File name:

Trojan-Ransom.Win32.Agent.aumz-01fa1ed69196ed40a66dbf458eaa6bdf983263175101c505eae366b85727e26e.7z

Full analysis: https://app.any.run/tasks/9c2cc3e3-655c-44eb-a683-92fe17ddb1cf
Verdict: Malicious activity
Analysis date: May 10, 2025, 13:54:32
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
evasion
arch-exec
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

F027BD0A7DA9364A8B8FE06D8A9BE03D

SHA1:

4F6583B77614B81C56C55F24EF0AABFA9D95CF32

SHA256:

7647E348775C00796D64663FF9180D790A6DABAAC4A91C33E3D4E4E9D6EC1186

SSDEEP:

1536:ZUjX57YrQZe1UyDkethEYqkrK6HJMdL+lq:85srQZ/yD9EYqk2Jdaq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • Trojan-Ransom.Win32.Agent.aumz-01fa1ed69196ed40a66dbf458eaa6bdf983263175101c505eae366b85727e26e.exe (PID: 7776)

  • SUSPICIOUS

    • Checks for external IP

      • Trojan-Ransom.Win32.Agent.aumz-01fa1ed69196ed40a66dbf458eaa6bdf983263175101c505eae366b85727e26e.exe (PID: 7776)

  • INFO

    • Disables trace logs

      • Trojan-Ransom.Win32.Agent.aumz-01fa1ed69196ed40a66dbf458eaa6bdf983263175101c505eae366b85727e26e.exe (PID: 7776)

    • Reads the computer name

      • Trojan-Ransom.Win32.Agent.aumz-01fa1ed69196ed40a66dbf458eaa6bdf983263175101c505eae366b85727e26e.exe (PID: 7776)

    • Creates files in the program directory

      • Trojan-Ransom.Win32.Agent.aumz-01fa1ed69196ed40a66dbf458eaa6bdf983263175101c505eae366b85727e26e.exe (PID: 7776)

    • Reads the software policy settings

      • Trojan-Ransom.Win32.Agent.aumz-01fa1ed69196ed40a66dbf458eaa6bdf983263175101c505eae366b85727e26e.exe (PID: 7776)
      • slui.exe (PID: 7288)
      • slui.exe (PID: 4988)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5304)

    • Checks proxy server information

      • Trojan-Ransom.Win32.Agent.aumz-01fa1ed69196ed40a66dbf458eaa6bdf983263175101c505eae366b85727e26e.exe (PID: 7776)
      • slui.exe (PID: 4988)

    • Manual execution by a user

      • Trojan-Ransom.Win32.Agent.aumz-01fa1ed69196ed40a66dbf458eaa6bdf983263175101c505eae366b85727e26e.exe (PID: 7776)

    • Checks supported languages

      • Trojan-Ransom.Win32.Agent.aumz-01fa1ed69196ed40a66dbf458eaa6bdf983263175101c505eae366b85727e26e.exe (PID: 7776)

    • Reads the machine GUID from the registry

      • Trojan-Ransom.Win32.Agent.aumz-01fa1ed69196ed40a66dbf458eaa6bdf983263175101c505eae366b85727e26e.exe (PID: 7776)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
ModifyDate: 2021:09:16 12:04:44+00:00
ArchivedFileName: Trojan-Ransom.Win32.Agent.aumz-01fa1ed69196ed40a66dbf458eaa6bdf983263175101c505eae366b85727e26e.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
134
Monitored processes
5
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe trojan-ransom.win32.agent.aumz-01fa1ed69196ed40a66dbf458eaa6bdf983263175101c505eae366b85727e26e.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
4988C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5304"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\Trojan-Ransom.Win32.Agent.aumz-01fa1ed69196ed40a66dbf458eaa6bdf983263175101c505eae366b85727e26e.7zC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7256C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7288"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7776"C:\Users\admin\Desktop\Trojan-Ransom.Win32.Agent.aumz-01fa1ed69196ed40a66dbf458eaa6bdf983263175101c505eae366b85727e26e.exe" C:\Users\admin\Desktop\Trojan-Ransom.Win32.Agent.aumz-01fa1ed69196ed40a66dbf458eaa6bdf983263175101c505eae366b85727e26e.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
PostgreSQL
Version:
9.3.11.16195
Modules
Images
c:\users\admin\desktop\trojan-ransom.win32.agent.aumz-01fa1ed69196ed40a66dbf458eaa6bdf983263175101c505eae366b85727e26e.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
3 006
Read events
2 971
Write events
35
Delete events
0

Modification events

(PID) Process:(5304) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(5304) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(5304) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(5304) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Trojan-Ransom.Win32.Agent.aumz-01fa1ed69196ed40a66dbf458eaa6bdf983263175101c505eae366b85727e26e.7z
(PID) Process:(5304) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5304) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5304) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5304) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5304) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(5304) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
Executable files
1
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
5304WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb5304.9131\Trojan-Ransom.Win32.Agent.aumz-01fa1ed69196ed40a66dbf458eaa6bdf983263175101c505eae366b85727e26e.exeexecutable
MD5:2E5C9DD19B7CF14A98DFC20E4B7B5F4D
SHA256:01FA1ED69196ED40A66DBF458EAA6BDF983263175101C505EAE366B85727E26E
7776Trojan-Ransom.Win32.Agent.aumz-01fa1ed69196ed40a66dbf458eaa6bdf983263175101c505eae366b85727e26e.exeC:\ProgramData\Keyboard\10052025_135453.logtext
MD5:89D18A1904F1D12F05FEB253523CD490
SHA256:037F767E2EAC435DE8A5342A1B3AB5A89BE67D6C964B36FFC23F19FE1C132BD0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
24
DNS requests
18
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.179:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
8136
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8136
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.48.23.179:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
2.16.253.202:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6544
svchost.exe
20.190.160.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
7776
Trojan-Ransom.Win32.Agent.aumz-01fa1ed69196ed40a66dbf458eaa6bdf983263175101c505eae366b85727e26e.exe
104.26.13.205:443
api.ipify.org
CLOUDFLARENET
US
shared

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.48.23.179
  • 23.48.23.169
  • 23.48.23.177
  • 23.48.23.168
  • 23.48.23.170
  • 23.48.23.176
  • 23.48.23.181
  • 23.48.23.174
  • 23.48.23.185
whitelisted
www.microsoft.com
  • 2.16.253.202
whitelisted
google.com
  • 142.250.185.110
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.160.2
  • 40.126.32.133
  • 40.126.32.140
  • 40.126.32.68
  • 20.190.160.65
  • 40.126.32.76
  • 20.190.160.17
  • 20.190.160.5
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
tanie-wino.pila.pl
  • —
unknown
api.ipify.org
  • 104.26.13.205
  • 172.67.74.152
  • 104.26.12.205
shared
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
7776
Trojan-Ransom.Win32.Agent.aumz-01fa1ed69196ed40a66dbf458eaa6bdf983263175101c505eae366b85727e26e.exe
Misc activity
ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Trojan-Ransom.Win32.Agent.aumz-01fa1ed69196ed40a66dbf458eaa6bdf983263175101c505eae366b85727e26e.7z