File name:

cryptolocker.exe

Full analysis: https://app.any.run/tasks/7301e974-ac1a-44c6-84b9-853b4efff406
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: December 05, 2023, 17:04:25
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
cryptolocker
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

0246BB54723BD4A49444AA4CA254845A

SHA1:

151382E82FBCFDF188B347911BD6A34293C14878

SHA256:

8CF50AE247445DE2E570F19705236ED4B1E19F75CA15345E5F00857243BC0E9B

SSDEEP:

6144:m28cv8eNLO1cy4uWj6x5OEbHyL3IKwCQLcwl:m/MLNLO1B5TRbSbI/Cg1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • cryptolocker.exe (PID: 1556)

    • Changes the autorun value in the registry

      • 2C28475F30.exe (PID: 3784)

    • CRYPTOLOCKER has been detected (SURICATA)

      • 2C28475F30.exe (PID: 3784)

  • SUSPICIOUS

    • Reads the Internet Settings

      • cryptolocker.exe (PID: 1556)
      • 2C28475F30.exe (PID: 3784)

    • Starts itself from another location

      • cryptolocker.exe (PID: 1556)

    • Uses TASKKILL.EXE to kill process

      • cryptolocker.exe (PID: 1556)

  • INFO

    • Checks supported languages

      • cryptolocker.exe (PID: 1556)
      • 2C28475F30.exe (PID: 3784)
      • wmpnscfg.exe (PID: 3940)

    • Reads the computer name

      • cryptolocker.exe (PID: 1556)
      • 2C28475F30.exe (PID: 3784)
      • wmpnscfg.exe (PID: 3940)

    • Reads the machine GUID from the registry

      • cryptolocker.exe (PID: 1556)
      • 2C28475F30.exe (PID: 3784)

    • Creates files or folders in the user directory

      • cryptolocker.exe (PID: 1556)

    • Reads Environment values

      • cryptolocker.exe (PID: 1556)
      • 2C28475F30.exe (PID: 3784)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3940)
      • WINWORD.EXE (PID: 2716)
      • explorer.exe (PID: 3420)
      • WINWORD.EXE (PID: 3016)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2014:01:20 11:26:48+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 257536
InitializedDataSize: 3072
UninitializedDataSize: -
EntryPoint: 0x40d8e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription: Microsoft Windows Auto Update
FileVersion: 1.0.0.0
InternalName: Microsoft Windows Auto Update.exe
LegalCopyright: Copyright © 2013
OriginalFileName: Microsoft Windows Auto Update.exe
ProductName: Microsoft Windows Auto Update
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
50
Monitored processes
7
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start cryptolocker.exe no specs #CRYPTOLOCKER 2c28475f30.exe taskkill.exe no specs wmpnscfg.exe no specs winword.exe no specs winword.exe no specs explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1556"C:\Users\admin\AppData\Local\Temp\cryptolocker.exe" C:\Users\admin\AppData\Local\Temp\cryptolocker.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Microsoft Windows Auto Update
Exit code:
1
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\cryptolocker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2084"taskkill" /F /IM cryptolocker.exeC:\Windows\System32\taskkill.exe—cryptolocker.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
2716"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
3016"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\makesalbum.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
3420"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3784"C:\Users\admin\AppData\Roaming\2C28475F30.exe" C:\Users\admin\AppData\Roaming\2C28475F30.exe
cryptolocker.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Microsoft Windows Auto Update
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\2c28475f30.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3940"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
7 000
Read events
6 185
Write events
357
Delete events
458

Modification events

(PID) Process:(1556) cryptolocker.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1556) cryptolocker.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1556) cryptolocker.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1556) cryptolocker.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3784) 2C28475F30.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:2C28475F30
Value:
C:\Users\admin\AppData\Roaming\2C28475F30.exe
(PID) Process:(3784) 2C28475F30.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:*2C28475F30
Value:
C:\Users\admin\AppData\Roaming\2C28475F30.exe
(PID) Process:(2716) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(2716) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
On
(PID) Process:(2716) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
On
(PID) Process:(2716) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
On
Executable files
2
Suspicious files
9
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
2716WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR3F74.tmp.cvr —
MD5:—
SHA256:—
3016WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR88A3.tmp.cvr —
MD5:—
SHA256:—
1556cryptolocker.exeC:\Users\admin\AppData\Roaming\2C28475F30.exeexecutable
MD5:0246BB54723BD4A49444AA4CA254845A
SHA256:8CF50AE247445DE2E570F19705236ED4B1E19F75CA15345E5F00857243BC0E9B
3016WINWORD.EXEC:\Users\admin\Desktop\~$kesalbum.rtfbinary
MD5:FEA1C632465E3735049679F2581F2287
SHA256:1FEF124B29DDF32BF0FF3FD4E878C8F908BD0A3E245254C8F6EA6878AB5DDC67
2716WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{235E978B-5F3F-448B-9AF1-B7266BF0CC28}.tmpbinary
MD5:1BB73BD10F67B1A363D397A71E4D620E
SHA256:5655CF063748A566DC044B7AE444BC9C33262F21984B8FE2B3012A9026AF2227
2716WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{D0B94DFC-527B-43C2-8400-061006E7EBB5}.tmpbinary
MD5:5D4D94EE7E06BBB0AF9584119797B23A
SHA256:4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
3016WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:2DBB2CDAD3C0592FBBF527771BBBEAAF
SHA256:EECE38BBF1F2A339A3D17CC7AE88DCD31C650680F57B53C7697A5CF1C5FE3279
2716WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmbinary
MD5:988B2F5EBF4E8BC52DBD6FDF4F3D254D
SHA256:152175938FB54DA2252157259C83A8C38DB6CBD9D54A5223D363E787A4095A8F
3016WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmbinary
MD5:640B974D86F65DC3BF2E326AC759E235
SHA256:A4019E7629DA631950CAEFD8D1A29F58CC0F62BB16B539D0AA9D1ADB0757A5AD
3016WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{3A17A366-6765-4E1E-BD0B-C8E2C6F39F79}.tmpbinary
MD5:574695AF6EE84505C725F3E9D86E1384
SHA256:E8311A7EBDEEF6D9C949441D4B3D2EB7091A961F45DFEBBD4656F771BC29E706
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
273
TCP/UDP connections
277
DNS requests
8
Threats
278

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3784
2C28475F30.exe
GET
403
194.58.112.165:80
http://yot.su/b7CnevqflWi9JL5a4v/K0N/qf5sO99vKEdkG+GPyEy92cP5F60d0px4Ziw9JuFlETnXUFcvsoIO5Pl44X+WOJI7Oh8un0MdsOeLICSdUA5se3JogJjm6UIe8qbxtiCPxbdYeLuYPmoZfRH9UvHWXICcCK+mqtpciA2wKDXYH9TDgels81ZNHHt7JipE1Rg04V/qrmOtm0KfKd4vAmxm0b6JcbL1PC5G3gU4cDscAYmpPKANiXhONxVFEwS09XW2xjQ58HqNty7z+YnKMwJAk52cV/oFYtudnOA8H6G2HbX8vQW17OOiaj+jzcLNAjHrlJKZsrMMMVfERbkJJ8PSv+w==
unknown
—
—
unknown
3784
2C28475F30.exe
GET
403
194.58.112.165:80
http://yot.su/b7CnevqflWi9JL5a4v/K0N/qf5sO99vKEdkG+GPyEy92cP5F60d0px4Ziw9JuFlETnXUFcvsoIO5Pl44X+WOJI7Oh8un0MdsOeLICSdUA5se3JogJjm6UIe8qbxtiCPxbdYeLuYPmoZfRH9UvHWXICcCK+mqtpciA2wKDXYH9TDgels81ZNHHt7JipE1Rg04V/qrmOtm0KfKd4vAmxm0b6JcbL1PC5G3gU4cDscAYmpPKANiXhONxVFEwS09XW2xjQ58HqNty7z+YnKMwJAk52cV/oFYtudnOA8H6G2HbX8vQW17OOiaj+jzcLNAjHrlJKZsrMMMVfERbkJJ8PSv+w==
unknown
—
—
unknown
3784
2C28475F30.exe
GET
403
194.58.112.165:80
http://yot.su/b7CnevqflWi9JL5a4v/K0N/qf5sO99vKEdkG+GPyEy92cP5F60d0px4Ziw9JuFlETnXUFcvsoIO5Pl44X+WOJI7Oh8un0MdsOeLICSdUA5se3JogJjm6UIe8qbxtiCPxbdYeLuYPmoZfRH9UvHWXICcCK+mqtpciA2wKDXYH9TDgels81ZNHHt7JipE1Rg04V/qrmOtm0KfKd4vAmxm0b6JcbL1PC5G3gU4cDscAYmpPKANiXhONxVFEwS09XW2xjQ58HqNty7z+YnKMwJAk52cV/oFYtudnOA8H6G2HbX8vQW17OOiaj+jzcLNAjHrlJKZsrMMMVfERbkJJ8PSv+w==
unknown
—
—
unknown
3784
2C28475F30.exe
GET
403
194.58.112.165:80
http://yot.su/b7CnevqflWi9JL5a4v/K0N/qf5sO99vKEdkG+GPyEy92cP5F60d0px4Ziw9JuFlETnXUFcvsoIO5Pl44X+WOJI7Oh8un0MdsOeLICSdUA5se3JogJjm6UIe8qbxtiCPxbdYeLuYPmoZfRH9UvHWXICcCK+mqtpciA2wKDXYH9TDgels81ZNHHt7JipE1Rg04V/qrmOtm0KfKd4vAmxm0b6JcbL1PC5G3gU4cDscAYmpPKANiXhONxVFEwS09XW2xjQ58HqNty7z+YnKMwJAk52cV/oFYtudnOA8H6G2HbX8vQW17OOiaj+jzcLNAjHrlJKZsrMMMVfERbkJJ8PSv+w==
unknown
—
—
unknown
3784
2C28475F30.exe
GET
503
194.58.112.165:80
http://yot.su/b7CnevqflWi9JL5a4v/K0N/qf5sO99vKEdkG+GPyEy92cP5F60d0px4Ziw9JuFlETnXUFcvsoIO5Pl44X+WOJI7Oh8un0MdsOeLICSdUA5se3JogJjm6UIe8qbxtiCPxbdYeLuYPmoZfRH9UvHWXICcCK+mqtpciA2wKDXYH9TDgels81ZNHHt7JipE1Rg04V/qrmOtm0KfKd4vAmxm0b6JcbL1PC5G3gU4cDscAYmpPKANiXhONxVFEwS09XW2xjQ58HqNty7z+YnKMwJAk52cV/oFYtudnOA8H6G2HbX8vQW17OOiaj+jzcLNAjHrlJKZsrMMMVfERbkJJ8PSv+w==
unknown
html
206 b
unknown
3784
2C28475F30.exe
GET
403
194.58.112.165:80
http://yot.su/b7CnevqflWi9JL5a4v/K0N/qf5sO99vKEdkG+GPyEy92cP5F60d0px4Ziw9JuFlETnXUFcvsoIO5Pl44X+WOJI7Oh8un0MdsOeLICSdUA5se3JogJjm6UIe8qbxtiCPxbdYeLuYPmoZfRH9UvHWXICcCK+mqtpciA2wKDXYH9TDgels81ZNHHt7JipE1Rg04V/qrmOtm0KfKd4vAmxm0b6JcbL1PC5G3gU4cDscAYmpPKANiXhONxVFEwS09XW2xjQ58HqNty7z+YnKMwJAk52cV/oFYtudnOA8H6G2HbX8vQW17OOiaj+jzcLNAjHrlJKZsrMMMVfERbkJJ8PSv+w==
unknown
—
—
unknown
3784
2C28475F30.exe
GET
403
194.58.112.165:80
http://yot.su/b7CnevqflWi9JL5a4v/K0N/qf5sO99vKEdkG+GPyEy92cP5F60d0px4Ziw9JuFlETnXUFcvsoIO5Pl44X+WOJI7Oh8un0MdsOeLICSdUA5se3JogJjm6UIe8qbxtiCPxbdYeLuYPmoZfRH9UvHWXICcCK+mqtpciA2wKDXYH9TDgels81ZNHHt7JipE1Rg04V/qrmOtm0KfKd4vAmxm0b6JcbL1PC5G3gU4cDscAYmpPKANiXhONxVFEwS09XW2xjQ58HqNty7z+YnKMwJAk52cV/oFYtudnOA8H6G2HbX8vQW17OOiaj+jzcLNAjHrlJKZsrMMMVfERbkJJ8PSv+w==
unknown
—
—
unknown
3784
2C28475F30.exe
GET
403
194.58.112.165:80
http://yot.su/b7CnevqflWi9JL5a4v/K0N/qf5sO99vKEdkG+GPyEy92cP5F60d0px4Ziw9JuFlETnXUFcvsoIO5Pl44X+WOJI7Oh8un0MdsOeLICSdUA5se3JogJjm6UIe8qbxtiCPxbdYeLuYPmoZfRH9UvHWXICcCK+mqtpciA2wKDXYH9TDgels81ZNHHt7JipE1Rg04V/qrmOtm0KfKd4vAmxm0b6JcbL1PC5G3gU4cDscAYmpPKANiXhONxVFEwS09XW2xjQ58HqNty7z+YnKMwJAk52cV/oFYtudnOA8H6G2HbX8vQW17OOiaj+jzcLNAjHrlJKZsrMMMVfERbkJJ8PSv+w==
unknown
—
—
unknown
3784
2C28475F30.exe
GET
503
194.58.112.165:80
http://yot.su/b7CnevqflWi9JL5a4v/K0N/qf5sO99vKEdkG+GPyEy92cP5F60d0px4Ziw9JuFlETnXUFcvsoIO5Pl44X+WOJI7Oh8un0MdsOeLICSdUA5se3JogJjm6UIe8qbxtiCPxbdYeLuYPmoZfRH9UvHWXICcCK+mqtpciA2wKDXYH9TDgels81ZNHHt7JipE1Rg04V/qrmOtm0KfKd4vAmxm0b6JcbL1PC5G3gU4cDscAYmpPKANiXhONxVFEwS09XW2xjQ58HqNty7z+YnKMwJAk52cV/oFYtudnOA8H6G2HbX8vQW17OOiaj+jzcLNAjHrlJKZsrMMMVfERbkJJ8PSv+w==
unknown
html
206 b
unknown
3784
2C28475F30.exe
GET
403
194.58.112.165:80
http://yot.su/b7CnevqflWi9JL5a4v/K0N/qf5sO99vKEdkG+GPyEy92cP5F60d0px4Ziw9JuFlETnXUFcvsoIO5Pl44X+WOJI7Oh8un0MdsOeLICSdUA5se3JogJjm6UIe8qbxtiCPxbdYeLuYPmoZfRH9UvHWXICcCK+mqtpciA2wKDXYH9TDgels81ZNHHt7JipE1Rg04V/qrmOtm0KfKd4vAmxm0b6JcbL1PC5G3gU4cDscAYmpPKANiXhONxVFEwS09XW2xjQ58HqNty7z+YnKMwJAk52cV/oFYtudnOA8H6G2HbX8vQW17OOiaj+jzcLNAjHrlJKZsrMMMVfERbkJJ8PSv+w==
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
868
svchost.exe
23.35.228.137:80
—
AKAMAI-AS
DE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
868
svchost.exe
184.30.20.134:80
armmf.adobe.com
AKAMAI-AS
DE
unknown
3784
2C28475F30.exe
194.58.112.165:80
yot.su
Domain names registrar REG.RU, Ltd
RU
unknown

DNS requests

Domain
IP
Reputation
cabin.su
  • —
unknown
armmf.adobe.com
  • 184.30.20.134
whitelisted
wrax.ru
  • —
unknown
icals.ru
  • —
unknown
hips.su
  • —
unknown
yot.su
  • 194.58.112.165
unknown

Threats

PID
Process
Class
Message
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query for .su TLD (Soviet Union) Often Malware Related
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query for .su TLD (Soviet Union) Often Malware Related
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query for .su TLD (Soviet Union) Often Malware Related
3784
2C28475F30.exe
A Network Trojan was detected
RANSOMWARE [ANY.RUN] CryptoLocker
3784
2C28475F30.exe
Potentially Bad Traffic
ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
3784
2C28475F30.exe
Potentially Bad Traffic
ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
3784
2C28475F30.exe
Potentially Bad Traffic
ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
3784
2C28475F30.exe
Potentially Bad Traffic
ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
3784
2C28475F30.exe
Potentially Bad Traffic
ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
3784
2C28475F30.exe
Potentially Bad Traffic
ET POLICY HTTP Request to .su TLD (Soviet Union) Often Malware Related
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
cryptolocker.exe