File name:

Trojan-Ransom.NSIS.Xamyh.agk-188cbd4c6cf94aa15fb22955a0910ed7fd8abdf20222e3ff241712efa6f9adf3.7z

Full analysis: https://app.any.run/tasks/0479346a-aa6a-43fe-acdd-656b4f358226
Verdict: Malicious activity
Analysis date: April 24, 2025, 19:57:49
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
arch-exec
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

220052D29E55E1DED49282B3BD7F0F10

SHA1:

3F464D97AADD649FFB03CE5DD3710D327151D3C4

SHA256:

A472323E23CA726E99ABB56BD4D7DCFAECC3DE380A9F511304097160A0B6885A

SSDEEP:

12288:HbtYfT0RpnOW7nx9ar9EEsujlTuwjpI/G3lTr3trvE9ILEimw:7tYfT0RpnOQx9ar9ENujtuwjpI/G3tz5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 2840)

    • Changes the autorun value in the registry

      • Trojan-Ransom.NSIS.Xamyh.agk-188cbd4c6cf94aa15fb22955a0910ed7fd8abdf20222e3ff241712efa6f9adf3.exe (PID: 2740)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Trojan-Ransom.NSIS.Xamyh.agk-188cbd4c6cf94aa15fb22955a0910ed7fd8abdf20222e3ff241712efa6f9adf3.exe (PID: 2740)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2840)

    • Reads the computer name

      • Trojan-Ransom.NSIS.Xamyh.agk-188cbd4c6cf94aa15fb22955a0910ed7fd8abdf20222e3ff241712efa6f9adf3.exe (PID: 2740)

    • Checks supported languages

      • Trojan-Ransom.NSIS.Xamyh.agk-188cbd4c6cf94aa15fb22955a0910ed7fd8abdf20222e3ff241712efa6f9adf3.exe (PID: 2740)
      • launcher.exe (PID: 328)

    • Manual execution by a user

      • Trojan-Ransom.NSIS.Xamyh.agk-188cbd4c6cf94aa15fb22955a0910ed7fd8abdf20222e3ff241712efa6f9adf3.exe (PID: 2740)
      • iexplore.exe (PID: 2412)

    • Creates files or folders in the user directory

      • Trojan-Ransom.NSIS.Xamyh.agk-188cbd4c6cf94aa15fb22955a0910ed7fd8abdf20222e3ff241712efa6f9adf3.exe (PID: 2740)

    • Create files in a temporary directory

      • Trojan-Ransom.NSIS.Xamyh.agk-188cbd4c6cf94aa15fb22955a0910ed7fd8abdf20222e3ff241712efa6f9adf3.exe (PID: 2740)

    • Application launched itself

      • iexplore.exe (PID: 2412)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
ModifyDate: 2016:07:20 14:35:36+00:00
ArchivedFileName: Trojan-Ransom.NSIS.Xamyh.agk-188cbd4c6cf94aa15fb22955a0910ed7fd8abdf20222e3ff241712efa6f9adf3.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
5
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe trojan-ransom.nsis.xamyh.agk-188cbd4c6cf94aa15fb22955a0910ed7fd8abdf20222e3ff241712efa6f9adf3.exe launcher.exe no specs iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
328"C:\Users\admin\AppData\Roaming\OkSearch\launcher.exe" 28800000C:\Users\admin\AppData\Roaming\OkSearch\launcher.exe—Trojan-Ransom.NSIS.Xamyh.agk-188cbd4c6cf94aa15fb22955a0910ed7fd8abdf20222e3ff241712efa6f9adf3.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\roaming\oksearch\launcher.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1560"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2412 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2412"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2740"C:\Users\admin\Desktop\Trojan-Ransom.NSIS.Xamyh.agk-188cbd4c6cf94aa15fb22955a0910ed7fd8abdf20222e3ff241712efa6f9adf3.exe" C:\Users\admin\Desktop\Trojan-Ransom.NSIS.Xamyh.agk-188cbd4c6cf94aa15fb22955a0910ed7fd8abdf20222e3ff241712efa6f9adf3.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\trojan-ransom.nsis.xamyh.agk-188cbd4c6cf94aa15fb22955a0910ed7fd8abdf20222e3ff241712efa6f9adf3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2840"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\Trojan-Ransom.NSIS.Xamyh.agk-188cbd4c6cf94aa15fb22955a0910ed7fd8abdf20222e3ff241712efa6f9adf3.7zC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
18 205
Read events
17 966
Write events
145
Delete events
94

Modification events

(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Trojan-Ransom.NSIS.Xamyh.agk-188cbd4c6cf94aa15fb22955a0910ed7fd8abdf20222e3ff241712efa6f9adf3.7z
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
Executable files
6
Suspicious files
46
Text files
85
Unknown types
0

Dropped files

PID
Process
Filename
Type
2840WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2840.48642\Trojan-Ransom.NSIS.Xamyh.agk-188cbd4c6cf94aa15fb22955a0910ed7fd8abdf20222e3ff241712efa6f9adf3.exeexecutable
MD5:2F69DB5DCC896A889A91F75AA2D9ED52
SHA256:188CBD4C6CF94AA15FB22955A0910ED7FD8ABDF20222E3FF241712EFA6F9ADF3
2740Trojan-Ransom.NSIS.Xamyh.agk-188cbd4c6cf94aa15fb22955a0910ed7fd8abdf20222e3ff241712efa6f9adf3.exeC:\Users\admin\AppData\Local\Temp\nsk40DD.tmp\ioSpecial.initext
MD5:E2D5070BC28DB1AC745613689FF86067
SHA256:D95AED234F932A1C48A2B1B0D98C60CA31F962310C03158E2884AB4DDD3EA1E0
2740Trojan-Ransom.NSIS.Xamyh.agk-188cbd4c6cf94aa15fb22955a0910ed7fd8abdf20222e3ff241712efa6f9adf3.exeC:\Users\admin\AppData\Roaming\OkSearch\chromium\hilbjnajfehfhggoadmonbjbnliofolg\_metadata\computed_hashes.jsonbinary
MD5:B714B0E75B9DD91B60ADCFCF3A397108
SHA256:1DFDC273E2F23957EAE10460EE5A1490C4F136F2D6FC483B9A1F0718F20C8D33
2740Trojan-Ransom.NSIS.Xamyh.agk-188cbd4c6cf94aa15fb22955a0910ed7fd8abdf20222e3ff241712efa6f9adf3.exeC:\Users\admin\AppData\Roaming\OkSearch\config.jsonbinary
MD5:802BF3ADFE4A3BBC674FB4B5E8FA44E9
SHA256:0FF0513139C4CB4B42D06D79E575339FABFDF9242C9CA663266B1B211CECE708
2740Trojan-Ransom.NSIS.Xamyh.agk-188cbd4c6cf94aa15fb22955a0910ed7fd8abdf20222e3ff241712efa6f9adf3.exeC:\Users\admin\AppData\Roaming\OkSearch\chromium\hilbjnajfehfhggoadmonbjbnliofolg\_metadata\verified_contents.jsontext
MD5:E71F887A12B6DEF2DCC8FBBDC131A35C
SHA256:660740BC4CA718A59E9F88600D4110BE001FA74A2496CB4D7F2A075E02D164EF
2740Trojan-Ransom.NSIS.Xamyh.agk-188cbd4c6cf94aa15fb22955a0910ed7fd8abdf20222e3ff241712efa6f9adf3.exeC:\Users\admin\AppData\Roaming\OkSearch\chromium\hilbjnajfehfhggoadmonbjbnliofolg\manifest.jsonbinary
MD5:341E1AC7C35CE759B2BAF177529011A4
SHA256:E371094628D0648EFE507A7818B8C30E6F97DCB7C4E6790849BFA57B120DFC92
2740Trojan-Ransom.NSIS.Xamyh.agk-188cbd4c6cf94aa15fb22955a0910ed7fd8abdf20222e3ff241712efa6f9adf3.exeC:\Users\admin\AppData\Roaming\OkSearch\chromium\hilbjnajfehfhggoadmonbjbnliofolg\js\core.jsbinary
MD5:2A251C1881A79768052A2D3A46E34A16
SHA256:AE6E526016A734B72594C7A33B04746572B8EAA630FD8D53CD58F724B68AAD11
2740Trojan-Ransom.NSIS.Xamyh.agk-188cbd4c6cf94aa15fb22955a0910ed7fd8abdf20222e3ff241712efa6f9adf3.exeC:\Users\admin\AppData\Roaming\OkSearch\chromium\hilbjnajfehfhggoadmonbjbnliofolg\css\popup.csstext
MD5:035794ECC9DAF73C239641959B9B9A1D
SHA256:84B328A012AE4E98D7EEBD81ED5CA6DAFC4DDE6EE53B028F3E60D13E8CC4CDA7
2740Trojan-Ransom.NSIS.Xamyh.agk-188cbd4c6cf94aa15fb22955a0910ed7fd8abdf20222e3ff241712efa6f9adf3.exeC:\Users\admin\AppData\Local\Temp\nsk40DD.tmp\InstallOptions.dllexecutable
MD5:046074D285897C008499F7F3AD5BE114
SHA256:254C5CCBCE59AD882F7F51D0BF760CABDE8C88C5AF84E13CC8AD77BA0361055C
2740Trojan-Ransom.NSIS.Xamyh.agk-188cbd4c6cf94aa15fb22955a0910ed7fd8abdf20222e3ff241712efa6f9adf3.exeC:\Users\admin\AppData\Roaming\OkSearch\chromium\hilbjnajfehfhggoadmonbjbnliofolg\icons\icon_128.pngbinary
MD5:DF8409D9614CBFC002611CE80A005FC7
SHA256:0B25C4F15D152B1FF952996D7E0DEADFFFE75C9CB0A28E4C9BFBF4D5B23B9185
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
26
DNS requests
10
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2412
iexplore.exe
GET
200
208.89.74.19:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?814920b3045b6e65
unknown
—
—
whitelisted
2412
iexplore.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
2412
iexplore.exe
GET
200
208.89.74.19:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?3ea76c6146e84486
unknown
—
—
whitelisted
1560
iexplore.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2412
iexplore.exe
2.23.227.208:443
www.bing.com
Ooredoo Q.S.C.
QA
whitelisted
2412
iexplore.exe
208.89.74.19:80
ctldl.windowsupdate.com
—
US
whitelisted
2412
iexplore.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
1560
iexplore.exe
13.107.5.80:443
api.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1560
iexplore.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
1560
iexplore.exe
150.171.28.10:443
bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.184.238
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 2.23.227.215
  • 2.23.227.208
whitelisted
ctldl.windowsupdate.com
  • 208.89.74.19
  • 208.89.74.23
  • 208.89.74.31
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
bing.com
  • 150.171.28.10
  • 150.171.27.10
whitelisted
r.bing.com
  • 2.23.227.215
  • 2.23.227.208
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Trojan-Ransom.NSIS.Xamyh.agk-188cbd4c6cf94aa15fb22955a0910ed7fd8abdf20222e3ff241712efa6f9adf3.7z