File name:

Trojan-Ransom.Win32.Agent.awnk-af53e36a62f237597b47d34349e40c16a3682a492fe7c320c7e834f6247e078a.7z

Full analysis: https://app.any.run/tasks/06df3f0f-b4cf-4f1b-a381-9d1d913a4198
Verdict: Malicious activity
Analysis date: May 02, 2025, 20:06:43
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

115BE82DAE1862A3BC92559AD9484178

SHA1:

A16C12D7CF17CBD029ECF6744BB0EB4D2825433C

SHA256:

B85B5A88659DD3D309026A949306065BE2E96991CC7EE34C3A479F0DDE5D25EE

SSDEEP:

24576:0eHiH1HdgMv2HioEzxvpA6qz7+A75LwbEysPkaoLLcCA+tOKmiu:0eHiH1H6MOHioEzBpMX+A75LwbEysPkI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 7152)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Trojan-Ransom.Win32.Agent.awnk-af53e36a62f237597b47d34349e40c16a3682a492fe7c320c7e834f6247e078a.exe (PID: 7740)

    • The process checks if it is being run in the virtual environment

      • Trojan-Ransom.Win32.Agent.awnk-af53e36a62f237597b47d34349e40c16a3682a492fe7c320c7e834f6247e078a.exe (PID: 7740)

    • Read disk information to detect sandboxing environments

      • Trojan-Ransom.Win32.Agent.awnk-af53e36a62f237597b47d34349e40c16a3682a492fe7c320c7e834f6247e078a.exe (PID: 7740)

    • Reads the BIOS version

      • Trojan-Ransom.Win32.Agent.awnk-af53e36a62f237597b47d34349e40c16a3682a492fe7c320c7e834f6247e078a.exe (PID: 7740)

    • Executes application which crashes

      • Trojan-Ransom.Win32.Agent.awnk-af53e36a62f237597b47d34349e40c16a3682a492fe7c320c7e834f6247e078a.exe (PID: 7740)

  • INFO

    • Checks supported languages

      • Trojan-Ransom.Win32.Agent.awnk-af53e36a62f237597b47d34349e40c16a3682a492fe7c320c7e834f6247e078a.exe (PID: 7740)

    • Manual execution by a user

      • Trojan-Ransom.Win32.Agent.awnk-af53e36a62f237597b47d34349e40c16a3682a492fe7c320c7e834f6247e078a.exe (PID: 7740)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7152)

    • Create files in a temporary directory

      • Trojan-Ransom.Win32.Agent.awnk-af53e36a62f237597b47d34349e40c16a3682a492fe7c320c7e834f6247e078a.exe (PID: 7740)

    • Reads the computer name

      • Trojan-Ransom.Win32.Agent.awnk-af53e36a62f237597b47d34349e40c16a3682a492fe7c320c7e834f6247e078a.exe (PID: 7740)

    • Reads the machine GUID from the registry

      • Trojan-Ransom.Win32.Agent.awnk-af53e36a62f237597b47d34349e40c16a3682a492fe7c320c7e834f6247e078a.exe (PID: 7740)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 7976)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
ModifyDate: 2020:09:07 12:11:28+00:00
ArchivedFileName: Trojan-Ransom.Win32.Agent.awnk-af53e36a62f237597b47d34349e40c16a3682a492fe7c320c7e834f6247e078a.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
135
Monitored processes
6
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe no specs trojan-ransom.win32.agent.awnk-af53e36a62f237597b47d34349e40c16a3682a492fe7c320c7e834f6247e078a.exe conhost.exe no specs werfault.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
7152"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\Trojan-Ransom.Win32.Agent.awnk-af53e36a62f237597b47d34349e40c16a3682a492fe7c320c7e834f6247e078a.7zC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7220C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7252"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7740"C:\Users\admin\Desktop\Trojan-Ransom.Win32.Agent.awnk-af53e36a62f237597b47d34349e40c16a3682a492fe7c320c7e834f6247e078a.exe" C:\Users\admin\Desktop\Trojan-Ransom.Win32.Agent.awnk-af53e36a62f237597b47d34349e40c16a3682a492fe7c320c7e834f6247e078a.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
ranet
Exit code:
3762504530
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\trojan-ransom.win32.agent.awnk-af53e36a62f237597b47d34349e40c16a3682a492fe7c320c7e834f6247e078a.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7752\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Trojan-Ransom.Win32.Agent.awnk-af53e36a62f237597b47d34349e40c16a3682a492fe7c320c7e834f6247e078a.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7976C:\WINDOWS\SysWOW64\WerFault.exe -u -p 7740 -s 1796C:\Windows\SysWOW64\WerFault.exe—Trojan-Ransom.Win32.Agent.awnk-af53e36a62f237597b47d34349e40c16a3682a492fe7c320c7e834f6247e078a.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
4 471
Read events
4 446
Write events
22
Delete events
3

Modification events

(PID) Process:(7152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Trojan-Ransom.Win32.Agent.awnk-af53e36a62f237597b47d34349e40c16a3682a492fe7c320c7e834f6247e078a.7z
(PID) Process:(7152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(7152) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
Executable files
4
Suspicious files
2
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
7976WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Trojan-Ransom.Wi_4bb5628fd583146b9e9f38391b4f513f1c7e7afd_aacdfb90_da37816a-a279-4c28-94e5-bc9cc3bd4bf2\Report.wer —
MD5:—
SHA256:—
7976WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\Trojan-Ransom.Win32.Agent.awnk-af53e36a62f237597b47d34349e40c16a3682a492fe7c320c7e834f6247e078a.exe.7740.dmp —
MD5:—
SHA256:—
7740Trojan-Ransom.Win32.Agent.awnk-af53e36a62f237597b47d34349e40c16a3682a492fe7c320c7e834f6247e078a.exeC:\Users\admin\AppData\Local\Temp\evbE850.tmpexecutable
MD5:FCAF8C87ED1894E1DFDFED942E5571DE
SHA256:18524A1F750900D03AF0DD9E77274D1B6AFF2C7B86E69817F899070318D7AB09
7976WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERF3CA.tmp.xmlxml
MD5:DF46AFF19A81561404FB1C324D6D6846
SHA256:DE3C298397B98A56EB87C3AF5BCECAE91B9892E614FF760F2A3CE5AF92F46D93
7976WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERF39A.tmp.WERInternalMetadata.xmlbinary
MD5:28BDCFE624C884BA6B598941DAFE3981
SHA256:D200450F2DDD0431BCCF45BA7B45387706B32A3AF249926D02DF64C6FBEF3C3C
7740Trojan-Ransom.Win32.Agent.awnk-af53e36a62f237597b47d34349e40c16a3682a492fe7c320c7e834f6247e078a.exeC:\Users\admin\AppData\Local\Temp\evbEF85.tmpexecutable
MD5:FCAF8C87ED1894E1DFDFED942E5571DE
SHA256:18524A1F750900D03AF0DD9E77274D1B6AFF2C7B86E69817F899070318D7AB09
7740Trojan-Ransom.Win32.Agent.awnk-af53e36a62f237597b47d34349e40c16a3682a492fe7c320c7e834f6247e078a.exeC:\Users\admin\AppData\Local\Temp\evbE840.tmpexecutable
MD5:FCAF8C87ED1894E1DFDFED942E5571DE
SHA256:18524A1F750900D03AF0DD9E77274D1B6AFF2C7B86E69817F899070318D7AB09
7152WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb7152.22409\Trojan-Ransom.Win32.Agent.awnk-af53e36a62f237597b47d34349e40c16a3682a492fe7c320c7e834f6247e078a.exeexecutable
MD5:76D274C823439CF02F18A0DECCFE70C5
SHA256:AF53E36A62F237597B47D34349E40C16A3682A492FE7C320C7E834F6247E078A
7976WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERF222.tmp.dmpbinary
MD5:0C8C3B2535BF844109F1D53ADD51F025
SHA256:797F9486ED660D596D63A2D0BD8986CCC8EBDC759E38656DA5AE99BDB6EECC79
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
16
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.155:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.155:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.48.23.155:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
2.16.253.202:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.32.136:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2112
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.110
whitelisted
crl.microsoft.com
  • 23.48.23.155
  • 23.48.23.153
  • 23.48.23.156
  • 23.48.23.158
  • 23.48.23.157
  • 23.48.23.148
  • 23.48.23.150
  • 23.48.23.151
  • 23.48.23.164
whitelisted
www.microsoft.com
  • 2.16.253.202
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 40.126.32.136
  • 40.126.32.76
  • 20.190.160.20
  • 20.190.160.66
  • 40.126.32.72
  • 20.190.160.4
  • 40.126.32.68
  • 20.190.160.22
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Trojan-Ransom.Win32.Agent.awnk-af53e36a62f237597b47d34349e40c16a3682a492fe7c320c7e834f6247e078a.7z