| File name: | file072b.7z |
| Full analysis: | https://app.any.run/tasks/5f52db5a-4180-4e1b-8655-ad10da0e468b |
| Verdict: | Malicious activity |
| Threats: | Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying. |
| Analysis date: | June 21, 2025, 20:53:09 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-7z-compressed |
| File info: | 7-zip archive data, version 0.4 |
| MD5: | B96F547EFDA38CEFB122E40B50F8694E |
| SHA1: | F35F60E4835FF77F96145F04A848F118115647BE |
| SHA256: | E1A7E224A15AB3A4BF97EC56DF29F385AE714436CEEF9D0AE00282B827419830 |
| SSDEEP: | 1536:3Lq1G9sBTttA38/Ii1kTbr7fg1YkEOOvG6DZ:7q1PTttAMBerzYYkOFDZ |
MALICIOUS
LOCKY has been detected (SURICATA)
- locky_dump_final_nou.exe (PID: 3112)
Connects to the CnC server
- locky_dump_final_nou.exe (PID: 3112)
SUSPICIOUS
Reads the Internet Settings
- locky_dump_final_nou.exe (PID: 3112)
There is functionality for taking screenshot (YARA)
- locky_dump_final_nou.exe (PID: 3112)
Reads security settings of Internet Explorer
- locky_dump_final_nou.exe (PID: 3112)
Connects to the server without a host name
- locky_dump_final_nou.exe (PID: 3112)
Contacting a server suspected of hosting an CnC
- locky_dump_final_nou.exe (PID: 3112)
INFO
Executable content was dropped or overwritten
- WinRAR.exe (PID: 1396)
- firefox.exe (PID: 1568)
Manual execution by a user
- locky_dump_final_nou.exe (PID: 3112)
- firefox.exe (PID: 2332)
Checks supported languages
- locky_dump_final_nou.exe (PID: 3112)
Reads the computer name
- locky_dump_final_nou.exe (PID: 3112)
Checks proxy server information
- locky_dump_final_nou.exe (PID: 3112)
Application launched itself
- firefox.exe (PID: 2332)
- firefox.exe (PID: 1568)
The sample compiled with english language support
- firefox.exe (PID: 1568)
Reads the machine GUID from the registry
- locky_dump_final_nou.exe (PID: 3112)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .7z | | | 7-Zip compressed archive (v0.4) (57.1) |
|---|---|---|
| .7z | | | 7-Zip compressed archive (gen) (42.8) |
EXIF
ZIP
| FileVersion: | 7z v0.04 |
|---|---|
| ModifyDate: | 2016:03:16 07:12:39+00:00 |
| ArchivedFileName: | locky_dump_final_nou.mem |
Total processes
50
Monitored processes
13
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 392 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1568.4.1836328623\2021087542" -childID 3 -isForBrowser -prefsHandle 3432 -prefMapHandle 3440 -prefsLen 29245 -prefMapSize 244371 -jsInitHandle 920 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8ae0c595-7fde-44ca-badb-b118a0c8770c} 1568 "\\.\pipe\gecko-crash-server-pipe.1568" 3388 13eb3b20 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 115.0.2 Modules
| |||||||||||||||
| 1080 | C:\Windows\system32\svchost.exe -k NetworkService | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1236 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1568.0.927873167\1367460910" -parentBuildID 20230710165010 -prefsHandle 1128 -prefMapHandle 1120 -prefsLen 28739 -prefMapSize 244371 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a67b065-7d1a-4e5b-a0bb-dcb35464b260} 1568 "\\.\pipe\gecko-crash-server-pipe.1568" 1216 deb25e0 gpu | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 115.0.2 Modules
| |||||||||||||||
| 1396 | "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\file072b.7z | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 1568 | "C:\Program Files\Mozilla Firefox\firefox.exe" | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | ||||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 115.0.2 Modules
| |||||||||||||||
| 1656 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1568.6.1406005473\1640608101" -childID 5 -isForBrowser -prefsHandle 3696 -prefMapHandle 3692 -prefsLen 29245 -prefMapSize 244371 -jsInitHandle 920 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {95b93bc8-c8f2-4c76-a9f5-2e907cfbda98} 1568 "\\.\pipe\gecko-crash-server-pipe.1568" 3708 1920e6d0 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 115.0.2 Modules
| |||||||||||||||
| 2088 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1568.2.543860801\1794677536" -childID 1 -isForBrowser -prefsHandle 1900 -prefMapHandle 1896 -prefsLen 28928 -prefMapSize 244371 -jsInitHandle 920 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ee874bee-2e0f-41d4-92f6-ada09fc47e6d} 1568 "\\.\pipe\gecko-crash-server-pipe.1568" 1912 12e616d0 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 115.0.2 Modules
| |||||||||||||||
| 2124 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1568.3.584766967\527381799" -childID 2 -isForBrowser -prefsHandle 2556 -prefMapHandle 2552 -prefsLen 34441 -prefMapSize 244371 -jsInitHandle 920 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {83766571-9b3d-44e3-866e-32ce4b9916ee} 1568 "\\.\pipe\gecko-crash-server-pipe.1568" 2568 167883f0 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 115.0.2 Modules
| |||||||||||||||
| 2332 | "C:\Program Files\Mozilla Firefox\firefox.exe" | C:\Program Files\Mozilla Firefox\firefox.exe | — | explorer.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 3112 | "C:\Users\admin\Desktop\locky_dump_final_nou.exe" | C:\Users\admin\Desktop\locky_dump_final_nou.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Modules
| |||||||||||||||
Total events
14 333
Read events
14 205
Write events
117
Delete events
11
Modification events
| (PID) Process: | (1396) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (1396) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (1396) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (1396) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
| (PID) Process: | (1396) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip | |||
| (PID) Process: | (1396) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (1396) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\file072b.7z | |||
| (PID) Process: | (1396) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (1396) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (1396) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
Executable files
5
Suspicious files
257
Text files
32
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1568 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin | — | |
MD5:— | SHA256:— | |||
| 1568 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-child-current.bin | binary | |
MD5:52EA35F57515A3241A44674C6D3D4E12 | SHA256:848A66A16F892F72EBB309C95154D18DE244044F995D85A4406E07B463B073CA | |||
| 1568 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmp | binary | |
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A | SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA | |||
| 1396 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb1396.465\locky_dump_final_nou.mem | executable | |
MD5:5ECAE43C683D9615FB60375CBAD5E1D2 | SHA256:AA7D54EB5BACDE9C5977B2BB21011263B0B7CB90C07808F0FDAFD60B790C40A0 | |||
| 1568 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
| 1568 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache-current.bin | binary | |
MD5:04BADC0A17F546BBD91CC2404D2776D9 | SHA256:54CD83D3031D15EA1F5B1C5D73416C0B2F9151F93E130DD525DDA488A8EB9110 | |||
| 1568 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json | binary | |
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A | SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA | |||
| 1568 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite | — | |
MD5:— | SHA256:— | |||
| 1568 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.js | text | |
MD5:C4BC0AC8EB2112D4DDF84A888A435600 | SHA256:67FF8170F8C5D83534990AC9EC8804F619820646E5B8B3F8BDC3D4974034061D | |||
| 1568 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
24
TCP/UDP connections
63
DNS requests
134
Threats
7
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1568 | firefox.exe | POST | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/ | unknown | — | — | whitelisted |
3112 | locky_dump_final_nou.exe | POST | 307 | 188.127.231.116:80 | http://188.127.231.116/main.php | unknown | — | — | malicious |
1568 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt?ipv4 | unknown | — | — | whitelisted |
3112 | locky_dump_final_nou.exe | POST | — | 78.40.108.39:80 | http://78.40.108.39/main.php | unknown | — | — | malicious |
3112 | locky_dump_final_nou.exe | POST | 307 | 188.127.231.116:80 | http://188.127.231.116/main.php | unknown | — | — | malicious |
3112 | locky_dump_final_nou.exe | POST | — | 78.40.108.39:80 | http://78.40.108.39/main.php | unknown | — | — | malicious |
1568 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/canonical.html | unknown | — | — | whitelisted |
1568 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt?ipv4 | unknown | — | — | whitelisted |
1568 | firefox.exe | POST | 200 | 184.24.77.48:80 | http://r11.o.lencr.org/ | unknown | — | — | whitelisted |
1568 | firefox.exe | POST | 200 | 142.250.185.67:80 | http://o.pki.goog/s/wr3/FIY | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 224.0.0.252:5355 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3112 | locky_dump_final_nou.exe | 78.40.108.39:80 | — | PS Internet Company LLC | KZ | malicious |
3112 | locky_dump_final_nou.exe | 51.255.107.10:80 | — | OVH SAS | FR | unknown |
3112 | locky_dump_final_nou.exe | 51.254.181.122:80 | — | OVH SAS | FR | unknown |
3112 | locky_dump_final_nou.exe | 51.255.107.8:80 | — | OVH SAS | FR | unknown |
3112 | locky_dump_final_nou.exe | 188.127.231.116:80 | — | LLC Smart Ape | EE | malicious |
1568 | firefox.exe | 34.107.221.82:80 | detectportal.firefox.com | GOOGLE | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
dns.msftncsi.com |
| whitelisted |
wpjrxfdnsjb.tf |
| unknown |
gnifbwpqx.pw |
| unknown |
bwfnrg.ru |
| unknown |
dqmikncgqkihlqa.us |
| unknown |
xarhtenicxmm.pw |
| unknown |
hxmsgrefta.it |
| unknown |
jynsubrh.tf |
| unknown |
eirwi.nl |
| unknown |
Threats
PID | Process | Class | Message |
|---|---|---|---|
3112 | locky_dump_final_nou.exe | Malware Command and Control Activity Detected | ET MALWARE Ransomware Locky CnC Beacon |
3112 | locky_dump_final_nou.exe | Malware Command and Control Activity Detected | ET MALWARE Ransomware Locky CnC Beacon |
1080 | svchost.exe | Potentially Bad Traffic | ET DNS Query to a *.pw domain - Likely Hostile |
1080 | svchost.exe | Potentially Bad Traffic | ET DNS Query to a *.pw domain - Likely Hostile |
3112 | locky_dump_final_nou.exe | Malware Command and Control Activity Detected | ET MALWARE Ransomware Locky CnC Beacon |
3112 | locky_dump_final_nou.exe | Malware Command and Control Activity Detected | ET MALWARE Ransomware Locky CnC Beacon |
3112 | locky_dump_final_nou.exe | Malware Command and Control Activity Detected | ET MALWARE Ransomware Locky CnC Beacon |