File name:

2025-06-21_1b61ad8c3e84becf2da5acf35ee1726f_cryptolocker_elex

Full analysis: https://app.any.run/tasks/c581d75d-3a46-4a85-8ca6-83fc3983a30c
Verdict: Malicious activity
Analysis date: June 21, 2025, 16:34:27
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

1B61AD8C3E84BECF2DA5ACF35EE1726F

SHA1:

D1646774B8AEB6C4E11BC67B330985CD46742445

SHA256:

651F906E4EFE3760001AE176F12F2917F3CD39331EC6DBB4957EA60CE9D0B5D1

SSDEEP:

768:xTg8+J2CMXia68U64J7FN0S16avdrQFiLjJvtAqjrG4UAu:lg8O2CMSaub2oc+vAqjDU9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads the date of Windows installation

      • 2025-06-21_1b61ad8c3e84becf2da5acf35ee1726f_cryptolocker_elex.exe (PID: 2492)

    • Executable content was dropped or overwritten

      • 2025-06-21_1b61ad8c3e84becf2da5acf35ee1726f_cryptolocker_elex.exe (PID: 2492)

    • Reads security settings of Internet Explorer

      • 2025-06-21_1b61ad8c3e84becf2da5acf35ee1726f_cryptolocker_elex.exe (PID: 2492)
      • lossy.exe (PID: 2696)

    • Starts itself from another location

      • 2025-06-21_1b61ad8c3e84becf2da5acf35ee1726f_cryptolocker_elex.exe (PID: 2492)

  • INFO

    • Process checks computer location settings

      • 2025-06-21_1b61ad8c3e84becf2da5acf35ee1726f_cryptolocker_elex.exe (PID: 2492)
      • lossy.exe (PID: 2696)

    • Checks supported languages

      • 2025-06-21_1b61ad8c3e84becf2da5acf35ee1726f_cryptolocker_elex.exe (PID: 2492)
      • lossy.exe (PID: 2696)

    • Reads the computer name

      • 2025-06-21_1b61ad8c3e84becf2da5acf35ee1726f_cryptolocker_elex.exe (PID: 2492)
      • lossy.exe (PID: 2696)

    • Create files in a temporary directory

      • 2025-06-21_1b61ad8c3e84becf2da5acf35ee1726f_cryptolocker_elex.exe (PID: 2492)
      • lossy.exe (PID: 2696)

    • Checks proxy server information

      • lossy.exe (PID: 2696)
      • slui.exe (PID: 1052)

    • Reads the machine GUID from the registry

      • lossy.exe (PID: 2696)

    • Reads the software policy settings

      • lossy.exe (PID: 2696)
      • slui.exe (PID: 1052)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:02:16 02:43:56+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 4096
InitializedDataSize: 12288
UninitializedDataSize: -
EntryPoint: 0x1000
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 2.0.1.7
ProductVersionNumber: 2.0.1.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Unknown (0x5)
ObjectFileType: Unknown
FileSubtype: -
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
4
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 2025-06-21_1b61ad8c3e84becf2da5acf35ee1726f_cryptolocker_elex.exe lossy.exe slui.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
1052C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2200C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2492"C:\Users\admin\Desktop\2025-06-21_1b61ad8c3e84becf2da5acf35ee1726f_cryptolocker_elex.exe" C:\Users\admin\Desktop\2025-06-21_1b61ad8c3e84becf2da5acf35ee1726f_cryptolocker_elex.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\2025-06-21_1b61ad8c3e84becf2da5acf35ee1726f_cryptolocker_elex.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2696"C:\Users\admin\AppData\Local\Temp\lossy.exe" C:\Users\admin\AppData\Local\Temp\lossy.exe
2025-06-21_1b61ad8c3e84becf2da5acf35ee1726f_cryptolocker_elex.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\lossy.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
7 427
Read events
7 427
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
2696lossy.exeC:\Users\admin\AppData\Local\Temp\swenled.exehtml
MD5:590A2A16DB7C9454E5429278E1E95347
SHA256:C5FFD9DBEF8CEBBF04436E0680847B95BE3F8140E3B3D1E99FE7E743799DFD97
24922025-06-21_1b61ad8c3e84becf2da5acf35ee1726f_cryptolocker_elex.exeC:\Users\admin\AppData\Local\Temp\lossy.exeexecutable
MD5:F1714C8EEA7C6E28DF414DE43F09D64C
SHA256:C83743BED720BF2F458A6A4B0A46403C23ED302DBE1730087C99967F40BF9BF5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
20
DNS requests
10
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6012
RUXIMICS.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6012
RUXIMICS.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
503
195.110.124.133:443
https://2ndry.com/gold/a3mor.exe
unknown
html
537 b
malicious
—
—
POST
500
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
2940
svchost.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
—
—
POST
500
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6012
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6012
RUXIMICS.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6012
RUXIMICS.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
1268
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
whitelisted
google.com
  • 142.250.184.206
whitelisted
crl.microsoft.com
  • 23.53.40.176
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
2ndry.com
  • 195.110.124.133
malicious
activation-v2.sls.microsoft.com
  • 40.91.76.224
  • 20.83.72.98
whitelisted
x1.c.lencr.org
  • 23.209.209.135
whitelisted
self.events.data.microsoft.com
  • 20.189.173.2
whitelisted

Threats

PID
Process
Class
Message
—
—
A Network Trojan was detected
ET MALWARE Downloader (P2P Zeus dropper UA)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-06-21_1b61ad8c3e84becf2da5acf35ee1726f_cryptolocker_elex