File name:

heisenberg.exe

Full analysis: https://app.any.run/tasks/8738ec19-4a5a-42b5-beda-c0240814719b
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: August 25, 2024, 14:58:07
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
smb
evasion
pastebin
xor-url
mpress
generic
xworm
remote
ransomware
upx
troldesh
shade
derialock
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64, for MS Windows
MD5:

02CB6D1971FB53861285F273D799CED3

SHA1:

16946DB5C16D768C0D76FAB6761C65358863FC59

SHA256:

996DE893CE9219A90FA76BEAB00295734913B55A6B85DD9C227175CF4CC93E3E

SSDEEP:

393216:oX6p5vshW6vD2CmG+pFuoM6oozwdeEEIbGHhTfwxkCE3:oUhG2CmTuh8jEEIi8kB3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • ColorBug.exe (PID: 6468)
      • reg.exe (PID: 10108)
      • 6AdwCleaner.exe (PID: 7908)
      • reg.exe (PID: 9024)
      • FreeYoutubeDownloader.exe (PID: 7756)
      • NoMoreRansom.exe (PID: 10824)
      • Telegram.exe (PID: 4704)
      • CockroachOnDesktop.exe (PID: 6320)
      • AntivirusPro2017.exe (PID: 6204)
      • Telegram.exe (PID: 11768)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 8172)
      • Telegram.exe (PID: 4704)
      • Telegram.exe (PID: 11768)

    • Troldesh is detected

      • NoMoreRansom.exe (PID: 10824)

    • Create files in the Startup directory

      • Telegram.exe (PID: 4704)

    • UAC/LUA settings modification

      • Illerka.C.exe (PID: 11408)

    • Registers / Runs the DLL via REGSVR32.EXE

      • cmd.exe (PID: 11720)

    • XORed URL has been found (YARA)

      • AntivirusPro2017.exe (PID: 6204)

    • XWORM has been detected (SURICATA)

      • Telegram.exe (PID: 11768)

    • Connects to the CnC server

      • DeriaLock.exe (PID: 12192)

    • DERIALOCK has been detected (SURICATA)

      • DeriaLock.exe (PID: 12192)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • heisenberg.exe (PID: 1288)
      • BadRabbit.exe (PID: 6368)
      • Delete Windows.exe (PID: 6460)
      • rundll32.exe (PID: 6360)
      • Antivirus2010.exe (PID: 6212)
      • FakeAdwCleaner.exe (PID: 1372)
      • Goose.exe (PID: 6252)
      • Penis_Cursor.exe (PID: 8532)
      • AntivirusPlatinum.exe (PID: 7924)
      • FreeYoutubeDownloader.exe (PID: 7756)
      • NoMoreRansom.exe (PID: 10824)
      • You_Are_An_Idiot.exe (PID: 10524)
      • Illerka.C.exe (PID: 11408)

    • Reads the date of Windows installation

      • heisenberg.exe (PID: 1288)
      • Delete Windows.exe (PID: 6460)
      • AntivirusPlatinum.exe (PID: 6268)
      • PizDeath.exe (PID: 8676)
      • Goose.exe (PID: 6252)
      • Telegram.exe (PID: 4704)
      • Penis_Cursor.exe (PID: 8532)
      • FreeYoutubeDownloader.exe (PID: 7756)
      • scream.exe (PID: 6240)
      • PowerPoint.exe (PID: 11592)
      • 302746537.exe (PID: 8928)
      • scream.exe (PID: 9132)
      • You_Are_An_Idiot.exe (PID: 10524)
      • Telegram.exe (PID: 11768)

    • Reads security settings of Internet Explorer

      • heisenberg.exe (PID: 1288)
      • AntivirusPlatinum.exe (PID: 6268)
      • Delete Windows.exe (PID: 6460)
      • HMBlocker.exe (PID: 3844)
      • PizDeath.exe (PID: 8676)
      • ChilledWindows.exe (PID: 6472)
      • Goose.exe (PID: 6252)
      • Antivirus.exe (PID: 6480)
      • Telegram.exe (PID: 4704)
      • Penis_Cursor.exe (PID: 8532)
      • FreeYoutubeDownloader.exe (PID: 7756)
      • 302746537.exe (PID: 8928)
      • scream.exe (PID: 6240)
      • PowerPoint.exe (PID: 11592)
      • scream.exe (PID: 9132)
      • You_Are_An_Idiot.exe (PID: 10524)
      • Illerka.C.exe (PID: 11408)
      • AntivirusPro2017.exe (PID: 6204)
      • Telegram.exe (PID: 11768)

    • Process drops legitimate windows executable

      • heisenberg.exe (PID: 1288)
      • AntivirusPlatinum.exe (PID: 7924)

    • Drops the executable file immediately after the start

      • heisenberg.exe (PID: 1288)
      • BadRabbit.exe (PID: 6368)
      • Delete Windows.exe (PID: 6460)
      • FakeAdwCleaner.exe (PID: 1372)
      • Antivirus2010.exe (PID: 6212)
      • Goose.exe (PID: 6252)
      • Penis_Cursor.exe (PID: 8532)
      • AntivirusPlatinum.exe (PID: 7924)
      • FreeYoutubeDownloader.exe (PID: 7756)
      • NoMoreRansom.exe (PID: 10824)
      • You_Are_An_Idiot.exe (PID: 10524)
      • Illerka.C.exe (PID: 11408)

    • Executing commands from a ".bat" file

      • heisenberg.exe (PID: 1288)
      • Delete Windows.exe (PID: 6460)
      • PizDeath.exe (PID: 8676)
      • 302746537.exe (PID: 8928)

    • Changes internet zones settings

      • Antivirus.exe (PID: 6480)

    • Starts CMD.EXE for commands execution

      • heisenberg.exe (PID: 1288)
      • rundll32.exe (PID: 6360)
      • Delete Windows.exe (PID: 6460)
      • cmd.exe (PID: 6584)
      • HMBlocker.exe (PID: 3844)
      • PizDeath.exe (PID: 8676)
      • 302746537.exe (PID: 8928)
      • cmd.exe (PID: 7216)

    • Application launched itself

      • AntivirusPlatinum.exe (PID: 6268)
      • cmd.exe (PID: 6584)
      • cmd.exe (PID: 7216)
      • PowerPoint.exe (PID: 11592)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 6404)
      • Trololo.exe (PID: 9932)
      • cmd.exe (PID: 11756)

    • Starts a Microsoft application from unusual location

      • Hydra.exe (PID: 8248)
      • Windows-KB2670838.msu.exe (PID: 10032)
      • Windows-KB2670838.msu.exe (PID: 10304)

    • The system shut down or reboot

      • HMBlocker.exe (PID: 3844)

    • The process executes VB scripts

      • heisenberg.exe (PID: 1288)
      • PizDeath.exe (PID: 8676)
      • scream.exe (PID: 6240)
      • scream.exe (PID: 9132)

    • Starts application with an unusual extension

      • cmd.exe (PID: 8472)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 8728)
      • cmd.exe (PID: 8840)

    • Creates a software uninstall entry

      • FreeYoutubeDownloader.exe (PID: 7756)

    • The process creates files with name similar to system file names

      • NoMoreRansom.exe (PID: 10824)

    • Creates file in the systems drive root

      • rundll32.exe (PID: 6360)

    • The executable file from the user directory is run by the CMD process

      • scream.exe (PID: 13292)

    • Uses WEVTUTIL.EXE to cleanup log

      • cmd.exe (PID: 13200)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 7552)

    • The process executes via Task Scheduler

      • Telegram.exe (PID: 11768)

    • Checks for external IP

      • svchost.exe (PID: 2256)
      • Telegram.exe (PID: 4704)
      • Telegram.exe (PID: 11768)

    • Contacting a server suspected of hosting an CnC

      • Telegram.exe (PID: 11768)
      • DeriaLock.exe (PID: 12192)

    • Connects to unusual port

      • Telegram.exe (PID: 11768)

  • INFO

    • Reads the computer name

      • heisenberg.exe (PID: 1288)
      • AntivirusPlatinum.exe (PID: 6268)
      • ChilledWindows.exe (PID: 6472)
      • Cool Spot Deskmate.EXE (PID: 6572)
      • CockroachOnDesktop.exe (PID: 6320)
      • Delete Windows.exe (PID: 6460)
      • ColorBug.exe (PID: 6468)
      • AntivirusPro2017.exe (PID: 6204)
      • MEMZ.exe (PID: 8412)
      • Telegram.exe (PID: 4704)
      • PizDeath.exe (PID: 8676)
      • AntivirusPlatinum.exe (PID: 7924)
      • GooseDesktop.exe (PID: 9612)
      • Penis_Cursor.exe (PID: 8532)
      • scream.exe (PID: 6240)
      • Windows-KB2670838.msu.exe (PID: 10304)
      • scream.exe (PID: 9132)
      • FreeYoutubeDownloader.exe (PID: 7756)
      • You_Are_An_Idiot.exe (PID: 10524)
      • NoMoreRansom.exe (PID: 10824)
      • 302746537.exe (PID: 8928)
      • InfinityCrypt.exe (PID: 11496)
      • Free YouTube Downloader.exe (PID: 11644)
      • Trololo.exe (PID: 9932)
      • PowerPoint.exe (PID: 11592)
      • Курсор - писюн.exe (PID: 10416)
      • Illerka.C.exe (PID: 11408)
      • DeriaLock.exe (PID: 12192)
      • Telegram.exe (PID: 11768)
      • identity_helper.exe (PID: 13024)

    • Checks supported languages

      • heisenberg.exe (PID: 1288)
      • Antivirus.exe (PID: 6480)
      • Antivirus2010.exe (PID: 6212)
      • AntivirusPlatinum.exe (PID: 6268)
      • AntivirusPro2017.exe (PID: 6204)
      • ChilledWindows.exe (PID: 6472)
      • BadRabbit.exe (PID: 6368)
      • CockroachOnDesktop.exe (PID: 6320)
      • Cool Spot Deskmate.EXE (PID: 6572)
      • ColorBug.exe (PID: 6468)
      • Delete Windows.exe (PID: 6460)
      • DeriaLock.exe (PID: 7096)
      • DesktopPuzzle.exe (PID: 420)
      • Telegram.exe (PID: 4704)
      • FakeAdwCleaner.exe (PID: 1372)
      • HappyAntivirus.exe (PID: 7224)
      • Hydra.exe (PID: 8248)
      • MEMZ.exe (PID: 8412)
      • HMBlocker.exe (PID: 3844)
      • PizDeath.exe (PID: 8676)
      • scream.exe (PID: 6240)
      • Goose.exe (PID: 6252)
      • chcp.com (PID: 9392)
      • Trololo.exe (PID: 9932)
      • GooseDesktop.exe (PID: 9612)
      • scream.exe (PID: 9132)
      • Penis_Cursor.exe (PID: 8532)
      • You_Are_An_Idiot.exe (PID: 10524)
      • NoMoreRansom.exe (PID: 10824)
      • Windows-KB2670838.msu.exe (PID: 10304)
      • 302746537.exe (PID: 8928)
      • Illerka.C.exe (PID: 11408)
      • InfinityCrypt.exe (PID: 11496)
      • FreeYoutubeDownloader.exe (PID: 7756)
      • PowerPoint.exe (PID: 11592)
      • Free YouTube Downloader.exe (PID: 11644)
      • Курсор - писюн.exe (PID: 10416)
      • DeriaLock.exe (PID: 12192)
      • YouAreAnIdiot.exe (PID: 12844)
      • scream.exe (PID: 13292)
      • Telegram.exe (PID: 11768)
      • identity_helper.exe (PID: 13024)

    • Create files in a temporary directory

      • heisenberg.exe (PID: 1288)
      • AntivirusPro2017.exe (PID: 6204)
      • PizDeath.exe (PID: 8676)
      • Goose.exe (PID: 6252)
      • Penis_Cursor.exe (PID: 8532)
      • 302746537.exe (PID: 8928)
      • You_Are_An_Idiot.exe (PID: 10524)
      • Illerka.C.exe (PID: 11408)
      • NoMoreRansom.exe (PID: 10824)

    • Process checks computer location settings

      • heisenberg.exe (PID: 1288)
      • AntivirusPlatinum.exe (PID: 6268)
      • Delete Windows.exe (PID: 6460)
      • HMBlocker.exe (PID: 3844)
      • PizDeath.exe (PID: 8676)
      • Goose.exe (PID: 6252)
      • Telegram.exe (PID: 4704)
      • Penis_Cursor.exe (PID: 8532)
      • FreeYoutubeDownloader.exe (PID: 7756)
      • 302746537.exe (PID: 8928)
      • scream.exe (PID: 6240)
      • PowerPoint.exe (PID: 11592)
      • scream.exe (PID: 9132)
      • You_Are_An_Idiot.exe (PID: 10524)
      • Telegram.exe (PID: 11768)

    • Dropped object may contain TOR URL's

      • BadRabbit.exe (PID: 6368)
      • rundll32.exe (PID: 6360)

    • Reads the machine GUID from the registry

      • ChilledWindows.exe (PID: 6472)
      • Delete Windows.exe (PID: 6460)
      • Telegram.exe (PID: 4704)
      • PizDeath.exe (PID: 8676)
      • Hydra.exe (PID: 8248)
      • GooseDesktop.exe (PID: 9612)
      • Windows-KB2670838.msu.exe (PID: 10304)
      • InfinityCrypt.exe (PID: 11496)
      • Free YouTube Downloader.exe (PID: 11644)
      • NoMoreRansom.exe (PID: 10824)
      • DeriaLock.exe (PID: 12192)
      • Telegram.exe (PID: 11768)

    • Checks proxy server information

      • Cool Spot Deskmate.EXE (PID: 6572)
      • Telegram.exe (PID: 4704)
      • Antivirus.exe (PID: 6480)
      • DeriaLock.exe (PID: 7096)
      • ChilledWindows.exe (PID: 6472)
      • DeriaLock.exe (PID: 12192)
      • Telegram.exe (PID: 11768)

    • Creates files or folders in the user directory

      • Delete Windows.exe (PID: 6460)
      • DeriaLock.exe (PID: 7096)
      • ChilledWindows.exe (PID: 6472)
      • Telegram.exe (PID: 4704)
      • InfinityCrypt.exe (PID: 11496)
      • DeriaLock.exe (PID: 12192)

    • Reads Microsoft Office registry keys

      • heisenberg.exe (PID: 1288)
      • PizDeath.exe (PID: 8676)
      • msedge.exe (PID: 9912)

    • Reads Environment values

      • Telegram.exe (PID: 4704)
      • DeriaLock.exe (PID: 7096)
      • Telegram.exe (PID: 11768)
      • DeriaLock.exe (PID: 12192)
      • identity_helper.exe (PID: 13024)

    • Changes the display of characters in the console

      • chcp.com (PID: 9392)

    • Disables trace logs

      • Telegram.exe (PID: 4704)
      • DeriaLock.exe (PID: 7096)
      • DeriaLock.exe (PID: 12192)
      • Telegram.exe (PID: 11768)

    • Application launched itself

      • msedge.exe (PID: 9912)

    • Reads CPU info

      • InfinityCrypt.exe (PID: 11496)

    • Creates files in the program directory

      • NoMoreRansom.exe (PID: 10824)

    • Process checks whether UAC notifications are on

      • Illerka.C.exe (PID: 11408)

    • Reads the software policy settings

      • Telegram.exe (PID: 4704)
      • Telegram.exe (PID: 11768)

    • Mpress packer has been detected

      • AntivirusPro2017.exe (PID: 6204)

    • UPX packer has been detected

      • HMBlocker.exe (PID: 3844)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

xor-url

(PID) Process(6204) AntivirusPro2017.exe
Decrypted-URLs (4)http://licencecheck24.com/checking.php
http://securerem.com/buynow.php?bid=%advid%
http://securerem.com/support.html
http://twinkcam.net/images/v.php?id=%advid%
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:05:12 10:17:07+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.33
CodeSize: 288768
InitializedDataSize: 136704
UninitializedDataSize: -
EntryPoint: 0x32ee0
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
419
Monitored processes
276
Malicious processes
11
Suspicious processes
17

Behavior graph

Click at the process to see the details
start heisenberg.exe antivirus.exe antivirus2010.exe no specs antivirus2010.exe antivirusplatinum.exe no specs THREAT antiviruspro2017.exe badrabbit.exe no specs badrabbit.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chilledwindows.exe no specs cockroachondesktop.exe colorbug.exe cool spot deskmate.exe no specs delete windows.exe rundll32.exe derialock.exe no specs mspaint.exe no specs mspaint.exe no specs mspaint.exe no specs mspaint.exe no specs mspaint.exe no specs mspaint.exe no specs mspaint.exe no specs cmd.exe no specs derialock.exe desktoppuzzle.exe no specs mspaint.exe no specs mspaint.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs fakeadwcleaner.exe telegram.exe cmd.exe no specs conhost.exe no specs usеrinit.exe no specs cmd.exe no specs conhost.exe no specs mspaint.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs mspaint.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs mspaint.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs mspaint.exe no specs cmd.exe no specs conhost.exe no specs freeyoutubedownloader.exe 6adwcleaner.exe antivirusplatinum.exe cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs mspaint.exe no specs goose.exe happyantivirus.exe no specs cmd.exe no specs conhost.exe no specs THREAT hmblocker.exe no specs mspaint.exe no specs hydra.exe no specs melting.exe no specs memz.exe no specs cmd.exe no specs schtasks.exe no specs penis_cursor.exe cmd.exe no specs shutdown.exe no specs pizdeath.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs wscript.exe no specs wscript.exe no specs cmd.exe no specs mspaint.exe no specs conhost.exe no specs mspaint.exe no specs wscript.exe no specs scream.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs trololo.exe no specs cmd.exe no specs wscript.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs chcp.com no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs goosedesktop.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs mspaint.exe no specs wscript.exe no specs svchost.exe cmd.exe no specs cmd.exe no specs conhost.exe no specs msedge.exe conhost.exe no specs trololo.exe windows-kb2670838.msu.exe no specs reg.exe mspaint.exe no specs scream.exe no specs cmd.exe no specs conhost.exe no specs msedge.exe no specs schtasks.exe no specs wscript.exe no specs conhost.exe no specs reg.exe windows-kb2670838.msu.exe cmd.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs cmd.exe no specs курсор - писюн.exe no specs conhost.exe no specs conhost.exe no specs you_are_an_idiot.exe msedge.exe no specs #TROLDESH nomoreransom.exe msedge.exe no specs mspaint.exe no specs msedge.exe no specs 302746537.exe no specs taskkill.exe no specs taskkill.exe no specs conhost.exe no specs conhost.exe no specs illerka.c.exe cmd.exe no specs infinitycrypt.exe no specs conhost.exe no specs powerpoint.exe no specs derialock.exe no specs free youtube downloader.exe no specs cmd.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs mspaint.exe no specs mspaint.exe no specs mspaint.exe no specs msedge.exe no specs explorer.exe no specs wscript.exe no specs msedge.exe no specs msedge.exe no specs mspaint.exe no specs msedge.exe no specs #DERIALOCK derialock.exe msedge.exe no specs mspaint.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs youareanidiot.exe no specs 2000.exe no specs mspaint.exe no specs msedge.exe no specs mspaint.exe no specs cmd.exe no specs msedge.exe no specs scream.exe no specs conhost.exe no specs powerpoint.exe mspaint.exe no specs explorer.exe no specs msedge.exe no specs mspaint.exe no specs mspaint.exe no specs mspaint.exe no specs regsvr32.exe no specs msedge.exe no specs msedge.exe no specs mspaint.exe no specs wevtutil.exe no specs cmd.exe no specs mspaint.exe no specs msedge.exe no specs conhost.exe no specs mspaint.exe no specs mspaint.exe no specs mspaint.exe no specs explorer.exe no specs wevtutil.exe no specs cmd.exe no specs mspaint.exe no specs msedge.exe no specs mspaint.exe no specs cmd.exe no specs conhost.exe no specs msedge.exe no specs cmd.exe no specs conhost.exe no specs wevtutil.exe no specs mspaint.exe no specs msedge.exe no specs mspaint.exe no specs explorer.exe no specs mspaint.exe no specs mspaint.exe no specs cmd.exe no specs msedge.exe no specs #XWORM telegram.exe schtasks.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
420"C:\Users\admin\AppData\Local\Temp\DesktopPuzzle.exe" C:\Users\admin\AppData\Local\Temp\DesktopPuzzle.exe—heisenberg.exe
User:
admin
Company:
Andy Feys
Integrity Level:
MEDIUM
Description:
Slider
Exit code:
1073807364
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\desktoppuzzle.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
872\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1288"C:\Users\admin\Desktop\heisenberg.exe" C:\Users\admin\Desktop\heisenberg.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1073807364
Modules
Images
c:\users\admin\desktop\heisenberg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1372"C:\Users\admin\AppData\Local\Temp\FakeAdwCleaner.exe" C:\Users\admin\AppData\Local\Temp\FakeAdwCleaner.exe
heisenberg.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\fakeadwcleaner.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1692mspaint C:\Windows\System32\mspaint.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Paint
Exit code:
1073807364
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mspaint.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2096mspaint C:\Windows\System32\mspaint.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Paint
Exit code:
1073807364
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mspaint.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2256C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2400C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\stopantivirus.bat" "C:\Windows\System32\cmd.exe—heisenberg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
4294967295
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
2508mspaint C:\Windows\System32\mspaint.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Paint
Exit code:
1073807364
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mspaint.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2904"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7308 --field-trial-handle=2252,i,4900441568173332323,1661607287599247478,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
Total events
123 521
Read events
122 698
Write events
778
Delete events
45

Modification events

(PID) Process:(1288) heisenberg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1288) heisenberg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1288) heisenberg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1288) heisenberg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6468) ColorBug.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:~~CB
Value:
cb.exe
(PID) Process:(6572) Cool Spot Deskmate.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Screen Babe Design
Operation:writeName:DeleteList
Value:
(PID) Process:(6572) Cool Spot Deskmate.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Screen Babe Design
Operation:writeName:DeleteFolder
Value:
(PID) Process:(6480) Antivirus.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\AnVi
Operation:writeName:Settings_0
Value:
1
(PID) Process:(6480) Antivirus.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:Use FormSuggest
Value:
Yes
(PID) Process:(6480) Antivirus.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
Operation:writeName:1601
Value:
0
Executable files
97
Suspicious files
222
Text files
158
Unknown types
12

Dropped files

PID
Process
Filename
Type
1288heisenberg.exeC:\Users\admin\AppData\Local\Temp\Prank2.vbstext
MD5:D543DBB26E4F1A0B5C0170D7BED43F1A
SHA256:B3DB3B6D326F1C98B5EA1C8F7BBAA4F65163F6167478348382B8FA272E72326E
1288heisenberg.exeC:\Users\admin\AppData\Local\Temp\Petya.exeexecutable
MD5:A92F13F3A1B3B39833D3CC336301B713
SHA256:4C1DC737915D76B7CE579ABDDABA74EAD6FDB5B519A1EA45308B8C49B950655C
1288heisenberg.exeC:\Users\admin\AppData\Local\Temp\PizDeath.exeexecutable
MD5:01B227AEC8F15CFAA65F03494F2FA7EB
SHA256:A15C2AEEF67607AAC6F960AF5AA7285D35D67DA06146AF02308BA6CC280E4D32
1288heisenberg.exeC:\Users\admin\AppData\Local\Temp\Petya.A.exeexecutable
MD5:AF2379CC4D607A45AC44D62135FB7015
SHA256:26B4699A7B9EEB16E76305D843D4AB05E94D43F3201436927E13B3EBAFA90739
1288heisenberg.exeC:\Users\admin\AppData\Local\Temp\Prank4.vbstext
MD5:507A5522C34525DB4C7F491AE8108239
SHA256:3427CEED0CA73C5492AE67691F611CAA5B08A89BD29EE067AD7C22AAAAE1A0AC
1288heisenberg.exeC:\Users\admin\AppData\Local\Temp\Prank.vbstext
MD5:AE6CCAC3FB001BBEE932D56094F4F1DB
SHA256:CB6EC854E7800BC56DBFFF53A5F79993072EA7D15689D41D3CCD6077817D5210
1288heisenberg.exeC:\Users\admin\AppData\Local\Temp\Porno DDOS.battext
MD5:245A8EF029B610E7BB3F3A03AC50B263
SHA256:4968842207F0EFE0CDC83A2EE14C5D1742B446B57769A83701FB100DCD666E70
1288heisenberg.exeC:\Users\admin\AppData\Local\Temp\Windows-KB2670838.msu.exeexecutable
MD5:6E49C75F701AA059FA6ED5859650B910
SHA256:F91F02FD27ADA64F36F6DF59A611FEF106FF7734833DEA825D0612E73BDFB621
1288heisenberg.exeC:\Users\admin\AppData\Local\Temp\stopantivirus.battext
MD5:31F028E35C7558A1EC0EA3A32227DB45
SHA256:68FEB2C42355F24B14B0A93F927C4A830202D2511923D7253EAA590B8D6A4C01
1288heisenberg.exeC:\Users\admin\AppData\Local\Temp\PowerPoint.exeexecutable
MD5:70108103A53123201CEB2E921FCFE83C
SHA256:9C3F8DF80193C085912C9950C58051AE77C321975784CC069CEACD4F57D5861D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
286
TCP/UDP connections
206
DNS requests
169
Threats
183

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
—
168.156.42.60:80
http://168.156.42.60:80/ask?t=4&u=3&a=20&m=29fa4b95&h=0
unknown
—
—
unknown
—
—
GET
—
168.156.42.60:80
http://168.156.42.60:80/ask?t=4&u=3&a=0&m=29fa4b95&h=0
unknown
—
—
unknown
4704
Telegram.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
shared
6480
Antivirus.exe
GET
404
104.245.107.49:80
http://searchdusty.com/avt/avt_db
unknown
—
—
whitelisted
7096
DeriaLock.exe
GET
403
162.55.0.137:80
http://arizonacode.bplaced.net/HF/SystemLocker/UNLOCKKEYS/LOGON.exe
unknown
—
—
whitelisted
6480
Antivirus.exe
GET
404
104.245.107.49:80
http://searchdusty.com/avt/avt.dat
unknown
—
—
whitelisted
6480
Antivirus.exe
GET
404
104.245.107.49:80
http://searchdusty.com/avt/avtr.dat
unknown
—
—
whitelisted
—
—
GET
401
13.107.6.158:443
https://business.bing.com/api/v1/user/token/microsoftgraph?&clienttype=edge-omnibox
unknown
—
—
—
—
—
OPTIONS
200
23.32.238.91:443
https://bzib.nelreports.net/api/report?cat=bingbusiness
unknown
—
—
—
7096
DeriaLock.exe
GET
403
162.55.0.137:80
http://arizonacode.bplaced.net/HF/SystemLocker/unlock-everybody.txt
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
—
—
168.156.42.60:80
—
WA-K20
US
unknown
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
192.168.100.2:445
—
—
—
whitelisted
—
—
168.156.42.60:445
—
WA-K20
US
unknown
6360
rundll32.exe
192.168.100.2:80
—
—
—
whitelisted
4704
Telegram.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
unknown
4
System
192.168.100.2:445
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.206
whitelisted
www.vikingwebscanner.com
  • —
malicious
ip-api.com
  • 208.95.112.1
shared
frequentwin.com
  • —
unknown
fastsofgeld.com
  • —
unknown
highway-traffic.com
  • —
unknown
searchdusty.com
  • 104.245.107.49
whitelisted
arizonacode.bplaced.net
  • 162.55.0.137
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
POLICY [ANY.RUN] Attempt to connect to an external SMB server
2256
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2256
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
4704
Telegram.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
4704
Telegram.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
6480
Antivirus.exe
Potentially Bad Traffic
ET USER_AGENTS User-Agent (Internet Explorer)
6480
Antivirus.exe
Potentially Bad Traffic
ET USER_AGENTS User-Agent (Internet Explorer)
6480
Antivirus.exe
Potentially Bad Traffic
ET USER_AGENTS User-Agent (Internet Explorer)
2256
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Online Pastebin Text Storage
7096
DeriaLock.exe
Misc activity
ET HUNTING [TW] Likely Javascript-Obfuscator Usage Observed M1
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
heisenberg.exe