File name:

57a2401758b5282090f145623041a6c3805663de137505a7095df9e0271b4602.exe

Full analysis: https://app.any.run/tasks/c5105a50-fdb3-451f-baca-b60f3587030a
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: May 15, 2025, 20:40:16
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto
rhysida
ransomware
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, 3 sections
MD5:

3225B95FC72F238AB1E53BFABC11B551

SHA1:

DCBD80DAE14FF473B2C052863D01EB7FC7A536C3

SHA256:

57A2401758B5282090F145623041A6C3805663DE137505A7095DF9E0271B4602

SSDEEP:

6144:pM+AxZw+nMz76l7790/ymkc/hCditXqQzARFwrwO:pM1Bxl77O/yhcJCkBFzQwrh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • RHYSIDA has been found (auto)

      • 57a2401758b5282090f145623041a6c3805663de137505a7095df9e0271b4602.exe (PID: 7264)

    • RHYSIDA has been detected (YARA)

      • 57a2401758b5282090f145623041a6c3805663de137505a7095df9e0271b4602.exe (PID: 7264)

  • SUSPICIOUS

    • Creates file in the systems drive root

      • 57a2401758b5282090f145623041a6c3805663de137505a7095df9e0271b4602.exe (PID: 7264)

    • Process drops legitimate windows executable

      • 57a2401758b5282090f145623041a6c3805663de137505a7095df9e0271b4602.exe (PID: 7264)

    • Executable content was dropped or overwritten

      • 57a2401758b5282090f145623041a6c3805663de137505a7095df9e0271b4602.exe (PID: 7264)

  • INFO

    • Checks supported languages

      • 57a2401758b5282090f145623041a6c3805663de137505a7095df9e0271b4602.exe (PID: 7264)

    • The sample compiled with english language support

      • 57a2401758b5282090f145623041a6c3805663de137505a7095df9e0271b4602.exe (PID: 7264)

    • The sample compiled with chinese language support

      • 57a2401758b5282090f145623041a6c3805663de137505a7095df9e0271b4602.exe (PID: 7264)

    • The sample compiled with portuguese language support

      • 57a2401758b5282090f145623041a6c3805663de137505a7095df9e0271b4602.exe (PID: 7264)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:01:31 05:27:48+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Large address aware, No debug
PEType: PE32+
LinkerVersion: 2.3
CodeSize: 249856
InitializedDataSize: 4096
UninitializedDataSize: 348160
EntryPoint: 0x8ec00
OSVersion: 4
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #RHYSIDA 57a2401758b5282090f145623041a6c3805663de137505a7095df9e0271b4602.exe sppextcomobj.exe no specs slui.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
7264"C:\Users\admin\AppData\Local\Temp\57a2401758b5282090f145623041a6c3805663de137505a7095df9e0271b4602.exe" C:\Users\admin\AppData\Local\Temp\57a2401758b5282090f145623041a6c3805663de137505a7095df9e0271b4602.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\57a2401758b5282090f145623041a6c3805663de137505a7095df9e0271b4602.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
7348C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7380"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
8124C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
572
Read events
572
Write events
0
Delete events
0

Modification events

No data
Executable files
153
Suspicious files
6 991
Text files
916
Unknown types
2

Dropped files

PID
Process
Filename
Type
726457a2401758b5282090f145623041a6c3805663de137505a7095df9e0271b4602.exeC:\Users\admin\CriticalBreachDetected.pdfpdf
MD5:6E08AFD4F953BED223FC48853F6EE5B4
SHA256:FA8746226978FC5B754403A8EE32050C3B0DA95C62275C593BC48B7A8010868F
726457a2401758b5282090f145623041a6c3805663de137505a7095df9e0271b4602.exeC:\Users\admin\.ms-ad\CriticalBreachDetected.pdfpdf
MD5:6E08AFD4F953BED223FC48853F6EE5B4
SHA256:FA8746226978FC5B754403A8EE32050C3B0DA95C62275C593BC48B7A8010868F
726457a2401758b5282090f145623041a6c3805663de137505a7095df9e0271b4602.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst.rhysidabinary
MD5:366B140BAFC863B7E366AA1E51604759
SHA256:CBC8B288DBD2C72432081CF33CEF431572A94C7FB89DBCD59973B99E3871814E
726457a2401758b5282090f145623041a6c3805663de137505a7095df9e0271b4602.exeC:\Users\admin\AppData\CriticalBreachDetected.pdfpdf
MD5:6E08AFD4F953BED223FC48853F6EE5B4
SHA256:FA8746226978FC5B754403A8EE32050C3B0DA95C62275C593BC48B7A8010868F
726457a2401758b5282090f145623041a6c3805663de137505a7095df9e0271b4602.exeC:\Users\admin\3D Objects\CriticalBreachDetected.pdfpdf
MD5:6E08AFD4F953BED223FC48853F6EE5B4
SHA256:FA8746226978FC5B754403A8EE32050C3B0DA95C62275C593BC48B7A8010868F
726457a2401758b5282090f145623041a6c3805663de137505a7095df9e0271b4602.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat.rhysidabinary
MD5:3CB389F387690653DA269B5A1DE2F70A
SHA256:06A974A2047C158306C992040B79E1ADE40922B4695D522280DFAAF2FE4D1E77
726457a2401758b5282090f145623041a6c3805663de137505a7095df9e0271b4602.exeC:\Users\admin\AppData\Local\CriticalBreachDetected.pdfpdf
MD5:6E08AFD4F953BED223FC48853F6EE5B4
SHA256:FA8746226978FC5B754403A8EE32050C3B0DA95C62275C593BC48B7A8010868F
726457a2401758b5282090f145623041a6c3805663de137505a7095df9e0271b4602.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\CriticalBreachDetected.pdfpdf
MD5:6E08AFD4F953BED223FC48853F6EE5B4
SHA256:FA8746226978FC5B754403A8EE32050C3B0DA95C62275C593BC48B7A8010868F
726457a2401758b5282090f145623041a6c3805663de137505a7095df9e0271b4602.exeC:\Users\admin\AppData\Local\Adobe\CriticalBreachDetected.pdfpdf
MD5:6E08AFD4F953BED223FC48853F6EE5B4
SHA256:FA8746226978FC5B754403A8EE32050C3B0DA95C62275C593BC48B7A8010868F
726457a2401758b5282090f145623041a6c3805663de137505a7095df9e0271b4602.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\Cache\CriticalBreachDetected.pdfpdf
MD5:6E08AFD4F953BED223FC48853F6EE5B4
SHA256:FA8746226978FC5B754403A8EE32050C3B0DA95C62275C593BC48B7A8010868F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
23
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7908
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7908
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
20.190.159.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
google.com
  • 216.58.206.46
whitelisted
www.microsoft.com
  • 23.52.120.96
whitelisted
login.live.com
  • 20.190.159.2
  • 20.190.159.128
  • 20.190.159.131
  • 40.126.31.73
  • 20.190.159.64
  • 40.126.31.1
  • 20.190.159.73
  • 40.126.31.3
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
57a2401758b5282090f145623041a6c3805663de137505a7095df9e0271b4602.exe