File name:

challenge.exe

Full analysis: https://app.any.run/tasks/c3ec5626-f519-4747-852b-9581de04a2d1
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: May 19, 2025, 15:05:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
xor-url
generic
ransomware
stop
djvu
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

A2F33095EF25B4D5B061EB53A7FE6548

SHA1:

B38A8CB06507ADB966DFDB809403F8F7F64CA534

SHA256:

B0D41E9B8C941D207A0958B92F57083DD9B9246958BD32E2E6E90C4EE0E12419

SSDEEP:

24576:sHMFgBanP6wJlYixpC9gbYstRiNhmREhf4gnlzY1hcP0GeN53UB:sHmgq1sUJOLlucev3UB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • challenge.exe (PID: 2812)

    • XORed URL has been found (YARA)

      • challenge.exe (PID: 3124)

    • DJVU mutex has been found

      • challenge.exe (PID: 3124)

    • Stop is detected

      • challenge.exe (PID: 3124)

  • SUSPICIOUS

    • Application launched itself

      • challenge.exe (PID: 2060)
      • challenge.exe (PID: 2812)
      • challenge.exe (PID: 2944)

    • Reads the Internet Settings

      • challenge.exe (PID: 2812)
      • challenge.exe (PID: 3124)

    • Reads security settings of Internet Explorer

      • challenge.exe (PID: 2812)
      • challenge.exe (PID: 3124)

    • Checks for external IP

      • svchost.exe (PID: 1080)
      • challenge.exe (PID: 2812)
      • challenge.exe (PID: 3124)

    • Reads settings of System Certificates

      • challenge.exe (PID: 2812)
      • challenge.exe (PID: 3124)

    • Adds/modifies Windows certificates

      • challenge.exe (PID: 2812)
      • challenge.exe (PID: 3124)

    • Executable content was dropped or overwritten

      • challenge.exe (PID: 2812)

    • Uses ICACLS.EXE to modify access control lists

      • challenge.exe (PID: 2812)

    • There is functionality for taking screenshot (YARA)

      • challenge.exe (PID: 3124)

  • INFO

    • Checks proxy server information

      • challenge.exe (PID: 2812)
      • challenge.exe (PID: 3124)

    • Checks supported languages

      • challenge.exe (PID: 2060)
      • challenge.exe (PID: 2812)
      • challenge.exe (PID: 2944)
      • challenge.exe (PID: 3124)

    • Reads the computer name

      • challenge.exe (PID: 2812)
      • challenge.exe (PID: 3124)

    • Reads the machine GUID from the registry

      • challenge.exe (PID: 2812)
      • challenge.exe (PID: 3124)

    • Reads the software policy settings

      • challenge.exe (PID: 2812)
      • challenge.exe (PID: 3124)

    • Creates files or folders in the user directory

      • challenge.exe (PID: 2812)
      • challenge.exe (PID: 3124)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

xor-url

(PID) Process(3124) challenge.exe
Decrypted-URLs (4)http://kotob.top/dl/build2.exe$run
http://tzgl.org/fhsgtsspen6/get.php
http://tzgl.org/files/1/build3.exe$run
https://we.tl/t-NONb1QT9
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:03:23 01:28:10+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 768000
InitializedDataSize: 623104
UninitializedDataSize: -
EntryPoint: 0x9d410
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
6
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start challenge.exe no specs challenge.exe svchost.exe icacls.exe no specs challenge.exe #XOR-URL challenge.exe

Process information

PID
CMD
Path
Indicators
Parent process
1080C:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1748icacls "C:\Users\admin\AppData\Local\56363920-22ed-4f9b-9ebf-ae5fe264f43d" /deny *S-1-1-0:(OI)(CI)(DE,DC)C:\Windows\System32\icacls.exe—challenge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
2060"C:\Users\admin\challenge.exe" C:\Users\admin\challenge.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\challenge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
2812"C:\Users\admin\challenge.exe" C:\Users\admin\challenge.exe
challenge.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\challenge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\mpr.dll
c:\windows\system32\wininet.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\user32.dll
2944"C:\Users\admin\challenge.exe" --Admin IsNotAutoStart IsNotTaskC:\Users\admin\challenge.exe
challenge.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\challenge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
3124"C:\Users\admin\challenge.exe" --Admin IsNotAutoStart IsNotTaskC:\Users\admin\challenge.exe
challenge.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\challenge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\mpr.dll
c:\windows\system32\wininet.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\user32.dll
xor-url
(PID) Process(3124) challenge.exe
Decrypted-URLs (4)http://kotob.top/dl/build2.exe$run
http://tzgl.org/fhsgtsspen6/get.php
http://tzgl.org/files/1/build3.exe$run
https://we.tl/t-NONb1QT9
Total events
11 797
Read events
11 632
Write events
133
Delete events
32

Modification events

(PID) Process:(1080) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Nla\Cache\Intranet
Operation:writeName:{4040CF00-1B3E-486A-B407-FA14C56B6FC0}
Value:
D4DA6D3F8867
(PID) Process:(2812) challenge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2812) challenge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2812) challenge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2812) challenge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2812) challenge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2812) challenge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2812) challenge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2812) challenge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2812) challenge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyServer
Value:
Executable files
1
Suspicious files
10
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
2812challenge.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:567FD41586EFF759D8231068F347CDA8
SHA256:C8A19CBB6B9518AE722A352FC915631A3A3420A581B4529F30B1980DCC77CAB2
1080svchost.exeC:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Cab3311.tmpcompressed
MD5:77B20B5CD41BC6BB475CCA3F91AE6E3C
SHA256:5511A9B9F9144ED7BDE4CCB074733B7C564D918D2A8B10D391AFC6BE5B3B1509
2812challenge.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:77B20B5CD41BC6BB475CCA3F91AE6E3C
SHA256:5511A9B9F9144ED7BDE4CCB074733B7C564D918D2A8B10D391AFC6BE5B3B1509
1080svchost.exeC:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Tar3312.tmpbinary
MD5:91A1B89AA7A488DBB204DBB4767F1F21
SHA256:F6BE95C88C20EF82EE8A6878E16F9ECD77300BC1905EB826592A0DD41AD1C0F8
2812challenge.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:4A90329071AE30B759D279CCA342B0A6
SHA256:4F544379EDA8E2653F71472AB968AEFD6B5D1F4B3CE28A5EDB14196184ED3B60
2812challenge.exeC:\Users\admin\AppData\Local\56363920-22ed-4f9b-9ebf-ae5fe264f43d\challenge.exeexecutable
MD5:A2F33095EF25B4D5B061EB53A7FE6548
SHA256:B0D41E9B8C941D207A0958B92F57083DD9B9246958BD32E2E6E90C4EE0E12419
2812challenge.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:0744955EE20726E7FA6C9CA6AE39B764
SHA256:5A302E81CBAA07E0A48EA837E89DDA41B6792739305912BE8293414FCEA1F466
1080svchost.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785binary
MD5:CD21D5FBCFA4B1DEC9492C792E338410
SHA256:4C018AE51D183B4911EA6CB9810660E46522CF8E2F190CC9E6D553BA50E25228
2812challenge.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\geo[1].jsontext
MD5:8FC980447A504B9D6396D381E6CB5B78
SHA256:DA7FAC8B5CD1685F63C4C8267FFD894BF83C15364288736E07AFAEC0D6F294FE
3124challenge.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\geo[1].jsontext
MD5:DB0126540B8B81AD14BF4A71A00D9D31
SHA256:6963E5DA5456E1367ED0E64C56479C3141E40AD688A59B03602D4AF35AFBD2A1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
10
DNS requests
6
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2812
challenge.exe
GET
200
208.89.74.27:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5e10f09bf6da9712
unknown
—
—
whitelisted
2812
challenge.exe
GET
200
216.58.206.35:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
2812
challenge.exe
GET
200
216.58.206.35:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2812
challenge.exe
104.21.112.1:443
api.2ip.ua
CLOUDFLARENET
—
whitelisted
2812
challenge.exe
208.89.74.27:80
ctldl.windowsupdate.com
—
US
whitelisted
2812
challenge.exe
216.58.206.35:80
c.pki.goog
GOOGLE
US
whitelisted
3124
challenge.exe
104.21.112.1:443
api.2ip.ua
CLOUDFLARENET
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.174
whitelisted
api.2ip.ua
  • 104.21.112.1
  • 104.21.96.1
  • 104.21.32.1
  • 104.21.80.1
  • 104.21.48.1
  • 104.21.64.1
  • 104.21.16.1
whitelisted
ctldl.windowsupdate.com
  • 208.89.74.27
  • 208.89.74.17
  • 208.89.74.23
  • 208.89.74.31
  • 208.89.74.21
  • 208.89.74.29
  • 208.89.74.19
whitelisted
c.pki.goog
  • 216.58.206.35
whitelisted
kotob.top
  • 127.0.0.1
unknown
tzgl.org
  • —
malicious

Threats

PID
Process
Class
Message
2812
challenge.exe
Potentially Bad Traffic
ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI)
1080
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Address Lookup DNS Query (2ip .ua)
3124
challenge.exe
Potentially Bad Traffic
ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI)
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
challenge.exe