File name:

lockscreen_17faeed322d4c981fdac273c2a305f2e30270b55.7z

Full analysis: https://app.any.run/tasks/a85618fd-550c-41d2-8ed3-40a285ccd864
Verdict: Malicious activity
Analysis date: May 15, 2025, 19:15:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
arch-exec
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

DE299B0F8EFE614C9A41A1A696285DC3

SHA1:

0FB18A54DE4687AB0A17951A59E037DEEB43A2A5

SHA256:

73917032CF0CC39A0E3B1136A0C36285E6E433244D59E405B9EDE484F03F78F5

SSDEEP:

3072:COuRkm3CuAeaqM8YjMiddiFpDpZVboINZgC:j7z5qlYIiEpNZFLF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • lockscreen_17faeed322d4c981fdac273c2a305f2e30270b55.exe (PID: 1028)

  • SUSPICIOUS

    • Application launched itself

      • lockscreen_17faeed322d4c981fdac273c2a305f2e30270b55.exe (PID: 2536)
      • loadhst.exe (PID: 1268)

    • Executable content was dropped or overwritten

      • lockscreen_17faeed322d4c981fdac273c2a305f2e30270b55.exe (PID: 1028)

    • Reads security settings of Internet Explorer

      • loadhst.exe (PID: 1560)
      • lockscreen_17faeed322d4c981fdac273c2a305f2e30270b55.exe (PID: 1028)

    • Reads the Internet Settings

      • lockscreen_17faeed322d4c981fdac273c2a305f2e30270b55.exe (PID: 1028)
      • loadhst.exe (PID: 1560)

    • Starts CMD.EXE for commands execution

      • lockscreen_17faeed322d4c981fdac273c2a305f2e30270b55.exe (PID: 1028)

    • Executing commands from a ".bat" file

      • lockscreen_17faeed322d4c981fdac273c2a305f2e30270b55.exe (PID: 1028)

    • Starts itself from another location

      • lockscreen_17faeed322d4c981fdac273c2a305f2e30270b55.exe (PID: 1028)

    • There is functionality for taking screenshot (YARA)

      • loadhst.exe (PID: 1560)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2060)

    • Manual execution by a user

      • lockscreen_17faeed322d4c981fdac273c2a305f2e30270b55.exe (PID: 2536)

    • Checks supported languages

      • lockscreen_17faeed322d4c981fdac273c2a305f2e30270b55.exe (PID: 2536)
      • lockscreen_17faeed322d4c981fdac273c2a305f2e30270b55.exe (PID: 1028)
      • loadhst.exe (PID: 1268)
      • loadhst.exe (PID: 1560)

    • Creates files or folders in the user directory

      • lockscreen_17faeed322d4c981fdac273c2a305f2e30270b55.exe (PID: 1028)

    • Reads the computer name

      • lockscreen_17faeed322d4c981fdac273c2a305f2e30270b55.exe (PID: 1028)
      • loadhst.exe (PID: 1560)

    • Checks proxy server information

      • loadhst.exe (PID: 1560)

    • Reads the machine GUID from the registry

      • loadhst.exe (PID: 1560)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
ModifyDate: 2012:01:09 17:01:44+00:00
ArchivedFileName: lockscreen_17faeed322d4c981fdac273c2a305f2e30270b55.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
6
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe lockscreen_17faeed322d4c981fdac273c2a305f2e30270b55.exe lockscreen_17faeed322d4c981fdac273c2a305f2e30270b55.exe cmd.exe no specs loadhst.exe no specs loadhst.exe

Process information

PID
CMD
Path
Indicators
Parent process
1028C:\Users\admin\Desktop\lockscreen_17faeed322d4c981fdac273c2a305f2e30270b55.exeC:\Users\admin\Desktop\lockscreen_17faeed322d4c981fdac273c2a305f2e30270b55.exe
lockscreen_17faeed322d4c981fdac273c2a305f2e30270b55.exe
User:
admin
Company:
Xiph.Org
Integrity Level:
HIGH
Description:
Directshow Filters for Ogg Vorbis, Speex, Theora, FLAC, and WebM
Exit code:
0
Version:
0.85.17777
Modules
Images
c:\users\admin\desktop\lockscreen_17faeed322d4c981fdac273c2a305f2e30270b55.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
1268"C:\Users\admin\AppData\Roaming\Microsoft\loadhst.exe" C:\Users\admin\AppData\Roaming\Microsoft\loadhst.exe—lockscreen_17faeed322d4c981fdac273c2a305f2e30270b55.exe
User:
admin
Company:
Xiph.Org
Integrity Level:
HIGH
Description:
Directshow Filters for Ogg Vorbis, Speex, Theora, FLAC, and WebM
Exit code:
0
Version:
0.85.17777
Modules
Images
c:\users\admin\appdata\roaming\microsoft\loadhst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
1560C:\Users\admin\AppData\Roaming\Microsoft\loadhst.exeC:\Users\admin\AppData\Roaming\Microsoft\loadhst.exe
loadhst.exe
User:
admin
Company:
Xiph.Org
Integrity Level:
HIGH
Description:
Directshow Filters for Ogg Vorbis, Speex, Theora, FLAC, and WebM
Version:
0.85.17777
Modules
Images
c:\users\admin\appdata\roaming\microsoft\loadhst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
2060"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\lockscreen_17faeed322d4c981fdac273c2a305f2e30270b55.7zC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2536"C:\Users\admin\Desktop\lockscreen_17faeed322d4c981fdac273c2a305f2e30270b55.exe" C:\Users\admin\Desktop\lockscreen_17faeed322d4c981fdac273c2a305f2e30270b55.exe
explorer.exe
User:
admin
Company:
Xiph.Org
Integrity Level:
HIGH
Description:
Directshow Filters for Ogg Vorbis, Speex, Theora, FLAC, and WebM
Exit code:
0
Version:
0.85.17777
Modules
Images
c:\users\admin\desktop\lockscreen_17faeed322d4c981fdac273c2a305f2e30270b55.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
2732C:\Windows\system32\cmd.exe /c ""C:\Users\admin\Desktop\clean.bat" "C:\Windows\System32\cmd.exe—lockscreen_17faeed322d4c981fdac273c2a305f2e30270b55.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
4 352
Read events
4 294
Write events
52
Delete events
6

Modification events

(PID) Process:(2060) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\lockscreen_17faeed322d4c981fdac273c2a305f2e30270b55.7z
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2060) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
Executable files
2
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
1028lockscreen_17faeed322d4c981fdac273c2a305f2e30270b55.exeC:\Users\admin\Desktop\clean.battext
MD5:CD5BFF0509918DE5E0DC16B5F0A8DAD4
SHA256:31C9DA49C9F232904A94AEB6484AE52839FD712A44C5B4D683E87E8BD910CBE0
1028lockscreen_17faeed322d4c981fdac273c2a305f2e30270b55.exeC:\Users\admin\AppData\Roaming\Microsoft\loadhst.exeexecutable
MD5:799259ADEA7A5B664DE93085A1BEE22A
SHA256:1063812E04C84BB1269CB6BF01F012CC689A1E364E46BB4502447B40017F2E29
2060WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2060.37167\lockscreen_17faeed322d4c981fdac273c2a305f2e30270b55.exeexecutable
MD5:799259ADEA7A5B664DE93085A1BEE22A
SHA256:1063812E04C84BB1269CB6BF01F012CC689A1E364E46BB4502447B40017F2E29
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
9
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1560
loadhst.exe
POST
404
49.13.77.253:80
http://ahtungarter.jino.ru/index.php
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1560
loadhst.exe
49.13.77.253:80
ahtungarter.jino.ru
Hetzner Online GmbH
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.110
whitelisted
ahtungarter.jino.ru
  • 49.13.77.253
whitelisted
ahtungarter22.ru
  • 49.13.77.253
unknown
ahtungarter33.ru
  • 49.13.77.253
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
lockscreen_17faeed322d4c981fdac273c2a305f2e30270b55.7z