File name:

aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe

Full analysis: https://app.any.run/tasks/8280b055-e369-4c6d-ae3f-cc695a429f25
Verdict: Malicious activity
Threats:

Akira Ransomware emerged in March 2023 and compromised over 250 organizations by January 2024 with approximately $42 million in ransom payments. It employs double extortion tactics exfiltrating data before encryption and threatening to publish it on a dedicated website.

Malware Trends Tracker     >>>
Analysis date: November 06, 2024, 21:13:48
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
akira
ransomware
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 7 sections
MD5:

FEB81A8D7E0F91D6F74B440CDD3C2F28

SHA1:

8C479629F45D8D9EA5E6ED48A3EEB9917FB7AD07

SHA256:

AAA7799EDFD86B52438A9E0D71F8069CBCBE1988036B95888FCDC553E729B7B9

SSDEEP:

24576:6RzFgrQfysXMLTZ28J3rGVuZ0EmjBfmxo:6RarQfyscLTZ28J3aVuZ0EmjBfmm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AKIRA has been detected (YARA)

      • aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe (PID: 640)

  • SUSPICIOUS

    • Executed via WMI

      • powershell.exe (PID: 2112)

    • The process executes via Task Scheduler

      • AppHostRegistrationVerifier.exe (PID: 5716)

  • INFO

    • Reads the computer name

      • aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe (PID: 640)

    • Checks supported languages

      • aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe (PID: 640)

    • Checks proxy server information

      • AppHostRegistrationVerifier.exe (PID: 5716)

    • Reads security settings of Internet Explorer

      • AppHostRegistrationVerifier.exe (PID: 5716)

    • Manual execution by a user

      • notepad.exe (PID: 6624)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:08:21 11:09:01+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.37
CodeSize: 831488
InitializedDataSize: 249856
UninitializedDataSize: -
EntryPoint: 0x8d058
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
7
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #AKIRA aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe no specs powershell.exe no specs conhost.exe no specs apphostregistrationverifier.exe no specs slui.exe notepad.exe no specs textinputhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
640"C:\Users\admin\Desktop\aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe" C:\Users\admin\Desktop\aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
1716\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2112powershell.exe -Command "Get-WmiObject Win32_Shadowcopy | Remove-WmiObject"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\atl.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
3972C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5716"C:\WINDOWS\system32\AppHostRegistrationVerifier.exe"C:\Windows\System32\AppHostRegistrationVerifier.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
App Uri Handlers Registration Verifier
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\apphostregistrationverifier.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
6560"C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mcaC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Version:
123.26505.0.0
Modules
Images
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\textinputhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\vcruntime140_app.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
6624"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\Log-06-11-2024-22-14-01.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
Total events
6 077
Read events
6 049
Write events
22
Delete events
6

Modification events

(PID) Process:(5716) AppHostRegistrationVerifier.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5716) AppHostRegistrationVerifier.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5716) AppHostRegistrationVerifier.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5716) AppHostRegistrationVerifier.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.ZuneMusic_8wekyb3d8bbwe\AppUriHandlers\mediaredirect.microsoft.com
Operation:writeName:LastValidationAttemptTime
Value:
C095BACE9030DB01
(PID) Process:(5716) AppHostRegistrationVerifier.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.ZuneMusic_8wekyb3d8bbwe\AppUriHandlers\mediaredirect.microsoft.com
Operation:writeName:FailedValiationCount
Value:
5
(PID) Process:(640) aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:Owner
Value:
800200007B4A41CD9030DB01
(PID) Process:(640) aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:SessionHash
Value:
F7C33EF949EC4A0BFDA9B6125E4E668DDD78A8A89403B6CDD963F395A979E227
(PID) Process:(640) aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:Sequence
Value:
1
(PID) Process:(640) aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:RegFiles0000
Value:
C:\Users\admin\AppData\Local\ConnectedDevicesPlatform\L.admin\ActivitiesCache.db-shm
(PID) Process:(640) aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0001
Operation:writeName:RegFilesHash
Value:
F4C10188727FDC269FA75AB0BC0FEACEC36CF5BD87E696E75697D31B2090A01A
Executable files
9
Suspicious files
2 661
Text files
770
Unknown types
0

Dropped files

PID
Process
Filename
Type
2112powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_1feqvvs3.0zr.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
640aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exeC:\Users\admin\akira_readme.txttext
MD5:08F762538499795B3FABC40857F2CAEA
SHA256:6DD6401DA86A4FA1E8B74802FA9417B573DEC2C29BEAA8827494702F07024C4B
640aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exeC:\bootTel.datbinary
MD5:B857B9D4891478A49F8A229EFF45958E
SHA256:24ADAA7302527DDFA882422786918232D69A5D5800BA31B58A93A85C857A9656
640aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exeC:\Users\admin\AppData\akira_readme.txttext
MD5:08F762538499795B3FABC40857F2CAEA
SHA256:6DD6401DA86A4FA1E8B74802FA9417B573DEC2C29BEAA8827494702F07024C4B
640aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exeC:\Users\admin\AppData\Local\akira_readme.txttext
MD5:08F762538499795B3FABC40857F2CAEA
SHA256:6DD6401DA86A4FA1E8B74802FA9417B573DEC2C29BEAA8827494702F07024C4B
640aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exeC:\Users\admin\AppData\Local\Comms\Unistore\akira_readme.txttext
MD5:08F762538499795B3FABC40857F2CAEA
SHA256:6DD6401DA86A4FA1E8B74802FA9417B573DEC2C29BEAA8827494702F07024C4B
2112powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_berpslqr.agq.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2112powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:39E9DD242E68F590AA175BAD9B264CA0
SHA256:BD878F8069EEC9B2B6FB72334E18CB2E6EBA1251D70792ABDD361521E5951700
640aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exeC:\Users\admin\AppData\Local\Comms\akira_readme.txttext
MD5:08F762538499795B3FABC40857F2CAEA
SHA256:6DD6401DA86A4FA1E8B74802FA9417B573DEC2C29BEAA8827494702F07024C4B
640aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exeC:\Users\admin\AppData\Local\Comms\UnistoreDB\925dd93ec5eb7a49812b084a97753325.arikabinary
MD5:665E1BD1C484E3CB9C463DD1F38B1512
SHA256:C9BC1CF366B35F0F0083552890F11FE5EC0851B383CB19125D5813564494F996
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
4
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2512
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3972
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.78
whitelisted
mediaredirect.microsoft.com
  • —
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
self.events.data.microsoft.com
  • 104.46.162.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
aaa7799edfd86b52438a9e0d71f8069cbcbe1988036b95888fcdc553e729b7b9.exe