File name:

Trojan.NSIS.Androm.CM.7z

Full analysis: https://app.any.run/tasks/e5222480-5f52-43ec-8ba6-f3796c285852
Verdict: Malicious activity
Threats:

Cerber is a Ransomware-as-a-Service (RaaS) that appeared in 2016, spread quickly and has been evolving since. It became well-known for its file encryption, offline capabilities, and sophisticated evasion techniques. It primarily targets enterprises, financial institutions, and government entities, encrypting their data and demanding ransom payments in Bitcoin. It also targets everyday users encrypting personal files (photos, documents) with the risk of their permanent loss.

Malware Trends Tracker     >>>
Analysis date: November 20, 2023, 20:53:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
cerber
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

FDFFB8E3F1D4D0AC7637D37A8D001E51

SHA1:

286C0EABBFB465387C6E8E82FB0DBC8C8B1B6681

SHA256:

5FCC0C39AFFE5A135D07383A29EBF9414093E39161990A627E1417B482C227FA

SSDEEP:

6144:78OOkTWFPHQiwB6GZZeWqg3ewjYQxAsb98FAHJDN1ezVr:78OOoSE5Fqg3ewjYqFbmFmJDT8r

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe (PID: 3672)

    • CERBER has been detected (SURICATA)

      • b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe (PID: 916)
      • msedge.exe (PID: 2900)

    • Connects to the CnC server

      • b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe (PID: 916)

    • Deletes shadow copies

      • cmd.exe (PID: 1352)

    • Probably malicious OneNote attachment is found

      • b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe (PID: 916)

    • Actions looks like stealing of personal data

      • b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe (PID: 916)

  • SUSPICIOUS

    • Application launched itself

      • taskmgr.exe (PID: 3464)
      • b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe (PID: 3672)

    • Reads the Internet Settings

      • taskmgr.exe (PID: 3464)
      • WMIC.exe (PID: 788)
      • mshta.exe (PID: 2864)
      • mshta.exe (PID: 3900)
      • b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe (PID: 916)

    • The process creates files with name similar to system file names

      • b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe (PID: 3672)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe (PID: 3672)

    • Starts CMD.EXE for commands execution

      • b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe (PID: 916)

    • Executes as Windows Service

      • VSSVC.exe (PID: 1348)

    • Creates files like ransomware instruction

      • b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe (PID: 916)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 3504)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 3504)

  • INFO

    • Manual execution by a user

      • taskmgr.exe (PID: 3464)
      • b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe (PID: 3672)
      • wmpnscfg.exe (PID: 1628)
      • mshta.exe (PID: 2864)

    • Reads the computer name

      • b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe (PID: 3672)
      • b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe (PID: 916)
      • wmpnscfg.exe (PID: 1628)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3440)

    • Checks supported languages

      • b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe (PID: 3672)
      • b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe (PID: 916)
      • wmpnscfg.exe (PID: 1628)

    • Create files in a temporary directory

      • b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe (PID: 3672)
      • b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe (PID: 916)

    • Reads the machine GUID from the registry

      • b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe (PID: 916)
      • wmpnscfg.exe (PID: 1628)

    • Creates files in the program directory

      • b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe (PID: 916)

    • Creates files or folders in the user directory

      • b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe (PID: 916)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 2864)
      • mshta.exe (PID: 3900)

    • Application launched itself

      • msedge.exe (PID: 3060)
      • msedge.exe (PID: 2112)
      • msedge.exe (PID: 3340)

    • Checks proxy server information

      • mshta.exe (PID: 2864)
      • mshta.exe (PID: 3900)

    • The dropped object may contain a URL to Tor Browser

      • b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe (PID: 916)

    • Dropped object may contain TOR URL's

      • b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe (PID: 916)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
97
Monitored processes
45
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs taskmgr.exe no specs taskmgr.exe b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe #CERBER b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe wmpnscfg.exe no specs cmd.exe no specs wmic.exe no specs vssvc.exe no specs PhotoViewer.dll no specs mshta.exe msedge.exe msedge.exe no specs msedge.exe no specs #CERBER msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs mshta.exe no specs cmd.exe no specs taskkill.exe no specs ping.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
328"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=2532 --field-trial-handle=1128,i,10033223277736203375,2685887415399655616,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
788C:\Windows\system32\wbem\wmic.exe shadowcopy deleteC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
916"C:\Users\admin\Desktop\b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe" C:\Users\admin\Desktop\b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe
b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1128"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=940 --field-trial-handle=1128,i,10033223277736203375,2685887415399655616,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1348C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1352"C:\Windows\system32\cmd.exe"C:\Windows\System32\cmd.exe—b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1352"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=3428 --field-trial-handle=1128,i,10033223277736203375,2685887415399655616,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1364"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=109.0.5414.149 "--annotation=exe=C:\Program Files\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win32 "--annotation=prod=Microsoft Edge" --annotation=ver=109.0.1518.115 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd8,0x69a6f598,0x69a6f5a8,0x69a6f5b4C:\Program Files\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1588"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3832 --field-trial-handle=1128,i,10033223277736203375,2685887415399655616,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1628"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
Total events
23 191
Read events
23 002
Write events
185
Delete events
4

Modification events

(PID) Process:(3440) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3440) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3440) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3440) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3440) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3440) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3440) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3440) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3440) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
(PID) Process:(3440) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\Desktop
Executable files
4
Suspicious files
406
Text files
266
Unknown types
100

Dropped files

PID
Process
Filename
Type
3672b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exeC:\Users\admin\AppData\Local\Temp\Devoir.2yvbinary
MD5:13EC7322B0E73FAEF660A81D772E5B14
SHA256:ABA40EB19E6EB60D7DF4AE1AF4D4B098B3FB3E15AB8818C32961FC45D465EE0E
3672b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exeC:\Users\admin\AppData\Local\Temp\nspDB62.tmp\System.dllexecutable
MD5:A436DB0C473A087EB61FF5C53C34BA27
SHA256:75ED40311875312617D6711BAED0BE29FCAEE71031CA27A8D308A72B15A51E49
3672b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exeC:\Users\admin\AppData\Local\Temp\disembarkation.dllexecutable
MD5:1BEA7D9E09E15E62B38474E87B5C1041
SHA256:B8BB9C23722C115730F68C1DE7E970CAB39B7E4A581EDC1759CECDD0B2288297
3440WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3440.10652\Trojan.NSIS.Androm.CM\b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe.bakexecutable
MD5:5CF53FF2D717D768C88FA264934F3361
SHA256:B6FDF9369AF7D3663274392DE89B1D644F86232311E63A4A395DDA474E1200EE
916b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exeC:\Users\admin\AppData\Local\Temp\90059c37\1320.tmpbinary
MD5:D25321900073C50B8ADFF22799076A40
SHA256:2AE4572B0A36CAAA02130EA5F7321501C7994B45CE94FFD70C44C92E8AED0144
916b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exeC:\Users\admin\Documents\OneNote Notebooks\Personal\Unfiled Notes.oneone
MD5:94EED19B0FC5BE20710A0FC863D7096C
SHA256:5068D02B93CEFA0B09A224493D277FD3F268A6A01E2266E12E7BFBF2A3640E55
916b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exeC:\Users\admin\Downloads\answertrademarks.jpgimage
MD5:7AB9AA3B5917240AD63C022D555B25B1
SHA256:2F53905F70EEDD3B6BDB0FEC5F9C0760D3E930CE83F4E66C6EB3F541CB96B8B7
916b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exeC:\Users\admin\Downloads\Vq5a1vrqDL.b58dimage
MD5:7AB9AA3B5917240AD63C022D555B25B1
SHA256:2F53905F70EEDD3B6BDB0FEC5F9C0760D3E930CE83F4E66C6EB3F541CB96B8B7
916b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exeC:\Users\admin\AppData\Roaming\FileZilla\README.htahtml
MD5:0FBD56E07F1895F81B00A79957ED8BED
SHA256:37ECBD4D785C1CA4F1134D31B8F460C43F90A406C75363B959A115F00221BB9A
916b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exeC:\Users\admin\AppData\Roaming\FileZilla\queue.sqlite3binary
MD5:891890D5BB7F79A08EC4C7037CDF74AE
SHA256:573EF3629B57C2C52DD3379DB72158734FE9643A6C9ADA3D8B7E6D278E8A1257
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
3 296
DNS requests
52
Threats
66

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2864
mshta.exe
GET
403
104.20.21.251:80
http://api.blockcypher.com/v1/btc/main/addrs/17gd1msp5FnMcEMF1MitTNSsYs7w7AQyCt?_=1700513749827
unknown
binary
98 b
unknown
2864
mshta.exe
GET
403
104.20.21.251:80
http://api.blockcypher.com/v1/btc/main/addrs/17gd1msp5FnMcEMF1MitTNSsYs7w7AQyCt?_=1700513767819
unknown
binary
98 b
unknown
2864
mshta.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
unknown
binary
1.47 Kb
unknown
2864
mshta.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e955e4dfd357a11c
unknown
compressed
4.66 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
916
b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe
65.55.50.1:6892
—
—
—
whitelisted
916
b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe
65.55.50.2:6892
—
—
—
whitelisted
916
b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe
65.55.50.6:6892
—
—
—
whitelisted
916
b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe
65.55.50.5:6892
—
—
—
whitelisted
916
b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe
65.55.50.0:6892
—
—
—
whitelisted
916
b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe
65.55.50.4:6892
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
xrhwryizf5mui7a5.ud9z0v.top
  • —
unknown
btc.blockr.io
  • —
unknown
api.blockcypher.com
  • 104.20.21.251
  • 172.67.2.88
  • 104.20.20.251
whitelisted
chain.so
  • 172.67.74.49
  • 104.26.8.86
  • 104.26.9.86
whitelisted
xrhwryizf5mui7a5.c3rczu.top
  • —
unknown
config.edge.skype.com
  • 13.107.42.16
whitelisted
nav-edge.smartscreen.microsoft.com
  • 20.103.180.120
whitelisted
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted

Threats

PID
Process
Class
Message
916
b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe
Malware Command and Control Activity Detected
ET MALWARE Ransomware/Cerber Checkin 2
916
b6fdf9369af7d3663274392de89b1d644f86232311e63a4a395dda474e1200ee.exe
Malware Command and Control Activity Detected
ET MALWARE Ransomware/Cerber Checkin M3 (10)
1080
svchost.exe
A Network Trojan was detected
ET MALWARE Ransomware/Cerber Onion Domain Lookup
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
2900
msedge.exe
A Network Trojan was detected
ET MALWARE Ransomware/Cerber Onion Domain Lookup
2900
msedge.exe
A Network Trojan was detected
ET MALWARE Ransomware/Cerber Onion Domain Lookup
2900
msedge.exe
A Network Trojan was detected
ET MALWARE Ransomware/Cerber Onion Domain Lookup
2900
msedge.exe
A Network Trojan was detected
ET MALWARE Ransomware/Cerber Onion Domain Lookup
1080
svchost.exe
A Network Trojan was detected
ET MALWARE Ransomware/Cerber Onion Domain Lookup
2900
msedge.exe
A Network Trojan was detected
ET MALWARE Ransomware/Cerber Onion Domain Lookup
33 ETPRO signatures available at the full report
Process
Message
msedge.exe
[1120/205559.804:ERROR:exception_handler_server.cc(527)] ConnectNamedPipe: The pipe is being closed. (0xE8)
msedge.exe
[1120/205610.154:ERROR:exception_handler_server.cc(527)] ConnectNamedPipe: The pipe is being closed. (0xE8)
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Trojan.NSIS.Androm.CM.7z