File name:

Encrypt.exe

Full analysis: https://app.any.run/tasks/938b9950-8242-418f-a7ef-bdabb9c46d7c
Verdict: Malicious activity
Threats:

Chaos ransomware is a malware family known for its destructive capabilities and diverse variants. It first appeared in 2021 as a ransomware builder and later acted as a wiper. Unlike most ransomware strains that encrypt data to extort payment, early Chaos variants permanently corrupted files, while later versions adopted more conventional encryption techniques.

Malware Trends Tracker     >>>
Analysis date: September 15, 2024, 10:12:53
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
dyndns
stealer
chaos
ransomware
crypto-regex
snake
keylogger
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

8728BA233FCB020A6A2EAABB90DF630C

SHA1:

C6DC576F2E0423E8A0F36BBA51FA7C65E1E281E7

SHA256:

B15052D17AFC1A01E83CDC0624DD268838237F8CD66FA12C56706BDEE8A61286

SSDEEP:

24576:53HzLnqOaNMCFJ6kPvOxrcg0i7uFCbU4+Il2L1ywdst:53HzLnqOaNMCFJ6kPvO1cg0i7rPmst

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • Encrypt.exe (PID: 3964)
      • svchost.exe (PID: 4540)

    • Connects to the CnC server

      • Synaptics.exe (PID: 5516)

    • Deletes shadow copies

      • cmd.exe (PID: 6848)
      • cmd.exe (PID: 1568)

    • Using BCDEDIT.EXE to modify recovery options

      • cmd.exe (PID: 2384)

    • Steals credentials from Web Browsers

      • svchost.exe (PID: 4540)

    • Create files in the Startup directory

      • svchost.exe (PID: 4540)

    • Actions looks like stealing of personal data

      • svchost.exe (PID: 4540)

    • Modifies files in the Chrome extension folder

      • svchost.exe (PID: 4540)

    • CHAOS has been detected (YARA)

      • svchost.exe (PID: 4540)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Encrypt.exe (PID: 3964)
      • Synaptics.exe (PID: 5516)
      • ._cache_Encrypt.exe (PID: 5732)
      • svchost.exe (PID: 4540)

    • Executable content was dropped or overwritten

      • Encrypt.exe (PID: 3964)
      • ._cache_Encrypt.exe (PID: 5732)

    • The process creates files with name similar to system file names

      • ._cache_Encrypt.exe (PID: 5732)
      • svchost.exe (PID: 4540)

    • Starts itself from another location

      • ._cache_Encrypt.exe (PID: 5732)

    • Reads the date of Windows installation

      • ._cache_Encrypt.exe (PID: 5732)
      • svchost.exe (PID: 4540)

    • Contacting a server suspected of hosting an CnC

      • Synaptics.exe (PID: 5516)

    • Starts CMD.EXE for commands execution

      • svchost.exe (PID: 4540)

    • Executes as Windows Service

      • VSSVC.exe (PID: 6344)
      • wbengine.exe (PID: 5880)
      • vds.exe (PID: 5548)

    • There is functionality for communication dyndns network (YARA)

      • Synaptics.exe (PID: 5516)

    • There is functionality for communication over UDP network (YARA)

      • Synaptics.exe (PID: 5516)

    • Found regular expressions for crypto-addresses (YARA)

      • svchost.exe (PID: 4540)

    • Start notepad (likely ransomware note)

      • svchost.exe (PID: 4540)

    • There is functionality for taking screenshot (YARA)

      • Synaptics.exe (PID: 5516)

    • Checks Windows Trust Settings

      • Synaptics.exe (PID: 5516)

  • INFO

    • Checks supported languages

      • Encrypt.exe (PID: 3964)
      • ._cache_Encrypt.exe (PID: 5732)
      • Synaptics.exe (PID: 5516)
      • svchost.exe (PID: 4540)

    • Reads the computer name

      • Encrypt.exe (PID: 3964)
      • ._cache_Encrypt.exe (PID: 5732)
      • Synaptics.exe (PID: 5516)
      • svchost.exe (PID: 4540)

    • The process uses the downloaded file

      • Encrypt.exe (PID: 3964)
      • ._cache_Encrypt.exe (PID: 5732)
      • svchost.exe (PID: 4540)

    • Process checks computer location settings

      • Encrypt.exe (PID: 3964)
      • ._cache_Encrypt.exe (PID: 5732)
      • svchost.exe (PID: 4540)

    • Creates files in the program directory

      • Encrypt.exe (PID: 3964)
      • Synaptics.exe (PID: 5516)
      • svchost.exe (PID: 4540)

    • Reads the machine GUID from the registry

      • ._cache_Encrypt.exe (PID: 5732)
      • svchost.exe (PID: 4540)
      • Synaptics.exe (PID: 5516)

    • Checks proxy server information

      • Synaptics.exe (PID: 5516)

    • Creates files or folders in the user directory

      • ._cache_Encrypt.exe (PID: 5732)
      • svchost.exe (PID: 4540)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 6904)
      • notepad.exe (PID: 6020)

    • Sends debugging messages

      • wbadmin.exe (PID: 4436)

    • Create files in a temporary directory

      • svchost.exe (PID: 4540)
      • Synaptics.exe (PID: 5516)

    • Reads Microsoft Office registry keys

      • svchost.exe (PID: 4540)

    • Reads the software policy settings

      • Synaptics.exe (PID: 5516)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Borland Delphi 7 (96.4)
.exe | Win32 Executable Delphi generic (2)
.exe | Win32 Executable (generic) (0.6)
.exe | Win16/32 Executable Delphi generic (0.3)
.exe | Generic Win/DOS Executable (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 629760
InitializedDataSize: 677888
UninitializedDataSize: -
EntryPoint: 0x9ab80
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
FileVersion: 1.0.0.0
FileDescription: 易语言程序
ProductName: 易语言程序
ProductVersion: 1.0.0.0
LegalCopyright: 作者版权所有 请尊重并使用正版
Comments: 本程序使用易语言编写(http://www.eyuyan.com)
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
147
Monitored processes
20
Malicious processes
5
Suspicious processes
2

Behavior graph

Click at the process to see the details
start encrypt.exe ._cache_encrypt.exe THREAT synaptics.exe THREAT svchost.exe cmd.exe no specs conhost.exe no specs vssadmin.exe no specs vssvc.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs bcdedit.exe no specs bcdedit.exe no specs cmd.exe no specs conhost.exe no specs wbadmin.exe wbengine.exe no specs vdsldr.exe no specs vds.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
752bcdedit /set {default} bootstatuspolicy ignoreallfailures C:\Windows\System32\bcdedit.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Boot Configuration Data Editor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\bcdedit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cryptsp.dll
1568"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quietC:\Windows\System32\cmd.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
2384"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled noC:\Windows\System32\cmd.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
2572C:\WINDOWS\System32\vdsldr.exe -EmbeddingC:\Windows\System32\vdsldr.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Virtual Disk Service Loader
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vdsldr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2720\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3908vssadmin delete shadows /all /quiet C:\Windows\System32\vssadmin.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3964"C:\Users\admin\Desktop\Encrypt.exe" C:\Users\admin\Desktop\Encrypt.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
易语言程序
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\encrypt.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4436wbadmin delete catalog -quietC:\Windows\System32\wbadmin.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Command Line Interface for Microsoft® BLB Backup
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4540"C:\Users\admin\AppData\Roaming\svchost.exe" C:\Users\admin\AppData\Roaming\svchost.exe
._cache_Encrypt.exe
User:
admin
Integrity Level:
HIGH
Description:
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
5140bcdedit /set {default} recoveryenabled noC:\Windows\System32\bcdedit.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Boot Configuration Data Editor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\bcdedit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cryptsp.dll
Total events
9 810
Read events
9 767
Write events
25
Delete events
18

Modification events

(PID) Process:(3964) Encrypt.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(3964) Encrypt.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:?????
Value:
C:\ProgramData\Synaptics\Synaptics.exe
(PID) Process:(4540) svchost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:UpdateTask
Value:
C:\Users\admin\AppData\Roaming\svchost.exe
(PID) Process:(752) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:delete keyName:(default)
Value:
(PID) Process:(752) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:writeName:Element
Value:
0000000000000000000000000000000006000000000000004800000000000000715E5C2FA985EB1190A89A9B763584210000000000000000745E5C2FA985EB1190A89A9B7635842100000000000000000000000000000000
(PID) Process:(752) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\12000002
Operation:delete keyName:(default)
Value:
(PID) Process:(752) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\12000002
Operation:writeName:Element
Value:
\EFI\Microsoft\Boot\bootmgfw.efi
(PID) Process:(752) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{5b970157-8568-11eb-b45c-806e6f6e6963}\Elements\11000001
Operation:delete keyName:(default)
Value:
(PID) Process:(752) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{5b970157-8568-11eb-b45c-806e6f6e6963}\Elements\11000001
Operation:writeName:Element
Value:
0000000000000000000000000000000006000000000000004800000000000000715E5C2FA985EB1190A89A9B763584210000000000000000745E5C2FA985EB1190A89A9B7635842100000000000000000000000000000000
(PID) Process:(752) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{5b970157-8568-11eb-b45c-806e6f6e6963}\Elements\12000002
Operation:delete keyName:(default)
Value:
Executable files
5
Suspicious files
642
Text files
909
Unknown types
0

Dropped files

PID
Process
Filename
Type
3964Encrypt.exeC:\ProgramData\Synaptics\Synaptics.exeexecutable
MD5:8728BA233FCB020A6A2EAABB90DF630C
SHA256:B15052D17AFC1A01E83CDC0624DD268838237F8CD66FA12C56706BDEE8A61286
3964Encrypt.exeC:\Users\admin\Desktop\._cache_Encrypt.exeexecutable
MD5:E7D91103647B76F121B854FE806F80E2
SHA256:04ED744D9643830FC5F0499203A6FDE506B5F2C89868695BFE179A8EDB3B28C0
3964Encrypt.exeC:\ProgramData\Synaptics\RCXAE49.tmpexecutable
MD5:B2B36F3E560521D53BD607DD291E3C08
SHA256:B950370DE86A4496DA5959653B7370C9A8FFA6481698D463997951F534442CF9
4540svchost.exeC:\$WinREAgent\RollbackInfo.ini.85h0binary
MD5:060E8A57F2B3274D5C19F54BF70CDE8D
SHA256:47E3FE9FC07CA94A43B6E462D8FC3C7F2A34229D99E1C5A176AB8B8BF66143EC
4540svchost.exeC:\$WinREAgent\RollbackInfo.inibinary
MD5:D1457B72C3FB323A2671125AEF3EAB5D
SHA256:8A8DE823D5ED3E12746A62EF169BCF372BE0CA44F0A1236ABC35DF05D96928E1
4540svchost.exeC:\$WinREAgent\read_it.txttext
MD5:76E381F78E94C35D358A4FC048D3AA37
SHA256:DB317B799B14715D1B26661DD60570FAA3B5C377656D490CD2697F78271C413F
4540svchost.exeC:\$WinREAgent\Backup\location.txtbinary
MD5:D1457B72C3FB323A2671125AEF3EAB5D
SHA256:8A8DE823D5ED3E12746A62EF169BCF372BE0CA44F0A1236ABC35DF05D96928E1
4540svchost.exeC:\$WinREAgent\Backup\ReAgent.xml.qx01binary
MD5:807FEA67330634EA401A5C760BA874A5
SHA256:D74A61712BF010ACE94B73323442B97A665194902CED05641F26CFBE43372F0B
4540svchost.exeC:\$WinREAgent\Backup\ReAgent.xmlbinary
MD5:D1457B72C3FB323A2671125AEF3EAB5D
SHA256:8A8DE823D5ED3E12746A62EF169BCF372BE0CA44F0A1236ABC35DF05D96928E1
4540svchost.exeC:\Recovery\ReAgentOld.xml.lbu4binary
MD5:A36026223D073960C2971C14982EC9E8
SHA256:E1B7DEAAEC860C3281B19E7DCB43A4FCE4BB638FD69CA6EE6D23F7300B4251E7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
22
DNS requests
10
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6880
RUXIMICS.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
303
74.125.133.84:443
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
unknown
—
—
—
2120
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
303
74.125.133.84:443
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
unknown
—
—
—
—
—
GET
303
74.125.133.84:443
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
unknown
—
—
—
5516
Synaptics.exe
GET
200
69.42.215.252:80
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
unknown
—
—
whitelisted
—
—
GET
404
216.58.212.161:443
https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
unknown
html
1.61 Kb
—
—
—
GET
404
216.58.212.161:443
https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
unknown
html
1.61 Kb
—
—
—
GET
404
216.58.212.161:443
https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
unknown
html
1.61 Kb
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
7056
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6880
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5516
Synaptics.exe
69.42.215.252:80
freedns.afraid.org
AWKNET
US
whitelisted
7056
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2256
svchost.exe
224.0.0.251:5353
—
—
—
unknown
6880
RUXIMICS.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
  • 20.73.194.208
whitelisted
google.com
  • 172.217.18.14
whitelisted
xred.mooo.com
  • —
whitelisted
freedns.afraid.org
  • 69.42.215.252
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
docs.google.com
  • 142.250.186.46
shared
drive.usercontent.google.com
  • 142.250.186.33
whitelisted

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to Abused Domain *.mooo.com
—
—
A Network Trojan was detected
ET MALWARE Win32/SnakeKeyLogger Payload Request (GET)
—
—
A Network Trojan was detected
ET HUNTING Suspicious User-Agent Containing .exe
—
—
A Network Trojan was detected
ET HUNTING Suspicious User-Agent Containing .exe
—
—
A Network Trojan was detected
ET HUNTING Suspicious User-Agent Containing .exe
—
—
A Network Trojan was detected
ET HUNTING Suspicious User-Agent Containing .exe
—
—
A Network Trojan was detected
ET HUNTING Suspicious User-Agent Containing .exe
—
—
A Network Trojan was detected
ET HUNTING Suspicious User-Agent Containing .exe
3 ETPRO signatures available at the full report
Process
Message
wbadmin.exe
Invalid parameter passed to C runtime function.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Encrypt.exe