File name:

9bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58

Full analysis: https://app.any.run/tasks/01e4951e-766a-49a2-851c-924113041ed1
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 04:29:32
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
ransomware
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

757139E76FAE876AE50DD2C3AC11D5D8

SHA1:

1C150493014D29C1F8A51E397E527F7D7C1476C7

SHA256:

9BAE897C19F237C22B6BDC024DF27455E739BE24BED07EF0D409F2DF87EEDA58

SSDEEP:

3072:gMMMMMMjMMMMMMTMMMMMMjMMMMMMTMMMMMMjMMMMMOMMMMMMjMMMMM+MMMMMMjMW:DRplyTd7BDbm+i1FzCVp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Known privilege escalation attack

      • dllhost.exe (PID: 7592)

    • RANSOMWARE has been detected

      • 9bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exe (PID: 7644)

    • Renames files like ransomware

      • 9bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exe (PID: 7644)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 9bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exe (PID: 7644)

    • Executes as Windows Service

      • VSSVC.exe (PID: 7892)

    • Changes the desktop background image

      • 9bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exe (PID: 7644)

  • INFO

    • Reads the computer name

      • 9bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exe (PID: 7452)
      • 9bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exe (PID: 7644)

    • Checks supported languages

      • 9bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exe (PID: 7452)
      • 9bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exe (PID: 7644)

    • Reads the machine GUID from the registry

      • 9bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exe (PID: 7452)
      • 9bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exe (PID: 7644)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 7592)

    • Creates files in the program directory

      • 9bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exe (PID: 7644)

    • Reads Environment values

      • 9bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exe (PID: 7644)

    • Reads product name

      • 9bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exe (PID: 7644)

    • Checks proxy server information

      • 9bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exe (PID: 7644)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (38.3)
.exe | Win32 Executable (generic) (26.2)
.exe | Win16/32 Executable Delphi generic (12)
.exe | Generic Win/DOS Executable (11.6)
.exe | DOS Executable Generic (11.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:10:22 15:32:08+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.12
CodeSize: 74752
InitializedDataSize: 20992
UninitializedDataSize: -
EntryPoint: 0x11caa
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
134
Monitored processes
6
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 9bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exe no specs CMSTPLUA THREAT 9bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exe no specs sppextcomobj.exe no specs slui.exe no specs vssvc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
7452"C:\Users\admin\AppData\Local\Temp\9bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exe" C:\Users\admin\AppData\Local\Temp\9bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\9bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\gdi32.dll
7592C:\WINDOWS\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}C:\Windows\SysWOW64\dllhost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ucrtbase.dll
c:\windows\syswow64\combase.dll
7644"C:\Users\admin\AppData\Local\Temp\9bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exe" C:\Users\admin\AppData\Local\Temp\9bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exe
dllhost.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\9bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\gdi32.dll
c:\windows\syswow64\win32u.dll
7676C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7760"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7892C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
1 415
Read events
1 408
Write events
6
Delete events
1

Modification events

(PID) Process:(7592) dllhost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(7644) 9bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7644) 9bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7644) 9bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7644) 9bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\AwlCQEBCC
Operation:delete keyName:(default)
Value:
(PID) Process:(7644) 9bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exeKey:HKEY_CURRENT_USER\Control Panel\Desktop
Operation:writeName:WallPaper
Value:
C:\ProgramData\AwlCQEBCC.bmp
(PID) Process:(7644) 9bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exeKey:HKEY_CURRENT_USER\Control Panel\Desktop
Operation:writeName:WallpaperStyle
Value:
10
Executable files
1
Suspicious files
66
Text files
80
Unknown types
0

Dropped files

PID
Process
Filename
Type
76449bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exeC:\Users\Administrator\Videos\AwlCQEBCC.README.txttext
MD5:0842767CB65FC2FD8159FE4F2B718945
SHA256:CE9645E29FD75E2B99AD49C64D40A1FB8A5412D8A9A8CD438A64664CFED539E7
76449bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exeC:\Users\Administrator\AwlCQEBCC.README.txttext
MD5:0842767CB65FC2FD8159FE4F2B718945
SHA256:CE9645E29FD75E2B99AD49C64D40A1FB8A5412D8A9A8CD438A64664CFED539E7
76449bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exeC:\Users\Administrator\Searches\vRCxwzP.AwlCQEBCCxml
MD5:0FA26B6C98419B5E7C00EFFFB5835612
SHA256:4094D158E3B0581BA433A46D0DCE62F99D8C0FD1B50BB4D0517DDC0A4A1FDE24
76449bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exeC:\Users\Administrator\Searches\b6W0ZLg.AwlCQEBCCxml
MD5:B6ACBEB59959AA5412A7565423EA7BAB
SHA256:99653A38C445AE1D4C373EE672339FD47FD098E0D0ADA5F0BE70E3B2BF711D38
76449bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exeC:\Users\Administrator\Searches\AwlCQEBCC.README.txttext
MD5:0842767CB65FC2FD8159FE4F2B718945
SHA256:CE9645E29FD75E2B99AD49C64D40A1FB8A5412D8A9A8CD438A64664CFED539E7
76449bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exeC:\Users\Administrator\Searches\EJ8PFNa.AwlCQEBCCxml
MD5:F26188A4891D18E9C99D55118E1A06AE
SHA256:4EABB8A700B57032952A8AE8353B400D14A688690F92F15F9B84520E016CF5C7
76449bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exeC:\ProgramData\AwlCQEBCC.icoimage
MD5:966B1897F569ED61C46876A6B08C5C70
SHA256:61EB24FAEA4D849484D72A4B0565B1EA14E5E0245C927067DD52BB46714A61E0
76449bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exeC:\Users\Administrator\Downloads\AwlCQEBCC.README.txttext
MD5:0842767CB65FC2FD8159FE4F2B718945
SHA256:CE9645E29FD75E2B99AD49C64D40A1FB8A5412D8A9A8CD438A64664CFED539E7
76449bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exeC:\Users\Administrator\Favorites\BSYahpF.AwlCQEBCCbinary
MD5:5D42DDDDA9951546C9D43F0062C94D39
SHA256:E0C0A5A360482B5C5DED8FAD5706C4C66F215F527851AD87B31380EF6060696E
76449bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58.exeC:\Users\Administrator\Documents\AwlCQEBCC.README.txttext
MD5:0842767CB65FC2FD8159FE4F2B718945
SHA256:CE9645E29FD75E2B99AD49C64D40A1FB8A5412D8A9A8CD438A64664CFED539E7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
19
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.32.238.112:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5800
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5800
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.32.238.112:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.32.76:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.32.238.112
  • 23.32.238.107
whitelisted
www.microsoft.com
  • 2.23.181.156
whitelisted
google.com
  • 172.217.18.14
whitelisted
fluentzip.org
  • —
malicious
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 40.126.32.76
  • 20.190.160.64
  • 40.126.32.134
  • 20.190.160.67
  • 40.126.32.68
  • 20.190.160.132
  • 40.126.32.74
  • 40.126.32.136
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
9bae897c19f237c22b6bdc024df27455e739be24bed07ef0d409f2df87eeda58