID: 2732)

    • Write to the desktop.ini file (may be used to cloak folders)

      • HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exe (PID: 2732)

    • Reads the Internet Settings

      • mshta.exe (PID: 3300)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2360)

    • Reads the machine GUID from the registry

      • HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exe (PID: 2732)
      • csc.exe (PID: 2096)
      • cvtres.exe (PID: 1560)

    • Checks supported languages

      • HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exe (PID: 2732)
      • csc.exe (PID: 2096)
      • cvtres.exe (PID: 1560)

    • Create files in a temporary directory

      • HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exe (PID: 2732)
      • csc.exe (PID: 2096)
      • cvtres.exe (PID: 1560)

    • Manual execution by a user

      • HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exe (PID: 2732)
      • mshta.exe (PID: 3300)
      • notepad.exe (PID: 948)
      • explorer.exe (PID: 3648)

    • Reads the computer name

      • HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exe (PID: 2732)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 3300)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
ModifyDate: 2018:05:08 22:55:44+00:00
ArchivedFileName: HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
7
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe heur-trojan-ransom.win32.generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exe csc.exe cvtres.exe no specs mshta.exe no specs notepad.exe no specs explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
948"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\MDQBR7CZEX7KFJZBAJMQJC164QF43OFRJ5SU7UHT.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1560C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES5232.tmp" "c:\Users\admin\AppData\Local\Temp\hj1pwjcj\CSC8F786D1A2B204AFE90CE62F01DB22249.TMP"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
14.10.25028.0 built by: VCTOOLSD15RTM
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\vcruntime140_clr0400.dll
c:\windows\system32\ucrtbase_clr0400.dll
2096"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\hj1pwjcj\hj1pwjcj.cmdline"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.8.3761.0 built by: NET48REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\vcruntime140_clr0400.dll
c:\windows\system32\ucrtbase_clr0400.dll
2360"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.7zC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2732"C:\Users\admin\Desktop\HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exe" C:\Users\admin\Desktop\HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\heur-trojan-ransom.win32.generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3300"C:\Windows\System32\mshta.exe" "C:\Users\admin\Desktop\HOW DECRIPT FILES.hta" C:\Windows\System32\mshta.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3648"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
1 932
Read events
1 894
Write events
38
Delete events
0

Modification events

(PID) Process:(2360) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2360) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2360) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2360) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2360) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2360) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2360) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.7z
(PID) Process:(2360) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2360) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2360) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
2
Suspicious files
409
Text files
9
Unknown types
0

Dropped files

PID
Process
Filename
Type
2732HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exeC:\Users\admin\AppData\Local\Temp\hj1pwjcj\hj1pwjcj.cmdlinetext
MD5:3231E57875D39C6D5BEEB23B3945958A
SHA256:19A103265ACCE7AA085788361E6AC0BC211369D84EC26ABE0E6B1AFB3992024F
2732HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exeC:\Users\admin\AppData\Local\Temp\hj1pwjcj\hj1pwjcj.0.cstext
MD5:2E9F1BC1D8DFE6511FDFBAB4AE2787AD
SHA256:FEAA668CDD9C24795979B6BB5B26FFD995A4C226BE82683323A0C7F356D29BAF
2732HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exeC:\autoexec.batbinary
MD5:9236B9B173F828BFC3C281E485ECFE5C
SHA256:779B205A283AA7FE1B41CC90A9678DA83904DB9AB9F631C557EBCB6D3F7AE897
2732HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exeC:\HOW DECRIPT FILES.htahtml
MD5:9C532232D7609C473B21E614D31E1AD6
SHA256:173D562AFC439CB13B15AA218A7F21912DB1429EF64B293F320134057A6B3088
2732HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exeC:\sequre@tuta.io_6175746F657865632E626174binary
MD5:9236B9B173F828BFC3C281E485ECFE5C
SHA256:779B205A283AA7FE1B41CC90A9678DA83904DB9AB9F631C557EBCB6D3F7AE897
2732HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exeC:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\sequre@tuta.io_6465736B746F702E696E69binary
MD5:C0717363FA0A8D9FC239856A48F66767
SHA256:03D8C684E14BBE786C241A3E287768C09C3F5EF71A43D66E7A1382432B54C5E3
2732HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exeC:\MSOCache\All Users\{90140000-0015-0407-0000-0000000FF1CE}-C\AccLR.cab —
MD5:—
SHA256:—
2732HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exeC:\MSOCache\All Users\{90140000-0015-0407-0000-0000000FF1CE}-C\sequre@tuta.io_4163634C522E636162 —
MD5:—
SHA256:—
2732HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exeC:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-500\desktop.inibinary
MD5:C0717363FA0A8D9FC239856A48F66767
SHA256:03D8C684E14BBE786C241A3E287768C09C3F5EF71A43D66E7A1382432B54C5E3
2732HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exeC:\Users\admin\Desktop\MDQBR7CZEX7KFJZBAJMQJC164QF43OFRJ5SU7UHT.txttext
MD5:E002B1C35A4A684D9F16A6D35D544F90
SHA256:E47709E86AED56B7FDC66DFEC62313031B711756B7586D2B479995EDC20F1EA4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.174
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.7z