File name:

2025-01-10_eb12a4e10b158809d6655977ade7d9f5_bkransomware_floxif

Full analysis: https://app.any.run/tasks/3d0210bc-b54b-4991-95ca-0e1f8b76a670
Verdict: Malicious activity
Analysis date: January 10, 2025, 18:17:47
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

EB12A4E10B158809D6655977ADE7D9F5

SHA1:

6BA15AC48E6A6ABD26D54D877D7722078D8EAF18

SHA256:

D89A95E276692F1B4D4F4CE78F027E9E9FF7992283F1F5A27BFE8078595F13B4

SSDEEP:

98304:+o+twheJ2PbOmaREeAVWxOPoTkbrUzhs+D50:/QW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • 2025-01-10_eb12a4e10b158809d6655977ade7d9f5_bkransomware_floxif.exe (PID: 440)
      • 2025-01-10_eb12a4e10b158809d6655977ade7d9f5_bkransomware_floxif.exe (PID: 2828)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 2025-01-10_eb12a4e10b158809d6655977ade7d9f5_bkransomware_floxif.exe (PID: 2828)

    • Process drops legitimate windows executable

      • 2025-01-10_eb12a4e10b158809d6655977ade7d9f5_bkransomware_floxif.exe (PID: 2828)

  • INFO

    • Creates files in the program directory

      • 2025-01-10_eb12a4e10b158809d6655977ade7d9f5_bkransomware_floxif.exe (PID: 2828)

    • Checks supported languages

      • 2025-01-10_eb12a4e10b158809d6655977ade7d9f5_bkransomware_floxif.exe (PID: 2828)

    • The sample compiled with english language support

      • 2025-01-10_eb12a4e10b158809d6655977ade7d9f5_bkransomware_floxif.exe (PID: 2828)

    • Reads the computer name

      • 2025-01-10_eb12a4e10b158809d6655977ade7d9f5_bkransomware_floxif.exe (PID: 2828)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (54.3)
.exe | Win64 Executable (generic) (34.8)
.exe | Win32 Executable (generic) (5.6)
.exe | Generic Win/DOS Executable (2.5)
.exe | DOS Executable Generic (2.5)

EXIF

EXE

ProductVersion: 11.0.0.4
FileVersion: 11.0.0.4
ProductName: Setup
OriginalFileName: Setup.exe
LegalTrademarks: Setup is a registered trademark of Hancom Inc.
LegalCopyright: Copyright 1989. Hancom Inc. All rights reserved
CompanyName: Hancom Inc.
InternalName: Setup.exe
FileDescription: Setup
Comments: Setup
CharacterSet: Unicode
LanguageCode: Process default
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 11.0.0.4
FileVersionNumber: 11.0.0.4
Subsystem: Windows GUI
SubsystemVersion: 5.1
ImageVersion: -
OSVersion: 5.1
EntryPoint: 0x12e27e
UninitializedDataSize: -
InitializedDataSize: 1824768
CodeSize: 1408512
LinkerVersion: 12
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit
TimeStamp: 2019:12:09 09:25:37+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
112
Monitored processes
2
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 2025-01-10_eb12a4e10b158809d6655977ade7d9f5_bkransomware_floxif.exe no specs 2025-01-10_eb12a4e10b158809d6655977ade7d9f5_bkransomware_floxif.exe

Process information

PID
CMD
Path
Indicators
Parent process
440"C:\Users\admin\Desktop\2025-01-10_eb12a4e10b158809d6655977ade7d9f5_bkransomware_floxif.exe" C:\Users\admin\Desktop\2025-01-10_eb12a4e10b158809d6655977ade7d9f5_bkransomware_floxif.exe—explorer.exe
User:
admin
Company:
Hancom Inc.
Integrity Level:
MEDIUM
Description:
Setup
Exit code:
3221226540
Version:
11.0.0.4
Modules
Images
c:\users\admin\desktop\2025-01-10_eb12a4e10b158809d6655977ade7d9f5_bkransomware_floxif.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
2828"C:\Users\admin\Desktop\2025-01-10_eb12a4e10b158809d6655977ade7d9f5_bkransomware_floxif.exe" C:\Users\admin\Desktop\2025-01-10_eb12a4e10b158809d6655977ade7d9f5_bkransomware_floxif.exe
explorer.exe
User:
admin
Company:
Hancom Inc.
Integrity Level:
HIGH
Description:
Setup
Exit code:
0
Version:
11.0.0.4
Modules
Images
c:\users\admin\desktop\2025-01-10_eb12a4e10b158809d6655977ade7d9f5_bkransomware_floxif.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
13
Read events
13
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
28282025-01-10_eb12a4e10b158809d6655977ade7d9f5_bkransomware_floxif.exeC:\Program Files\Common Files\System\symsrv.dllexecutable
MD5:7574CF2C64F35161AB1292E2F532AABF
SHA256:DE055A89DE246E629A8694BDE18AF2B1605E4B9B493C7E4AEF669DD67ACF5085
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
16
DNS requests
3
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
google.com
  • 142.250.185.238
whitelisted
self.events.data.microsoft.com
  • 20.42.73.30
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-01-10_eb12a4e10b158809d6655977ade7d9f5_bkransomware_floxif