download:

/MalwareStudio/Worm-Locker2.0/raw/refs/heads/main/Worm%20Locker2.0(ransomware).zip

Full analysis: https://app.any.run/tasks/f2f7609f-62f4-47b6-bec8-8a992c8a76f6
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: May 15, 2025, 20:07:47
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
arch-doc
wormlocker
ransomware
ransomware
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

883752FED229F8A2E871296D217FB6C5

SHA1:

AA730BA4B3191CD935EA8D7D1FDA9EFB3D89C44F

SHA256:

995DF061CEC051F1964775932BE424EE3DA5A4EE91E2B9A17F7A625894088DBF

SSDEEP:

6144:RBXiVkkxr3hZuhwSWVGhVkYXSiaiJh4CXKEmf:XXi++xZpV5YiiaiX4CFmf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 6036)

    • Disables task manager

      • Automatic_converter_rff_to_mp4.exe (PID: 7372)

    • WORMLOCKER has been detected

      • Automatic_converter_rff_to_mp4.exe (PID: 7372)

    • WORMLOCKER has been detected (YARA)

      • Automatic_converter_rff_to_mp4.exe (PID: 7372)

    • Changes the login/logoff helper path in the registry

      • WormLocker2.0.exe (PID: 8060)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • Automatic_converter_rff_to_mp4.exe (PID: 7372)
      • WormLocker2.0.exe (PID: 8060)

    • Reads security settings of Internet Explorer

      • Automatic_converter_rff_to_mp4.exe (PID: 7372)
      • WinRAR.exe (PID: 6036)
      • WormLocker2.0.exe (PID: 8060)

    • Starts CMD.EXE for commands execution

      • Automatic_converter_rff_to_mp4.exe (PID: 7372)

    • Takes ownership (TAKEOWN.EXE)

      • cmd.exe (PID: 7444)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 7444)

    • The process checks if it is being run in the virtual environment

      • icacls.exe (PID: 7524)

    • Executable content was dropped or overwritten

      • Automatic_converter_rff_to_mp4.exe (PID: 7372)

    • Process drops legitimate windows executable

      • Automatic_converter_rff_to_mp4.exe (PID: 7372)

    • The process executes VB scripts

      • WormLocker2.0.exe (PID: 8060)

    • Start notepad (likely ransomware note)

      • WinRAR.exe (PID: 6036)

  • INFO

    • Reads the computer name

      • Automatic_converter_rff_to_mp4.exe (PID: 7372)
      • WormLocker2.0.exe (PID: 8060)

    • Process checks computer location settings

      • Automatic_converter_rff_to_mp4.exe (PID: 7372)
      • WormLocker2.0.exe (PID: 8060)

    • Checks supported languages

      • Automatic_converter_rff_to_mp4.exe (PID: 7372)
      • WormLocker2.0.exe (PID: 8060)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6036)

    • Reads the machine GUID from the registry

      • Automatic_converter_rff_to_mp4.exe (PID: 7372)
      • WormLocker2.0.exe (PID: 8060)

    • The sample compiled with english language support

      • Automatic_converter_rff_to_mp4.exe (PID: 7372)

    • Reads Microsoft Office registry keys

      • WormLocker2.0.exe (PID: 8060)
      • WinRAR.exe (PID: 6036)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 1812)

    • Reads the software policy settings

      • slui.exe (PID: 7256)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2020:12:16 14:24:44
ZipCRC: 0xba549ebb
ZipCompressedSize: 209145
ZipUncompressedSize: 330240
ZipFileName: Automatic_converter_rff_to_mp4.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
144
Monitored processes
13
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe automatic_converter_rff_to_mp4.exe no specs #WORMLOCKER automatic_converter_rff_to_mp4.exe cmd.exe no specs conhost.exe no specs takeown.exe no specs icacls.exe no specs wormlocker2.0.exe notepad.exe no specs wscript.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1812"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\Rar$DIa6036.705\README.txtC:\Windows\System32\notepad.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
5868C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5968"C:\WINDOWS\System32\WScript.exe" "C:\Windows\System32\ransom_voice.vbs" C:\Windows\System32\wscript.exe—WormLocker2.0.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Windows Based Script Host
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6036"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\f2f7609f-62f4-47b6-bec8-8a992c8a76f6.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7224C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7256"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7324"C:\Users\admin\AppData\Local\Temp\Rar$EXa6036.48863\Automatic_converter_rff_to_mp4.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa6036.48863\Automatic_converter_rff_to_mp4.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
SysWOW64
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa6036.48863\automatic_converter_rff_to_mp4.exe
c:\windows\system32\ntdll.dll
7372"C:\Users\admin\AppData\Local\Temp\Rar$EXa6036.48863\Automatic_converter_rff_to_mp4.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa6036.48863\Automatic_converter_rff_to_mp4.exe
WinRAR.exe
User:
admin
Integrity Level:
HIGH
Description:
SysWOW64
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa6036.48863\automatic_converter_rff_to_mp4.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
7444"C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "%username%:F"C:\Windows\System32\cmd.exe—Automatic_converter_rff_to_mp4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
7452\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
5 353
Read events
5 140
Write events
213
Delete events
0

Modification events

(PID) Process:(6036) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6036) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6036) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6036) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\f2f7609f-62f4-47b6-bec8-8a992c8a76f6.zip
(PID) Process:(6036) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6036) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6036) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6036) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7372) Automatic_converter_rff_to_mp4.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:DisableTaskMgr
Value:
1
(PID) Process:(8060) WormLocker2.0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Operation:writeName:Shell
Value:
empty
Executable files
5
Suspicious files
19
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
7372Automatic_converter_rff_to_mp4.exeC:\Windows\System32\LogonUItrue.exeexecutable
MD5:893144FE49AA16124B5BD3034E79BBC6
SHA256:CF01E46C146699F6C0E3DD447043F59BC9438DBBCB9563AF6C60EBC6D82727F2
6036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6036.48863\Automatic_converter_rff_to_mp4.exeexecutable
MD5:1B4F89BDB12A349DE92CA7F1261E67A0
SHA256:D4C83205CF6F3098AB6A757312525F4D14A57A819306EEEA5C0D022B00B38CF3
8060WormLocker2.0.exeC:\Users\admin\Downloads\worm_tool.systext
MD5:5031E9989AE1AB3BA509B7D4220C0DDF
SHA256:954D1BB83D80BB6F6E746B28F0DE3EC4C4ED980CFE67ED23A9159CD464FF339A
7372Automatic_converter_rff_to_mp4.exeC:\Windows\System32\LogonUIinf.exeexecutable
MD5:31618202EB911F6606405D237E098AD0
SHA256:7944285565408818FAE6F861D45D7A722F5AC630DA98FB762826F061831E46F4
7372Automatic_converter_rff_to_mp4.exeC:\Windows\System32\WormLocker2.0.exeexecutable
MD5:041AA5E99AE545DAC5F9306BB20D869E
SHA256:830C271C8ACA775457A090A51C93AD08F9665361EEEAA3FDA3F9AE032202AD73
8060WormLocker2.0.exeC:\Users\admin\Desktop\worm_tool.systext
MD5:5031E9989AE1AB3BA509B7D4220C0DDF
SHA256:954D1BB83D80BB6F6E746B28F0DE3EC4C4ED980CFE67ED23A9159CD464FF339A
7372Automatic_converter_rff_to_mp4.exeC:\Windows\System32\LogonUI.exeexecutable
MD5:31618202EB911F6606405D237E098AD0
SHA256:7944285565408818FAE6F861D45D7A722F5AC630DA98FB762826F061831E46F4
6036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa6036.705\README.txttext
MD5:1B5E62F0E3DFB4A4F1FB56E7DA453305
SHA256:ED828C1EDC4BE8CFCA8F1138D897D9730386FB4F9E57DE4FDE491EC73A845474
7372Automatic_converter_rff_to_mp4.exeC:\Windows\System32\ransom_voice.vbstext
MD5:C1F9613622F740C2F00C2FA8881BA7BA
SHA256:D200A1E942B8CFDCD8190D1AD59F92E27E39B919BA230F2DD88D70C3DF428C7B
6036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6036.48863\README.txttext
MD5:1B5E62F0E3DFB4A4F1FB56E7DA453305
SHA256:ED828C1EDC4BE8CFCA8F1138D897D9730386FB4F9E57DE4FDE491EC73A845474
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
22
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.174:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1228
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1228
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.48.23.174:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.32.140:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.174
whitelisted
crl.microsoft.com
  • 23.48.23.174
  • 23.48.23.175
  • 23.48.23.183
  • 23.48.23.181
  • 23.48.23.186
  • 23.48.23.177
  • 23.48.23.189
  • 23.48.23.179
  • 23.48.23.190
whitelisted
www.microsoft.com
  • 23.52.120.96
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 40.126.32.140
  • 20.190.160.66
  • 40.126.32.72
  • 20.190.160.67
  • 20.190.160.2
  • 20.190.160.128
  • 40.126.32.138
  • 20.190.160.4
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/MalwareStudio/Worm-Locker2.0/raw/refs/heads/main/Worm%20Locker2.0(ransomware).zip