File name:

Rokku.exe

Full analysis: https://app.any.run/tasks/84164379-8958-4875-b60e-5db7282f688d
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: May 16, 2025, 16:36:58
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
ransomware
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed, 3 sections
MD5:

97512F4617019C907CD0F88193039E7C

SHA1:

24CFA261EE30F697E7D1E2215EEE1C21EEBF4579

SHA256:

438888EF36BAD1079AF79DAF152DB443B4472C5715A7B3DA0BA24CC757C53499

SSDEEP:

24576:P8XElWAqM0791OKD7S1olKPn5RjARsSZL/mOHDm+0sfoxztDAH:PmElWhM0791OKD7S1olKPn5RjARs8Tm4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Deletes shadow copies

      • Rokku.exe (PID: 7428)

    • Starts NET.EXE for service management

      • Rokku.exe (PID: 7428)

    • RANSOMWARE has been detected

      • Rokku.exe (PID: 7428)

    • Create files in the Startup directory

      • Rokku.exe (PID: 7428)

  • SUSPICIOUS

    • Mutex name with non-standard characters

      • Rokku.exe (PID: 7428)

    • Uses REG/REGEDIT.EXE to modify registry

      • Rokku.exe (PID: 7428)

    • Creates file in the systems drive root

      • Rokku.exe (PID: 7428)

    • Reads security settings of Internet Explorer

      • Rokku.exe (PID: 7428)

    • There is functionality for taking screenshot (YARA)

      • Rokku.exe (PID: 7428)

  • INFO

    • Reads the computer name

      • Rokku.exe (PID: 7428)

    • Reads the machine GUID from the registry

      • Rokku.exe (PID: 7428)

    • Checks supported languages

      • Rokku.exe (PID: 7428)

    • Process checks computer location settings

      • Rokku.exe (PID: 7428)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 7704)

    • UPX packer has been detected

      • Rokku.exe (PID: 7428)

    • Reads the software policy settings

      • slui.exe (PID: 7540)

    • Creates files or folders in the user directory

      • Rokku.exe (PID: 7428)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (39.3)
.exe | Win32 EXE Yoda's Crypter (38.6)
.dll | Win32 Dynamic Link Library (generic) (9.5)
.exe | Win32 Executable (generic) (6.5)
.exe | Generic Win/DOS Executable (2.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:08:11 14:04:50+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: 2.22
CodeSize: 684032
InitializedDataSize: 4096
UninitializedDataSize: 933888
EntryPoint: 0x18b0d0
OSVersion: 4
ImageVersion: 1
SubsystemVersion: 4
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
144
Monitored processes
16
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start THREAT rokku.exe conhost.exe no specs sppextcomobj.exe no specs slui.exe wmic.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs net.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
7428"C:\Users\admin\Downloads\Rokku.exe" C:\Users\admin\Downloads\Rokku.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\downloads\rokku.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7436\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Rokku.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7508C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7540"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7704"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractiveC:\Windows\SysWOW64\wbem\WMIC.exe—Rokku.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7716\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—WMIC.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7752"C:\Windows\System32\reg.exe" add "HKLM\SYSTEM\CurrentControlSet\services\VSS" /v Start /t REG_DWORD /d 4 /fC:\Windows\SysWOW64\reg.exe—Rokku.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7772\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—reg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7792"C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /fC:\Windows\SysWOW64\reg.exe—Rokku.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7812\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—reg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
4 191
Read events
4 191
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
60
Text files
112
Unknown types
0

Dropped files

PID
Process
Filename
Type
7428Rokku.exeC:\Users\Public\README_HOW_TO_UNLOCK.HTMLhtml
MD5:C784D96CA311302C6F2F8F0BEE8C725B
SHA256:A7836550412B0E0963D16D8442B894A1148326B86D119E4D30F1B11956380EF0
7428Rokku.exeC:\Users\admin\Downloads\README_HOW_TO_UNLOCK.TXTtext
MD5:04B892B779D04F3A906FDE1A904D98BB
SHA256:EB22C6ECFD4D7D0FCEA5063201CCF5E7313780E007EF47CCA01F1369EE0E6BE0
7428Rokku.exeC:\Users\admin\3D Objects\README_HOW_TO_UNLOCK.HTMLhtml
MD5:C784D96CA311302C6F2F8F0BEE8C725B
SHA256:A7836550412B0E0963D16D8442B894A1148326B86D119E4D30F1B11956380EF0
7428Rokku.exeC:\Users\admin\Desktop\README_HOW_TO_UNLOCK.TXTtext
MD5:04B892B779D04F3A906FDE1A904D98BB
SHA256:EB22C6ECFD4D7D0FCEA5063201CCF5E7313780E007EF47CCA01F1369EE0E6BE0
7428Rokku.exeC:\Users\admin\.ms-ad\README_HOW_TO_UNLOCK.TXTtext
MD5:04B892B779D04F3A906FDE1A904D98BB
SHA256:EB22C6ECFD4D7D0FCEA5063201CCF5E7313780E007EF47CCA01F1369EE0E6BE0
7428Rokku.exeC:\Users\admin\README_HOW_TO_UNLOCK.TXTtext
MD5:04B892B779D04F3A906FDE1A904D98BB
SHA256:EB22C6ECFD4D7D0FCEA5063201CCF5E7313780E007EF47CCA01F1369EE0E6BE0
7428Rokku.exeC:\Users\admin\AppData\README_HOW_TO_UNLOCK.HTMLhtml
MD5:C784D96CA311302C6F2F8F0BEE8C725B
SHA256:A7836550412B0E0963D16D8442B894A1148326B86D119E4D30F1B11956380EF0
7428Rokku.exeC:\Users\admin\AppData\README_HOW_TO_UNLOCK.TXTtext
MD5:04B892B779D04F3A906FDE1A904D98BB
SHA256:EB22C6ECFD4D7D0FCEA5063201CCF5E7313780E007EF47CCA01F1369EE0E6BE0
7428Rokku.exeC:\Users\admin\3D Objects\README_HOW_TO_UNLOCK.TXTtext
MD5:04B892B779D04F3A906FDE1A904D98BB
SHA256:EB22C6ECFD4D7D0FCEA5063201CCF5E7313780E007EF47CCA01F1369EE0E6BE0
7428Rokku.exeC:\Users\admin\README_HOW_TO_UNLOCK.HTMLhtml
MD5:C784D96CA311302C6F2F8F0BEE8C725B
SHA256:A7836550412B0E0963D16D8442B894A1148326B86D119E4D30F1B11956380EF0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
10
DNS requests
8
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2112
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
google.com
  • 142.250.186.142
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Rokku.exe