File name:

HEUR-Trojan-Ransom.MSIL.Agent.gen-7431f66d89ea92fb18a3fb489b71417672d15e6140e66062912c38138b2a8c55.7z

Full analysis: https://app.any.run/tasks/390809e2-58d2-4e96-9741-05cf28cd3502
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: March 22, 2025, 00:34:44
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
ransomware
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

AE68179B17FE0D4667963E29887DD68A

SHA1:

C534E32C8096ECACB4BBC11EAE5C1A6D3D0D98E8

SHA256:

872628BE3AEB21F9BFB5984DFFFCD43DE4351D8283279BEF8E4AD25C87AF46EB

SSDEEP:

1536:Fq4xQuKjHiY3QGYcJETdWgg0zohEI9TkLQ:4o9Igg0zo+vQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Renames files like ransomware

      • svchost.exe (PID: 4300)

    • RANSOMWARE has been detected

      • svchost.exe (PID: 4300)

    • Deletes shadow copies

      • cmd.exe (PID: 7756)
      • cmd.exe (PID: 7616)

    • Create files in the Startup directory

      • svchost.exe (PID: 4300)

    • Using BCDEDIT.EXE to modify recovery options

      • cmd.exe (PID: 5936)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • HEUR-Trojan-Ransom.MSIL.Agent.gen-7431f66d89ea92fb18a3fb489b71417672d15e6140e66062912c38138b2a8c55.exe (PID: 6516)
      • TEST1.exe (PID: 2960)

    • The process creates files with name similar to system file names

      • TEST1.exe (PID: 2960)

    • Reads the date of Windows installation

      • TEST1.exe (PID: 2960)
      • svchost.exe (PID: 4300)

    • Reads security settings of Internet Explorer

      • TEST1.exe (PID: 2960)
      • svchost.exe (PID: 4300)

    • Starts itself from another location

      • TEST1.exe (PID: 2960)

    • Write to the desktop.ini file (may be used to cloak folders)

      • svchost.exe (PID: 4300)

    • Executes as Windows Service

      • VSSVC.exe (PID: 5960)
      • vds.exe (PID: 2420)
      • wbengine.exe (PID: 7484)

    • Starts CMD.EXE for commands execution

      • svchost.exe (PID: 4300)

    • Start notepad (likely ransomware note)

      • svchost.exe (PID: 4300)

  • INFO

    • Reads the computer name

      • HEUR-Trojan-Ransom.MSIL.Agent.gen-7431f66d89ea92fb18a3fb489b71417672d15e6140e66062912c38138b2a8c55.exe (PID: 6516)
      • TEST1.exe (PID: 2960)
      • svchost.exe (PID: 4300)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7296)

    • Manual execution by a user

      • HEUR-Trojan-Ransom.MSIL.Agent.gen-7431f66d89ea92fb18a3fb489b71417672d15e6140e66062912c38138b2a8c55.exe (PID: 6516)
      • TEST1.exe (PID: 2960)
      • notepad.exe (PID: 7740)

    • Checks supported languages

      • HEUR-Trojan-Ransom.MSIL.Agent.gen-7431f66d89ea92fb18a3fb489b71417672d15e6140e66062912c38138b2a8c55.exe (PID: 6516)
      • TEST1.exe (PID: 2960)
      • svchost.exe (PID: 4300)

    • Creates files or folders in the user directory

      • TEST1.exe (PID: 2960)
      • svchost.exe (PID: 4300)

    • Process checks computer location settings

      • TEST1.exe (PID: 2960)
      • svchost.exe (PID: 4300)

    • Reads the machine GUID from the registry

      • svchost.exe (PID: 4300)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 8048)
      • notepad.exe (PID: 7740)
      • notepad.exe (PID: 7440)

    • Autorun file from Startup directory

      • svchost.exe (PID: 4300)

    • Reads Microsoft Office registry keys

      • svchost.exe (PID: 4300)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
ModifyDate: 2021:07:16 12:09:50+00:00
ArchivedFileName: HEUR-Trojan-Ransom.MSIL.Agent.gen-7431f66d89ea92fb18a3fb489b71417672d15e6140e66062912c38138b2a8c55.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
161
Monitored processes
23
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe no specs heur-trojan-ransom.msil.agent.gen-7431f66d89ea92fb18a3fb489b71417672d15e6140e66062912c38138b2a8c55.exe test1.exe THREAT svchost.exe cmd.exe no specs conhost.exe no specs vssadmin.exe no specs vssvc.exe no specs wmic.exe no specs notepad.exe no specs cmd.exe no specs conhost.exe no specs bcdedit.exe no specs bcdedit.exe no specs cmd.exe no specs conhost.exe no specs wbadmin.exe no specs wbengine.exe no specs vdsldr.exe no specs vds.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2420C:\WINDOWS\System32\vds.exeC:\Windows\System32\vds.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Virtual Disk Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vds.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2960"C:\Users\admin\Desktop\TEST1.exe" C:\Users\admin\Desktop\TEST1.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
1
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\test1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
4300"C:\Users\admin\AppData\Roaming\svchost.exe" C:\Users\admin\AppData\Roaming\svchost.exe
TEST1.exe
User:
admin
Integrity Level:
HIGH
Description:
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
5936"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled noC:\Windows\System32\cmd.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
5956vssadmin delete shadows /all /quiet C:\Windows\System32\vssadmin.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5960C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6516"C:\Users\admin\Desktop\HEUR-Trojan-Ransom.MSIL.Agent.gen-7431f66d89ea92fb18a3fb489b71417672d15e6140e66062912c38138b2a8c55.exe" C:\Users\admin\Desktop\HEUR-Trojan-Ransom.MSIL.Agent.gen-7431f66d89ea92fb18a3fb489b71417672d15e6140e66062912c38138b2a8c55.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\heur-trojan-ransom.msil.agent.gen-7431f66d89ea92fb18a3fb489b71417672d15e6140e66062912c38138b2a8c55.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7208wbadmin delete catalog -quietC:\Windows\System32\wbadmin.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Command Line Interface for Microsoft® BLB Backup
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
7296"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\HEUR-Trojan-Ransom.MSIL.Agent.gen-7431f66d89ea92fb18a3fb489b71417672d15e6140e66062912c38138b2a8c55.7zC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7300bcdedit /set {default} recoveryenabled noC:\Windows\System32\bcdedit.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Boot Configuration Data Editor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\bcdedit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cryptsp.dll
Total events
4 484
Read events
4 430
Write events
36
Delete events
18

Modification events

(PID) Process:(7296) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7296) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7296) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7296) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\HEUR-Trojan-Ransom.MSIL.Agent.gen-7431f66d89ea92fb18a3fb489b71417672d15e6140e66062912c38138b2a8c55.7z
(PID) Process:(7296) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7296) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7296) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7296) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7296) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(7296) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
Executable files
3
Suspicious files
1
Text files
109
Unknown types
0

Dropped files

PID
Process
Filename
Type
4300svchost.exeC:\Users\admin\Desktop\desktop.ini.k3a0text
MD5:9DB415A7E70C4D2B9FB698E5CC81E42C
SHA256:ECF2CF4C74AB05533958A8CD4A59504755AE93F55E271E89833EC3251CB7A034
7296WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb7296.303\HEUR-Trojan-Ransom.MSIL.Agent.gen-7431f66d89ea92fb18a3fb489b71417672d15e6140e66062912c38138b2a8c55.exeexecutable
MD5:B88619C2EFB4942746534CF388821AD1
SHA256:7431F66D89EA92FB18A3FB489B71417672D15E6140E66062912C38138B2A8C55
4300svchost.exeC:\Users\admin\Desktop\backand.png.a9fqtext
MD5:5E26B86DC2F9CA7D1E6D807208D1655D
SHA256:0D285604B814C97D207CB54A47E246354C35B978EC35D391CE696E401DFA1499
6516HEUR-Trojan-Ransom.MSIL.Agent.gen-7431f66d89ea92fb18a3fb489b71417672d15e6140e66062912c38138b2a8c55.exeC:\Users\admin\Desktop\TEST1.exeexecutable
MD5:7AFC1FC3C6AE1E29F3CEF98331E2ADE8
SHA256:F18F189A64664F6E64151C2D7C356F4A67372BADD904C08E998B0E2E35D88CE4
4300svchost.exeC:\Users\admin\Desktop\anand.jpgtext
MD5:13ADB5577293AA03F6B5C955E72B6EF0
SHA256:78A09A4A86771AF6CEAAD0D573683A80C0860B068317823F41FB51D3549AA6F0
4300svchost.exeC:\Users\admin\Desktop\backand.pngtext
MD5:5E26B86DC2F9CA7D1E6D807208D1655D
SHA256:0D285604B814C97D207CB54A47E246354C35B978EC35D391CE696E401DFA1499
2960TEST1.exeC:\Users\admin\AppData\Roaming\svchost.exeexecutable
MD5:7AFC1FC3C6AE1E29F3CEF98331E2ADE8
SHA256:F18F189A64664F6E64151C2D7C356F4A67372BADD904C08E998B0E2E35D88CE4
4300svchost.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.urlbinary
MD5:83660DEB1A47E0B191FDA82BDFD61827
SHA256:87089BD6FEDDA43B5E4D738B5BF246BA1B2E5C248B9220F0D1E742B827F30B0D
4300svchost.exeC:\Users\admin\Desktop\anand.jpg.9op9text
MD5:13ADB5577293AA03F6B5C955E72B6EF0
SHA256:78A09A4A86771AF6CEAAD0D573683A80C0860B068317823F41FB51D3549AA6F0
4300svchost.exeC:\Users\admin\Desktop\desktop.initext
MD5:9DB415A7E70C4D2B9FB698E5CC81E42C
SHA256:ECF2CF4C74AB05533958A8CD4A59504755AE93F55E271E89833EC3251CB7A034
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
25
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
95.101.54.128:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.54.128:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3020
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3020
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7488
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
95.101.54.128:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
40.126.31.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7488
backgroundTaskHost.exe
20.199.58.43:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7488
backgroundTaskHost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.110
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 95.101.54.128
  • 95.101.54.122
whitelisted
login.live.com
  • 40.126.31.130
  • 40.126.31.3
  • 40.126.31.131
  • 20.190.159.130
  • 40.126.31.129
  • 20.190.159.129
  • 40.126.31.71
  • 20.190.159.68
whitelisted
ocsp.digicert.com
  • 184.30.131.245
  • 2.23.77.188
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
www.microsoft.com
  • 2.23.181.156
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
HEUR-Trojan-Ransom.MSIL.Agent.gen-7431f66d89ea92fb18a3fb489b71417672d15e6140e66062912c38138b2a8c55.7z