File name:

Trojan-Ransom.Win32.Krotten.d-3d44b923866b3ea2081d02bfa0efa055adfa869ca621311f3e4ddb2aa54c0dd8.exe

Full analysis: https://app.any.run/tasks/1ebf8cc6-aed5-4ee4-a28b-4a5835da4c3f
Verdict: Malicious activity
Analysis date: April 22, 2025, 22:21:00
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-reg
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

BCAA24F4FF68681398D4189E3A13276C

SHA1:

55F78324C63E942BB1B6F9F9CF2D75C524EEB0B3

SHA256:

3D44B923866B3EA2081D02BFA0EFA055ADFA869CA621311F3E4DDB2AA54C0DD8

SSDEEP:

1536:eMzQxlzel+NUz5MVVVVVVuVV3pY/pRmw57li2XfGn4IS:jkxlzeA/VVVVVVuVV3pYxRmw57lzXfGG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Disables the Find the Start menu

      • Trojan-Ransom.Win32.Krotten.d-3d44b923866b3ea2081d02bfa0efa055adfa869ca621311f3e4ddb2aa54c0dd8.exe (PID: 7724)

    • Disables the LogOff the Start menu

      • Trojan-Ransom.Win32.Krotten.d-3d44b923866b3ea2081d02bfa0efa055adfa869ca621311f3e4ddb2aa54c0dd8.exe (PID: 7724)

    • Disables the Run the Start menu

      • Trojan-Ransom.Win32.Krotten.d-3d44b923866b3ea2081d02bfa0efa055adfa869ca621311f3e4ddb2aa54c0dd8.exe (PID: 7724)

    • Disables the Shutdown in the Start menu

      • Trojan-Ransom.Win32.Krotten.d-3d44b923866b3ea2081d02bfa0efa055adfa869ca621311f3e4ddb2aa54c0dd8.exe (PID: 7724)

    • Changes the autorun value in the registry

      • Trojan-Ransom.Win32.Krotten.d-3d44b923866b3ea2081d02bfa0efa055adfa869ca621311f3e4ddb2aa54c0dd8.exe (PID: 7724)

  • SUSPICIOUS

    • Changes the title of the Internet Explorer window

      • Trojan-Ransom.Win32.Krotten.d-3d44b923866b3ea2081d02bfa0efa055adfa869ca621311f3e4ddb2aa54c0dd8.exe (PID: 7724)

    • Changes the Home page of Internet Explorer

      • Trojan-Ransom.Win32.Krotten.d-3d44b923866b3ea2081d02bfa0efa055adfa869ca621311f3e4ddb2aa54c0dd8.exe (PID: 7724)

  • INFO

    • Reads the computer name

      • Trojan-Ransom.Win32.Krotten.d-3d44b923866b3ea2081d02bfa0efa055adfa869ca621311f3e4ddb2aa54c0dd8.exe (PID: 7724)

    • Checks supported languages

      • Trojan-Ransom.Win32.Krotten.d-3d44b923866b3ea2081d02bfa0efa055adfa869ca621311f3e4ddb2aa54c0dd8.exe (PID: 7724)

    • Reads the software policy settings

      • slui.exe (PID: 8112)

    • Auto-launch of the file from Registry key

      • Trojan-Ransom.Win32.Krotten.d-3d44b923866b3ea2081d02bfa0efa055adfa869ca621311f3e4ddb2aa54c0dd8.exe (PID: 7724)

    • Checks proxy server information

      • slui.exe (PID: 8112)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (35.8)
.exe | Win64 Executable (generic) (31.7)
.scr | Windows screen saver (15)
.dll | Win32 Dynamic Link Library (generic) (7.5)
.exe | Win32 Executable (generic) (5.1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2004:04:05 13:17:12+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 5.12
CodeSize: 19456
InitializedDataSize: 101376
UninitializedDataSize: -
EntryPoint: 0x37c7
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
125
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start trojan-ransom.win32.krotten.d-3d44b923866b3ea2081d02bfa0efa055adfa869ca621311f3e4ddb2aa54c0dd8.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
7724"C:\Users\admin\Desktop\Trojan-Ransom.Win32.Krotten.d-3d44b923866b3ea2081d02bfa0efa055adfa869ca621311f3e4ddb2aa54c0dd8.exe" C:\Users\admin\Desktop\Trojan-Ransom.Win32.Krotten.d-3d44b923866b3ea2081d02bfa0efa055adfa869ca621311f3e4ddb2aa54c0dd8.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
48
Modules
Images
c:\users\admin\desktop\trojan-ransom.win32.krotten.d-3d44b923866b3ea2081d02bfa0efa055adfa869ca621311f3e4ddb2aa54c0dd8.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
8112C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
3 416
Read events
3 372
Write events
43
Delete events
1

Modification events

(PID) Process:(7724) Trojan-Ransom.Win32.Krotten.d-3d44b923866b3ea2081d02bfa0efa055adfa869ca621311f3e4ddb2aa54c0dd8.exeKey:HKEY_CURRENT_USER\Control Panel\Desktop
Operation:writeName:MenuShowDelay
Value:
9999
(PID) Process:(7724) Trojan-Ransom.Win32.Krotten.d-3d44b923866b3ea2081d02bfa0efa055adfa869ca621311f3e4ddb2aa54c0dd8.exeKey:HKEY_CURRENT_USER\Control Panel\International
Operation:writeName:sTimeFormat
Value:
ÁËßÄÜ
(PID) Process:(7724) Trojan-Ransom.Win32.Krotten.d-3d44b923866b3ea2081d02bfa0efa055adfa869ca621311f3e4ddb2aa54c0dd8.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main
Operation:writeName:Window title
Value:
:::::::::: Ìîé ÏÈÇÄÎÐÅÇ ::::::::::
(PID) Process:(7724) Trojan-Ransom.Win32.Krotten.d-3d44b923866b3ea2081d02bfa0efa055adfa869ca621311f3e4ddb2aa54c0dd8.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main
Operation:writeName:Start Page
Value:
http://poetry.rotten.com/uday/index19.html
(PID) Process:(7724) Trojan-Ransom.Win32.Krotten.d-3d44b923866b3ea2081d02bfa0efa055adfa869ca621311f3e4ddb2aa54c0dd8.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:Window title
Value:
:::::::::: Ìîé ÏÈÇÄÎÐÅÇ ::::::::::
(PID) Process:(7724) Trojan-Ransom.Win32.Krotten.d-3d44b923866b3ea2081d02bfa0efa055adfa869ca621311f3e4ddb2aa54c0dd8.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:Start Page
Value:
http://poetry.rotten.com/uday/index19.html
(PID) Process:(7724) Trojan-Ransom.Win32.Krotten.d-3d44b923866b3ea2081d02bfa0efa055adfa869ca621311f3e4ddb2aa54c0dd8.exeKey:HKEY_CURRENT_USER\Control Panel\Desktop
Operation:writeName:WallpaperOriginX
Value:
210
(PID) Process:(7724) Trojan-Ransom.Win32.Krotten.d-3d44b923866b3ea2081d02bfa0efa055adfa869ca621311f3e4ddb2aa54c0dd8.exeKey:HKEY_CURRENT_USER\Control Panel\Desktop
Operation:writeName:WallpaperOriginY
Value:
187
(PID) Process:(7724) Trojan-Ransom.Win32.Krotten.d-3d44b923866b3ea2081d02bfa0efa055adfa869ca621311f3e4ddb2aa54c0dd8.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
Operation:writeName:NoStartMenuPinnedList
Value:
1
(PID) Process:(7724) Trojan-Ransom.Win32.Krotten.d-3d44b923866b3ea2081d02bfa0efa055adfa869ca621311f3e4ddb2aa54c0dd8.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
Operation:writeName:NoStartMenuMFUprogramsList
Value:
1
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
22
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4208
RUXIMICS.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4208
RUXIMICS.exe
GET
200
88.221.110.122:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4208
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4208
RUXIMICS.exe
88.221.110.122:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4208
RUXIMICS.exe
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted
7408
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
8112
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
google.com
  • 142.250.184.206
whitelisted
crl.microsoft.com
  • 88.221.110.122
  • 88.221.110.114
whitelisted
www.microsoft.com
  • 23.219.150.101
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Trojan-Ransom.Win32.Krotten.d-3d44b923866b3ea2081d02bfa0efa055adfa869ca621311f3e4ddb2aa54c0dd8.exe