analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d

Full analysis: https://app.any.run/tasks/5e51e662-cfa7-4780-ab4f-a2b93f3b7dd8
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: October 05, 2022, 02:13:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

BE60E389A0108B2871DFF12DFBB542AC

SHA1:

14B4E0BFAC64EC0F837F84AB1780CA7CED8D670D

SHA256:

5D40615701C48A122E44F831E7C8643D07765629A83B15D090587F469C77693D

SSDEEP:

1536:QguHLgeS6umiCp31W4qYXgsLlOqrgB9GpF7LXdarTkCAKL5dsluhtvM4CoLT6QPg:D6seqCp31Hgsp9a9GTrda8CAKLTsWkyI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts NET.EXE for service management

      • 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe (PID: 3068)

    • Deletes shadow copies

      • 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe (PID: 3068)

    • Writes to a start menu file

      • 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe (PID: 3068)

  • SUSPICIOUS

    • Checks supported languages

      • 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe (PID: 3068)
      • cmd.exe (PID: 2200)
      • cmd.exe (PID: 2304)
      • cmd.exe (PID: 2212)

    • Reads the computer name

      • 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe (PID: 3068)

    • Starts SC.EXE for service management

      • 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe (PID: 3068)

    • Uses TASKKILL.EXE to kill process

      • 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe (PID: 3068)

    • Reads Environment values

      • 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe (PID: 3068)

    • Changes tracing settings of the file or console

      • 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe (PID: 3068)

    • Starts CMD.EXE for commands execution

      • 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe (PID: 3068)

    • Creates files in the user directory

      • 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe (PID: 3068)

    • Creates files in the program directory

      • 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe (PID: 3068)

    • Creates files like Ransomware instruction

      • 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe (PID: 3068)

    • Starts CMD.EXE for self-deleting

      • 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe (PID: 3068)

    • Starts CHOICE.EXE (used to create a delay)

      • cmd.exe (PID: 2212)

  • INFO

    • Checks supported languages

      • net.exe (PID: 2044)
      • net.exe (PID: 1964)
      • net.exe (PID: 3144)
      • net1.exe (PID: 2452)
      • net.exe (PID: 116)
      • net1.exe (PID: 1396)
      • net1.exe (PID: 3100)
      • net1.exe (PID: 2504)
      • net.exe (PID: 3688)
      • net.exe (PID: 2784)
      • net.exe (PID: 320)
      • net.exe (PID: 3676)
      • net.exe (PID: 2084)
      • net.exe (PID: 1744)
      • net.exe (PID: 2312)
      • net1.exe (PID: 3040)
      • net.exe (PID: 664)
      • net1.exe (PID: 2528)
      • net1.exe (PID: 2480)
      • net1.exe (PID: 3188)
      • net.exe (PID: 1716)
      • net1.exe (PID: 3216)
      • net.exe (PID: 3556)
      • net1.exe (PID: 3060)
      • net1.exe (PID: 3140)
      • net1.exe (PID: 3228)
      • net1.exe (PID: 476)
      • net1.exe (PID: 3524)
      • net.exe (PID: 3720)
      • net.exe (PID: 4028)
      • net.exe (PID: 1876)
      • net.exe (PID: 1840)
      • net1.exe (PID: 1956)
      • net.exe (PID: 3760)
      • net1.exe (PID: 4060)
      • net1.exe (PID: 2472)
      • net1.exe (PID: 2656)
      • net.exe (PID: 3724)
      • net1.exe (PID: 3784)
      • net.exe (PID: 2792)
      • net.exe (PID: 1924)
      • net.exe (PID: 3664)
      • net.exe (PID: 1232)
      • net.exe (PID: 2480)
      • net1.exe (PID: 3032)
      • net.exe (PID: 1056)
      • sc.exe (PID: 3676)
      • net1.exe (PID: 2684)
      • net.exe (PID: 2192)
      • net.exe (PID: 3888)
      • net1.exe (PID: 2896)
      • net.exe (PID: 3088)
      • net1.exe (PID: 956)
      • sc.exe (PID: 2520)
      • sc.exe (PID: 3920)
      • sc.exe (PID: 2812)
      • net1.exe (PID: 2920)
      • net.exe (PID: 2504)
      • net.exe (PID: 3488)
      • taskkill.exe (PID: 4056)
      • net.exe (PID: 2176)
      • taskkill.exe (PID: 476)
      • net1.exe (PID: 2036)
      • taskkill.exe (PID: 4032)
      • vssadmin.exe (PID: 2200)
      • vssadmin.exe (PID: 1636)
      • net.exe (PID: 916)
      • net.exe (PID: 1068)
      • net1.exe (PID: 1568)
      • net1.exe (PID: 1696)
      • net.exe (PID: 2244)
      • net.exe (PID: 2884)
      • net1.exe (PID: 2168)
      • net1.exe (PID: 2452)
      • vssadmin.exe (PID: 1744)
      • net1.exe (PID: 2964)
      • vssadmin.exe (PID: 3880)
      • vssadmin.exe (PID: 3600)
      • vssadmin.exe (PID: 1384)
      • net1.exe (PID: 3984)
      • vssadmin.exe (PID: 2624)
      • net1.exe (PID: 3236)
      • net1.exe (PID: 2656)
      • vssadmin.exe (PID: 1592)
      • vssadmin.exe (PID: 3608)
      • vssadmin.exe (PID: 2348)
      • vssadmin.exe (PID: 2196)
      • net1.exe (PID: 2832)
      • vssadmin.exe (PID: 2936)
      • net1.exe (PID: 2940)
      • net1.exe (PID: 3208)
      • vssadmin.exe (PID: 3748)
      • vssadmin.exe (PID: 2392)
      • notepad.exe (PID: 1440)
      • PING.EXE (PID: 3524)
      • fsutil.exe (PID: 3056)
      • choice.exe (PID: 3508)

    • Reads the computer name

      • net1.exe (PID: 1396)
      • net1.exe (PID: 3100)
      • net1.exe (PID: 2452)
      • net1.exe (PID: 3188)
      • net1.exe (PID: 3040)
      • net1.exe (PID: 2480)
      • net1.exe (PID: 3060)
      • net1.exe (PID: 3140)
      • net1.exe (PID: 3216)
      • net1.exe (PID: 476)
      • net1.exe (PID: 4060)
      • net1.exe (PID: 3228)
      • net1.exe (PID: 3524)
      • net1.exe (PID: 1956)
      • net1.exe (PID: 3784)
      • net1.exe (PID: 2472)
      • net1.exe (PID: 2656)
      • sc.exe (PID: 3676)
      • net1.exe (PID: 3032)
      • net1.exe (PID: 2684)
      • net1.exe (PID: 2896)
      • sc.exe (PID: 2520)
      • net1.exe (PID: 956)
      • net1.exe (PID: 2920)
      • sc.exe (PID: 2812)
      • sc.exe (PID: 3920)
      • taskkill.exe (PID: 4056)
      • net1.exe (PID: 2036)
      • taskkill.exe (PID: 4032)
      • taskkill.exe (PID: 476)
      • vssadmin.exe (PID: 2200)
      • net1.exe (PID: 1568)
      • net1.exe (PID: 2452)
      • net1.exe (PID: 1696)
      • net1.exe (PID: 2168)
      • vssadmin.exe (PID: 1636)
      • net1.exe (PID: 2964)
      • vssadmin.exe (PID: 1744)
      • vssadmin.exe (PID: 2624)
      • vssadmin.exe (PID: 3600)
      • net1.exe (PID: 3236)
      • vssadmin.exe (PID: 3880)
      • vssadmin.exe (PID: 1592)
      • vssadmin.exe (PID: 1384)
      • net1.exe (PID: 3984)
      • net1.exe (PID: 2656)
      • vssadmin.exe (PID: 2348)
      • vssadmin.exe (PID: 2196)
      • vssadmin.exe (PID: 2392)
      • vssadmin.exe (PID: 3748)
      • vssadmin.exe (PID: 2936)
      • net1.exe (PID: 3208)
      • net1.exe (PID: 2832)
      • vssadmin.exe (PID: 3608)
      • net1.exe (PID: 2940)
      • PING.EXE (PID: 3524)

    • Reads settings of System Certificates

      • 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe (PID: 3068)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2020-Jul-08 21:24:12
FileDescription: Codemeter
FileVersion: 4.5.0.0
InternalName: aZnLma0ZpqTthmr
LegalCopyright: Copyright 2019 3fTddThVDVTaMx4
OriginalFilename: gCLianUocZKoeIY
ProductVersion: 4.5.0.0
Assembly Version: 4.5.0.0
ProductName: ntWB6ohspNIoCar
CompanyName: YOkBRITTKNBYLVa qNEQn0mbG2wNoNm
LegalTrademarks: PWWPh5jww0vweJe 4pFhUfFs2GJ1B5U

DOS Header

e_magic: MZ
e_cblp: 144
e_cp: 3
e_crlc: -
e_cparhdr: 4
e_minalloc: -
e_maxalloc: 65535
e_ss: -
e_sp: 184
e_csum: -
e_ip: -
e_cs: -
e_ovno: -
e_oemid: -
e_oeminfo: -
e_lfanew: 128

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 3
TimeDateStamp: 2020-Jul-08 21:24:12
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
8192
89732
90112
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
5.50999
.rsrc
98304
1588
2048
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.71351
.reloc
106496
12
512
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
0.10191

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.54846
936
Latin 1 / Western European
UNKNOWN
RT_VERSION
1 (#2)
5.00112
490
Latin 1 / Western European
UNKNOWN
RT_MANIFEST

Imports

mscoree.dll
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
195
Monitored processes
101
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net1.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs taskkill.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs taskkill.exe no specs taskkill.exe no specs net1.exe no specs net1.exe no specs vssadmin.exe no specs net1.exe no specs vssadmin.exe no specs vssadmin.exe no specs vssadmin.exe no specs vssadmin.exe no specs vssadmin.exe no specs vssadmin.exe no specs vssadmin.exe no specs vssadmin.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs vssadmin.exe no specs vssadmin.exe no specs vssadmin.exe no specs vssadmin.exe no specs vssadmin.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs cmd.exe no specs notepad.exe no specs cmd.exe no specs cmd.exe no specs ping.exe no specs choice.exe no specs fsutil.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3068"C:\Users\admin\AppData\Local\Temp\5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe" C:\Users\admin\AppData\Local\Temp\5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
Explorer.EXE
User:
admin
Company:
YOkBRITTKNBYLVa qNEQn0mbG2wNoNm
Integrity Level:
MEDIUM
Description:
Codemeter
Exit code:
0
Version:
4.5.0.0
Modules
Images
c:\users\admin\appdata\local\temp\5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3144"net.exe" stop avpsus /yC:\Windows\system32\net.exe—5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
1964"net.exe" stop McAfeeDLPAgentService /yC:\Windows\system32\net.exe—5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\apphelp.dll
2044"net.exe" stop mfewc /yC:\Windows\system32\net.exe—5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\net.exe
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
116"net.exe" stop BMR Boot Service /yC:\Windows\system32\net.exe—5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\mpr.dll
c:\windows\system32\browcli.dll
c:\windows\system32\netutils.dll
c:\windows\system32\samcli.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\wkscli.dll
1744"net.exe" stop NetBackup BMR MTFTP Service /yC:\Windows\system32\net.exe—5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\browcli.dll
c:\windows\system32\samcli.dll
3676"net.exe" stop DefWatch /yC:\Windows\system32\net.exe—5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\net.exe
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
664"net.exe" stop ccEvtMgr /yC:\Windows\system32\net.exe—5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
3688"net.exe" stop ccSetMgr /yC:\Windows\system32\net.exe—5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\mpr.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\advapi32.dll
1876"net.exe" stop SavRoam /yC:\Windows\system32\net.exe—5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\browcli.dll
c:\windows\system32\netutils.dll
Total events
4 642
Read events
4 608
Write events
34
Delete events
0

Modification events

(PID) Process:(3068) 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3068) 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3068) 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(3068) 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(3068) 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3068) 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(3068) 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3068) 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3068) 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:FileTracingMask
Value:
(PID) Process:(3068) 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:ConsoleTracingMask
Value:
Executable files
0
Suspicious files
33
Text files
12
Unknown types
2

Dropped files

PID
Process
Filename
Type
30685d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exeC:\Users\Public\Music\Sample Music\Kalimba.mp3.locked —
MD5:—
SHA256:—
30685d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exeC:\Users\Public\Music\Sample Music\Sleep Away.mp3.locked —
MD5:—
SHA256:—
30685d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exeC:\Users\admin\Pictures\joinsetting.png.lockedbinary
MD5:121C38087667D9F8AEF12B7A0DC0122F
SHA256:BA395F2626A714994EDA20048D130F1EFF1C8A49E0F6DE50DA7F05457C35BDA5
30685d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exeC:\Users\admin\Pictures\shipgrand.png.lockedbinary
MD5:491214CD48192DD70E9C245558EE4738
SHA256:4DE946C5A33255216C52049F0160E0789A330618032508367F9D7BA857547137
30685d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exeC:\ProgramData\Mozilla\updates\308046B0AF4A39CB\updates\backup-update.log.lockedvc
MD5:07A93ED30765B62030975F89C20FA5C9
SHA256:72F98FC6442B8817CB5ABAA3E9E441612F0B84CEBDCCE1CB0F3C79E1057916C6
30685d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exeC:\Users\admin\AppData\Local\Temp\HOW_TO_DECYPHER_FILES.txttext
MD5:C283AA621B17AC8127B1E74CC69A3FB0
SHA256:B01AB09919C0B59E3E3631BDCA33DF114926B7BB082679A128AA5E1EB545452B
30685d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exeC:\Users\admin\Downloads\gamesmessages.jpg.lockedbinary
MD5:C2A7573E4D61A1694B13DE0F48E6E270
SHA256:EA67F258A4B1C4968DD82890E9339CF26410FCB8DC9F00C4383FE6B28F00C824
30685d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exeC:\Users\admin\Downloads\binlook.jpg.lockedbinary
MD5:FA50651478FAE505F11FDFD642A07540
SHA256:12BBB3F53DC05F1217467918E6DB7F0069CA55D540F40AF1513C5CF9AA17464A
30685d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exeC:\Users\Public\Pictures\Sample Pictures\Koala.jpg.lockedbinary
MD5:66ADAAE925E0924B96C646C4FBB9C96C
SHA256:14BAD7567FA74C3D56006F35AD10B98169677170BE7E8D0A60F51443E96CADCC
30685d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exeC:\Users\Public\Pictures\Sample Pictures\Desert.jpg.lockedbinary
MD5:4C90B57E0FBC29A08DBD2BA0C02EEF4D
SHA256:0BEB122323B878F057F8149DB2AA32A84462610C5C7D8EA1DED7B0219A4DC63D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3068
5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
142.250.185.100:443
www.google.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
www.google.com
  • 142.250.185.100
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d