File name:

6639c5e42418fa8caf0dee6d4516984842cda2bfa9070139ebae691fbf1969f0

Full analysis: https://app.any.run/tasks/3d48bca1-eb0f-4dc9-96eb-410fb19e1061
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: May 19, 2025, 03:45:33
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
evasion
ransomware
auto-sch
blackhunt
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

B26AAA9908C7A9E43DD1F60FF4A20CE1

SHA1:

9C8A1BEB8FF7C470592211460BF476D24B061420

SHA256:

6639C5E42418FA8CAF0DEE6D4516984842CDA2BFA9070139EBAE691FBF1969F0

SSDEEP:

6144:U7QuvMEX+Z1tPKYJlsAFJsnSQqMK7IZL6t+XXAOMHkuglLqTK74:U7QpvzJKYJ+AFwSQqMKkZ+t+ZMHkvqmU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 6184)

    • Using BCDEDIT.EXE to modify recovery options

      • cmd.exe (PID: 7204)
      • cmd.exe (PID: 7604)
      • cmd.exe (PID: 7668)
      • cmd.exe (PID: 7856)
      • cmd.exe (PID: 7500)
      • cmd.exe (PID: 7784)
      • cmd.exe (PID: 8008)
      • cmd.exe (PID: 6564)

    • Deletes shadow copies

      • cmd.exe (PID: 7616)
      • cmd.exe (PID: 7848)
      • cmd.exe (PID: 7908)
      • cmd.exe (PID: 8108)
      • cmd.exe (PID: 5136)
      • cmd.exe (PID: 2392)
      • cmd.exe (PID: 1128)
      • cmd.exe (PID: 8052)

    • Resizes shadow copies

      • cmd.exe (PID: 7416)
      • cmd.exe (PID: 7644)
      • cmd.exe (PID: 7792)
      • cmd.exe (PID: 7840)

    • RANSOMWARE has been detected

      • 74df3452a6b9dcdba658af7a9cf5afb09cce51534f9bc63079827bf73075243b.exe (PID: 4724)

    • BLACKHUNT has been detected (YARA)

      • 74df3452a6b9dcdba658af7a9cf5afb09cce51534f9bc63079827bf73075243b.exe (PID: 4724)
      • 74df3452a6b9dcdba658af7a9cf5afb09cce51534f9bc63079827bf73075243b.exe (PID: 7084)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 7144)
      • cmd.exe (PID: 5404)

    • Renames files like ransomware

      • 74df3452a6b9dcdba658af7a9cf5afb09cce51534f9bc63079827bf73075243b.exe (PID: 4724)

    • Starts CMD.EXE for self-deleting

      • 74df3452a6b9dcdba658af7a9cf5afb09cce51534f9bc63079827bf73075243b.exe (PID: 4724)
      • 74df3452a6b9dcdba658af7a9cf5afb09cce51534f9bc63079827bf73075243b.exe (PID: 7084)

  • SUSPICIOUS

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 5508)
      • cmd.exe (PID: 1616)
      • cmd.exe (PID: 5048)
      • cmd.exe (PID: 4976)
      • cmd.exe (PID: 1072)
      • cmd.exe (PID: 1532)
      • cmd.exe (PID: 2852)
      • cmd.exe (PID: 456)
      • cmd.exe (PID: 4920)
      • cmd.exe (PID: 5680)
      • cmd.exe (PID: 5244)
      • cmd.exe (PID: 6488)
      • cmd.exe (PID: 5956)
      • cmd.exe (PID: 7304)
      • cmd.exe (PID: 7352)
      • cmd.exe (PID: 7408)
      • cmd.exe (PID: 7180)
      • cmd.exe (PID: 7428)
      • cmd.exe (PID: 7628)
      • cmd.exe (PID: 7544)
      • cmd.exe (PID: 8016)
      • cmd.exe (PID: 7684)
      • cmd.exe (PID: 7796)
      • cmd.exe (PID: 7896)
      • cmd.exe (PID: 8116)
      • cmd.exe (PID: 8144)
      • cmd.exe (PID: 8188)
      • cmd.exe (PID: 1052)
      • cmd.exe (PID: 7300)
      • cmd.exe (PID: 2852)
      • cmd.exe (PID: 780)
      • cmd.exe (PID: 856)
      • cmd.exe (PID: 7404)
      • cmd.exe (PID: 8120)
      • cmd.exe (PID: 7424)
      • cmd.exe (PID: 1196)
      • cmd.exe (PID: 5364)
      • cmd.exe (PID: 1116)
      • cmd.exe (PID: 7692)
      • cmd.exe (PID: 6252)
      • cmd.exe (PID: 7216)
      • cmd.exe (PID: 8028)
      • cmd.exe (PID: 4728)
      • cmd.exe (PID: 7784)
      • cmd.exe (PID: 300)
      • cmd.exe (PID: 4892)
      • cmd.exe (PID: 6044)
      • cmd.exe (PID: 4932)
      • cmd.exe (PID: 1188)
      • cmd.exe (PID: 7296)
      • cmd.exe (PID: 4812)
      • cmd.exe (PID: 7560)
      • cmd.exe (PID: 2644)
      • cmd.exe (PID: 6268)
      • cmd.exe (PID: 1240)
      • cmd.exe (PID: 7584)
      • cmd.exe (PID: 5352)
      • cmd.exe (PID: 6080)
      • cmd.exe (PID: 7608)
      • cmd.exe (PID: 7828)
      • cmd.exe (PID: 7156)
      • cmd.exe (PID: 5200)
      • cmd.exe (PID: 7272)
      • cmd.exe (PID: 5384)
      • cmd.exe (PID: 1748)
      • cmd.exe (PID: 7528)

    • Found strings related to reading or modifying Windows Defender settings

      • 74df3452a6b9dcdba658af7a9cf5afb09cce51534f9bc63079827bf73075243b.exe (PID: 4724)
      • 74df3452a6b9dcdba658af7a9cf5afb09cce51534f9bc63079827bf73075243b.exe (PID: 7084)

    • Starts CMD.EXE for commands execution

      • 74df3452a6b9dcdba658af7a9cf5afb09cce51534f9bc63079827bf73075243b.exe (PID: 4724)
      • 74df3452a6b9dcdba658af7a9cf5afb09cce51534f9bc63079827bf73075243b.exe (PID: 7084)

    • Reads security settings of Internet Explorer

      • 74df3452a6b9dcdba658af7a9cf5afb09cce51534f9bc63079827bf73075243b.exe (PID: 4724)

    • Modifies existing scheduled task

      • schtasks.exe (PID: 7940)
      • schtasks.exe (PID: 300)
      • schtasks.exe (PID: 8036)
      • schtasks.exe (PID: 7296)

    • Creates file in the systems drive root

      • 74df3452a6b9dcdba658af7a9cf5afb09cce51534f9bc63079827bf73075243b.exe (PID: 4724)

    • Checks for external IP

      • svchost.exe (PID: 2196)

    • Uses WEVTUTIL.EXE to cleanup log

      • cmd.exe (PID: 7448)
      • cmd.exe (PID: 6148)
      • cmd.exe (PID: 5176)
      • cmd.exe (PID: 7716)
      • cmd.exe (PID: 7748)
      • cmd.exe (PID: 7664)
      • cmd.exe (PID: 5508)
      • cmd.exe (PID: 1228)
      • cmd.exe (PID: 8104)
      • cmd.exe (PID: 2800)

    • Uses pipe srvsvc via SMB (transferring data)

      • 74df3452a6b9dcdba658af7a9cf5afb09cce51534f9bc63079827bf73075243b.exe (PID: 4724)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 7368)
      • cmd.exe (PID: 2560)

    • Hides command output

      • cmd.exe (PID: 7368)
      • cmd.exe (PID: 2560)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 5216)
      • cmd.exe (PID: 8164)

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 4844)
      • schtasks.exe (PID: 1912)

  • INFO

    • Creates files in the program directory

      • 74df3452a6b9dcdba658af7a9cf5afb09cce51534f9bc63079827bf73075243b.exe (PID: 4724)

    • Reads the computer name

      • 74df3452a6b9dcdba658af7a9cf5afb09cce51534f9bc63079827bf73075243b.exe (PID: 4724)
      • 74df3452a6b9dcdba658af7a9cf5afb09cce51534f9bc63079827bf73075243b.exe (PID: 7084)

    • Manual execution by a user

      • 74df3452a6b9dcdba658af7a9cf5afb09cce51534f9bc63079827bf73075243b.exe (PID: 4724)
      • 74df3452a6b9dcdba658af7a9cf5afb09cce51534f9bc63079827bf73075243b.exe (PID: 7084)
      • notepad.exe (PID: 1760)
      • OpenWith.exe (PID: 3192)
      • mshta.exe (PID: 7312)
      • OpenWith.exe (PID: 6824)
      • rundll32.exe (PID: 7364)
      • rundll32.exe (PID: 7508)
      • rundll32.exe (PID: 5756)
      • OpenWith.exe (PID: 5408)
      • OpenWith.exe (PID: 7696)
      • rundll32.exe (PID: 8124)
      • rundll32.exe (PID: 5164)
      • rundll32.exe (PID: 5344)
      • OpenWith.exe (PID: 6592)
      • OpenWith.exe (PID: 5984)
      • OpenWith.exe (PID: 7788)

    • Reads the machine GUID from the registry

      • 74df3452a6b9dcdba658af7a9cf5afb09cce51534f9bc63079827bf73075243b.exe (PID: 4724)

    • Checks supported languages

      • 74df3452a6b9dcdba658af7a9cf5afb09cce51534f9bc63079827bf73075243b.exe (PID: 4724)
      • 74df3452a6b9dcdba658af7a9cf5afb09cce51534f9bc63079827bf73075243b.exe (PID: 7084)

    • Process checks computer location settings

      • 74df3452a6b9dcdba658af7a9cf5afb09cce51534f9bc63079827bf73075243b.exe (PID: 4724)

    • Auto-launch of the file from Task Scheduler

      • cmd.exe (PID: 7144)
      • cmd.exe (PID: 5404)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 1760)

    • Reads Microsoft Office registry keys

      • OpenWith.exe (PID: 3192)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 7312)

    • Application launched itself

      • AcroCEF.exe (PID: 7716)
      • Acrobat.exe (PID: 7840)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0003
ZipCompression: Unknown (99)
ZipModifyDate: 2024:01:09 22:10:30
ZipCRC: 0x884b4800
ZipCompressedSize: 251557
ZipUncompressedSize: 723968
ZipFileName: 74df3452a6b9dcdba658af7a9cf5afb09cce51534f9bc63079827bf73075243b.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
517
Monitored processes
386
Malicious processes
14
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs THREAT 74df3452a6b9dcdba658af7a9cf5afb09cce51534f9bc63079827bf73075243b.exe conhost.exe no specs svchost.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs vssadmin.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs vssadmin.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs vssadmin.exe no specs schtasks.exe no specs bcdedit.exe no specs bcdedit.exe no specs fsutil.exe no specs wbadmin.exe no specs # BLACKHUNT 74df3452a6b9dcdba658af7a9cf5afb09cce51534f9bc63079827bf73075243b.exe conhost.exe no specs notepad.exe no specs openwith.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs fsutil.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs wevtutil.exe no specs cmd.exe no specs wevtutil.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs wevtutil.exe no specs cmd.exe no specs wevtutil.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs wevtutil.exe no specs cmd.exe no specs vssadmin.exe no specs conhost.exe no specs bcdedit.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs fsutil.exe no specs conhost.exe no specs wbadmin.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs bcdedit.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs schtasks.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs notepad.exe no specs conhost.exe no specs taskkill.exe no specs ping.exe no specs mshta.exe no specs rundll32.exe no specs rundll32.exe no specs openwith.exe no specs openwith.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs openwith.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs schtasks.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs vssadmin.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs vssadmin.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs bcdedit.exe no specs fsutil.exe no specs conhost.exe no specs vssadmin.exe no specs bcdedit.exe no specs wbadmin.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs fsutil.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs wevtutil.exe no specs cmd.exe no specs conhost.exe no specs wevtutil.exe no specs cmd.exe no specs conhost.exe no specs wevtutil.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs wevtutil.exe no specs conhost.exe no specs cmd.exe no specs wevtutil.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs vssadmin.exe no specs cmd.exe no specs conhost.exe no specs bcdedit.exe no specs cmd.exe no specs bcdedit.exe no specs conhost.exe no specs fsutil.exe no specs cmd.exe no specs conhost.exe no specs wbadmin.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs schtasks.exe no specs conhost.exe no specs cmd.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs taskkill.exe no specs slui.exe notepad.exe no specs reg.exe no specs ping.exe no specs mshta.exe no specs acrobat.exe no specs acrobat.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
300schtasks.exe /Change /TN "\Microsoft\Windows\SystemRestore\SR" /disableC:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
300"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "StartMenuLogOff" /t REG_DWORD /d 1 /fC:\Windows\System32\cmd.exe—74df3452a6b9dcdba658af7a9cf5afb09cce51534f9bc63079827bf73075243b.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
300bcdedit /set {default} bootstatuspolicy IgnoreAllFailuresC:\Windows\System32\bcdedit.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Boot Configuration Data Editor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\bcdedit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cryptsp.dll
456"C:\Windows\System32\cmd.exe" /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /fC:\Windows\System32\cmd.exe—74df3452a6b9dcdba658af7a9cf5afb09cce51534f9bc63079827bf73075243b.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
456\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
632\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
660wevtutil.exe cl SetupC:\Windows\System32\wevtutil.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Eventing Command Line Utility
Exit code:
5
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wevtutil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\combase.dll
c:\windows\system32\sechost.dll
664REG ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "legalnoticecaption" /t REG_SZ /d "WARNING WARNING WARNING. " /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
672reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" /v "{2C5F9FCC-F266-43F6-BFD7-838DAE269E11}" /t REG_SZ /d "C:\ProgramData\#BlackHunt_ReadMe.hta" /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
728\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
35 610
Read events
35 489
Write events
115
Delete events
6

Modification events

(PID) Process:(6184) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6184) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6184) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6184) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\6639c5e42418fa8caf0dee6d4516984842cda2bfa9070139ebae691fbf1969f0.zip
(PID) Process:(6184) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6184) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6184) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6184) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4724) 74df3452a6b9dcdba658af7a9cf5afb09cce51534f9bc63079827bf73075243b.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:GlobalAssocChangedCounter
Value:
114
(PID) Process:(7312) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
0
Suspicious files
393
Text files
148
Unknown types
0

Dropped files

PID
Process
Filename
Type
472474df3452a6b9dcdba658af7a9cf5afb09cce51534f9bc63079827bf73075243b.exeC:\ProgramData\#BlackHunt_Public.keybinary
MD5:38905150F60FED8B301FC43198808588
SHA256:5AF4290C674E074D3A78DB70AB287908CF5CEAC250ADFDD6627110B63F4F2A13
472474df3452a6b9dcdba658af7a9cf5afb09cce51534f9bc63079827bf73075243b.exeC:\ProgramData\#BlackHunt_Private.keybinary
MD5:11C79A6C82A8D5E34B91DBFD88383040
SHA256:A160D3AE09E2DEAB661DCA0AFA2414E5C9C2A465C8C2CCD9E640FB2A3420041F
472474df3452a6b9dcdba658af7a9cf5afb09cce51534f9bc63079827bf73075243b.exeC:\ProgramData\#BlackHunt_ID.txtbinary
MD5:9CAF6220878AF71A5CCE9F631EB86458
SHA256:89D83CE7E56DF71BC01A98C13BC59325C808096182A3876828745AE20D27A20F
472474df3452a6b9dcdba658af7a9cf5afb09cce51534f9bc63079827bf73075243b.exeC:\ProgramData\Adobe\ARM\Acrobat_23.001.20093\#BlackHunt_ReadMe.txttext
MD5:CCB09D3FCAFED0A207059BC01ECE8ED4
SHA256:68025975A8D998909EE7811425B0894608A9BE2B783C6D3E26264F47F473AE57
472474df3452a6b9dcdba658af7a9cf5afb09cce51534f9bc63079827bf73075243b.exeC:\ProgramData\Adobe\ARM\S\#BlackHunt_Private.keybinary
MD5:11C79A6C82A8D5E34B91DBFD88383040
SHA256:A160D3AE09E2DEAB661DCA0AFA2414E5C9C2A465C8C2CCD9E640FB2A3420041F
472474df3452a6b9dcdba658af7a9cf5afb09cce51534f9bc63079827bf73075243b.exeC:\ProgramData\Adobe\ARM\#BlackHunt_ReadMe.htahtml
MD5:9AC575170360CF517BA689BBD7FE03C6
SHA256:32F04BA31E9FBD709F8AABD109E37A9C22A87C50FD2C6CE95F7A777F8E6CA6E6
472474df3452a6b9dcdba658af7a9cf5afb09cce51534f9bc63079827bf73075243b.exeC:\ProgramData\Adobe\ARM\Acrobat_23.001.20093\#BlackHunt_Private.keybinary
MD5:11C79A6C82A8D5E34B91DBFD88383040
SHA256:A160D3AE09E2DEAB661DCA0AFA2414E5C9C2A465C8C2CCD9E640FB2A3420041F
472474df3452a6b9dcdba658af7a9cf5afb09cce51534f9bc63079827bf73075243b.exeC:\ProgramData\Adobe\ARM\Acrobat_23.001.20093\#BlackHunt_ReadMe.htahtml
MD5:9AC575170360CF517BA689BBD7FE03C6
SHA256:32F04BA31E9FBD709F8AABD109E37A9C22A87C50FD2C6CE95F7A777F8E6CA6E6
472474df3452a6b9dcdba658af7a9cf5afb09cce51534f9bc63079827bf73075243b.exeC:\ProgramData\Adobe\ARM\S\#BlackHunt_ReadMe.htahtml
MD5:9AC575170360CF517BA689BBD7FE03C6
SHA256:32F04BA31E9FBD709F8AABD109E37A9C22A87C50FD2C6CE95F7A777F8E6CA6E6
472474df3452a6b9dcdba658af7a9cf5afb09cce51534f9bc63079827bf73075243b.exeC:\ProgramData\Adobe\#BlackHunt_ReadMe.txttext
MD5:CCB09D3FCAFED0A207059BC01ECE8ED4
SHA256:68025975A8D998909EE7811425B0894608A9BE2B783C6D3E26264F47F473AE57
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
28
DNS requests
12
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4724
74df3452a6b9dcdba658af7a9cf5afb09cce51534f9bc63079827bf73075243b.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2196
svchost.exe
224.0.0.251:5353
—
—
—
unknown
2196
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
whitelisted
google.com
  • 172.217.18.14
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
geo2.adobe.com
  • 95.100.184.205
whitelisted
p13n.adobe.io
  • 107.22.247.231
  • 54.144.73.197
  • 34.193.227.236
  • 18.207.85.246
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
6639c5e42418fa8caf0dee6d4516984842cda2bfa9070139ebae691fbf1969f0