File name:

HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.7z

Full analysis: https://app.any.run/tasks/e440f27f-d9a8-4e0c-8b60-2aaeada46ca8
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 13:17:01
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
arch-exec
ransomware
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

A8C88FF940A7895C8D73EA27DB344DA4

SHA1:

58A9508DA9AD5B722D3B4BC737B11EA1F728AFEC

SHA256:

34A655545173EE1EAAF7563357D382F5B2D3BBCCD3A12001586291F6823287BE

SSDEEP:

768:cnPrFfU5iDj7527JZb/OzvCgEKFZdoBTJuUPiHBKAW2vtsWlSh3:aPrFfNjUZb/MtEKTW7ub4AW2vt9lS1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts Visual C# compiler

      • HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exe (PID: 2732)

  • SUSPICIOUS

    • Uses .NET C# to load dll

      • HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exe (PID: 2732)

    • Executable content was dropped or overwritten

      • csc.exe (PID: 2096)

    • Creates file in the systems drive root

      • HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exe (PID: 2732)

    • Write to the desktop.ini file (may be used to cloak folders)

      • HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exe (PID: 2732)

    • Reads the Internet Settings

      • mshta.exe (PID: 3300)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2360)

    • Checks supported languages

      • HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exe (PID: 2732)
      • csc.exe (PID: 2096)
      • cvtres.exe (PID: 1560)

    • Manual execution by a user

      • HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exe (PID: 2732)
      • notepad.exe (PID: 948)
      • mshta.exe (PID: 3300)
      • explorer.exe (PID: 3648)

    • Create files in a temporary directory

      • HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exe (PID: 2732)
      • csc.exe (PID: 2096)
      • cvtres.exe (PID: 1560)

    • Reads the machine GUID from the registry

      • HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exe (PID: 2732)
      • csc.exe (PID: 2096)
      • cvtres.exe (PID: 1560)

    • Reads the computer name

      • HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exe (PID: 2732)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 3300)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
ModifyDate: 2018:05:08 22:55:44+00:00
ArchivedFileName: HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
7
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe heur-trojan-ransom.win32.generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exe csc.exe cvtres.exe no specs mshta.exe no specs notepad.exe no specs explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
948"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\MDQBR7CZEX7KFJZBAJMQJC164QF43OFRJ5SU7UHT.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1560C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES5232.tmp" "c:\Users\admin\AppData\Local\Temp\hj1pwjcj\CSC8F786D1A2B204AFE90CE62F01DB22249.TMP"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
14.10.25028.0 built by: VCTOOLSD15RTM
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\vcruntime140_clr0400.dll
c:\windows\system32\ucrtbase_clr0400.dll
2096"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\hj1pwjcj\hj1pwjcj.cmdline"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.8.3761.0 built by: NET48REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\vcruntime140_clr0400.dll
c:\windows\system32\ucrtbase_clr0400.dll
2360"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.7zC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2732"C:\Users\admin\Desktop\HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exe" C:\Users\admin\Desktop\HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\heur-trojan-ransom.win32.generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3300"C:\Windows\System32\mshta.exe" "C:\Users\admin\Desktop\HOW DECRIPT FILES.hta" C:\Windows\System32\mshta.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3648"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
1 932
Read events
1 894
Write events
38
Delete events
0

Modification events

(PID) Process:(2360) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2360) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2360) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2360) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2360) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2360) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2360) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.7z
(PID) Process:(2360) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2360) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2360) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
2
Suspicious files
409
Text files
9
Unknown types
0

Dropped files

PID
Process
Filename
Type
2732HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exeC:\sequre@tuta.io_6175746F657865632E626174binary
MD5:9236B9B173F828BFC3C281E485ECFE5C
SHA256:779B205A283AA7FE1B41CC90A9678DA83904DB9AB9F631C557EBCB6D3F7AE897
2732HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exeC:\autoexec.batbinary
MD5:9236B9B173F828BFC3C281E485ECFE5C
SHA256:779B205A283AA7FE1B41CC90A9678DA83904DB9AB9F631C557EBCB6D3F7AE897
2732HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exeC:\HOW DECRIPT FILES.htahtml
MD5:9C532232D7609C473B21E614D31E1AD6
SHA256:173D562AFC439CB13B15AA218A7F21912DB1429EF64B293F320134057A6B3088
2732HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exeC:\Users\admin\Desktop\HOW DECRIPT FILES.htahtml
MD5:9C532232D7609C473B21E614D31E1AD6
SHA256:173D562AFC439CB13B15AA218A7F21912DB1429EF64B293F320134057A6B3088
2732HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exeC:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-500\sequre@tuta.io_6465736B746F702E696E69binary
MD5:C0717363FA0A8D9FC239856A48F66767
SHA256:03D8C684E14BBE786C241A3E287768C09C3F5EF71A43D66E7A1382432B54C5E3
2732HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exeC:\config.sysbinary
MD5:403AE32CCDF2B1124A6A17279B1BE835
SHA256:9AF67CE1F75026D41B3F42196478A73CC9CA9B91E45F9183DF0882D1CE683942
2732HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exeC:\MSOCache\All Users\{90140000-0015-0407-0000-0000000FF1CE}-C\AccLR.cab —
MD5:—
SHA256:—
2732HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exeC:\MSOCache\All Users\{90140000-0015-0407-0000-0000000FF1CE}-C\sequre@tuta.io_4163634C522E636162 —
MD5:—
SHA256:—
2732HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.exeC:\$Recycle.Bin\HOW DECRIPT FILES.htahtml
MD5:9C532232D7609C473B21E614D31E1AD6
SHA256:173D562AFC439CB13B15AA218A7F21912DB1429EF64B293F320134057A6B3088
2096csc.exeC:\Users\admin\AppData\Local\Temp\hj1pwjcj\CSC8F786D1A2B204AFE90CE62F01DB22249.TMPbinary
MD5:CD77E53AE6F9DFA5EDF9A6EFC65D2305
SHA256:FF0F4137B02D6DE6CF5F310BE079301A71230B2EEBB95B833835E2D022CD95A5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.174
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
HEUR-Trojan-Ransom.Win32.Generic-208cca124ddafe35a122f6bdd36191151a2730b4e1051804d5f68d0cb4b44145.7z