File name:

Trojan-Ransom.Win32.HmBlocker.azp-2fb0e82639a4251e2edd7c5fe134fe20f6a50a1599b00b441b09e7076752be9d.7z

Full analysis: https://app.any.run/tasks/9efe9cf5-ac1f-4ec1-af4b-d90a106e12d9
Verdict: Malicious activity
Analysis date: April 19, 2025, 22:00:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

F46A07A6BDE8D74D099A23D1BFDE8A93

SHA1:

024B6026737FCD9D25AFFC81DC583C237BB2BC07

SHA256:

E2FAD368A00AA419A65CB406FB48B65D7CA1A8B84ACE54926E5371BE77840E93

SSDEEP:

768:Lbd8qrD1hjpR6f3jW9+GNtu0WcPH4Ry9vCdVA1kIqHZBOqhunJt7z1ot:fd1tp8f3pEHyA9EVARsb4Jt7Bot

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • reg.exe (PID: 2420)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Trojan-Ransom.Win32.HmBlocker.azp-2fb0e82639a4251e2edd7c5fe134fe20f6a50a1599b00b441b09e7076752be9d.exe (PID: 328)

    • Reads the Internet Settings

      • Trojan-Ransom.Win32.HmBlocker.azp-2fb0e82639a4251e2edd7c5fe134fe20f6a50a1599b00b441b09e7076752be9d.exe (PID: 328)
      • sipnotify.exe (PID: 288)

    • Starts CMD.EXE for commands execution

      • Trojan-Ransom.Win32.HmBlocker.azp-2fb0e82639a4251e2edd7c5fe134fe20f6a50a1599b00b441b09e7076752be9d.exe (PID: 328)

    • The system shut down or reboot

      • Trojan-Ransom.Win32.HmBlocker.azp-2fb0e82639a4251e2edd7c5fe134fe20f6a50a1599b00b441b09e7076752be9d.exe (PID: 328)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 2744)

    • The process executes via Task Scheduler

      • ctfmon.exe (PID: 1832)
      • sipnotify.exe (PID: 288)

  • INFO

    • Manual execution by a user

      • Trojan-Ransom.Win32.HmBlocker.azp-2fb0e82639a4251e2edd7c5fe134fe20f6a50a1599b00b441b09e7076752be9d.exe (PID: 328)
      • IMEKLMG.EXE (PID: 2144)
      • IMEKLMG.EXE (PID: 2152)
      • 1886015021.EXE (PID: 2172)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2840)

    • Reads the computer name

      • Trojan-Ransom.Win32.HmBlocker.azp-2fb0e82639a4251e2edd7c5fe134fe20f6a50a1599b00b441b09e7076752be9d.exe (PID: 328)
      • IMEKLMG.EXE (PID: 2152)
      • IMEKLMG.EXE (PID: 2144)
      • 1886015021.EXE (PID: 2172)

    • Checks supported languages

      • Trojan-Ransom.Win32.HmBlocker.azp-2fb0e82639a4251e2edd7c5fe134fe20f6a50a1599b00b441b09e7076752be9d.exe (PID: 328)
      • IMEKLMG.EXE (PID: 2152)
      • IMEKLMG.EXE (PID: 2144)
      • 1886015021.EXE (PID: 2172)

    • Process checks whether UAC notifications are on

      • IMEKLMG.EXE (PID: 2144)
      • IMEKLMG.EXE (PID: 2152)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
ModifyDate: 2012:06:14 17:19:26+00:00
ArchivedFileName: Trojan-Ransom.Win32.HmBlocker.azp-2fb0e82639a4251e2edd7c5fe134fe20f6a50a1599b00b441b09e7076752be9d.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
92
Monitored processes
10
Malicious processes
0
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe trojan-ransom.win32.hmblocker.azp-2fb0e82639a4251e2edd7c5fe134fe20f6a50a1599b00b441b09e7076752be9d.exe shutdown.exe no specs cmd.exe no specs reg.exe ctfmon.exe no specs sipnotify.exe imeklmg.exe no specs imeklmg.exe no specs 1886015021.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
288C:\Windows\system32\sipnotify.exe -LogonOrUnlockC:\Windows\System32\sipnotify.exe
taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
sipnotify
Exit code:
0
Version:
6.1.7602.20480 (win7sp1_ldr_escrow.191010-1716)
Modules
Images
c:\windows\system32\sipnotify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
328"C:\Users\admin\Desktop\Trojan-Ransom.Win32.HmBlocker.azp-2fb0e82639a4251e2edd7c5fe134fe20f6a50a1599b00b441b09e7076752be9d.exe" C:\Users\admin\Desktop\Trojan-Ransom.Win32.HmBlocker.azp-2fb0e82639a4251e2edd7c5fe134fe20f6a50a1599b00b441b09e7076752be9d.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
3221225786
Modules
Images
c:\users\admin\desktop\trojan-ransom.win32.hmblocker.azp-2fb0e82639a4251e2edd7c5fe134fe20f6a50a1599b00b441b09e7076752be9d.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
704"C:\Windows\System32\shutdown.exe" /R /T 04 /FC:\Windows\System32\shutdown.exe—Trojan-Ransom.Win32.HmBlocker.azp-2fb0e82639a4251e2edd7c5fe134fe20f6a50a1599b00b441b09e7076752be9d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Shutdown and Annotation Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\shutdown.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\secur32.dll
1832C:\Windows\System32\ctfmon.exe C:\Windows\System32\ctfmon.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CTF Loader
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msctfmonitor.dll
c:\windows\system32\msctf.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
2144"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /JPN /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
2152"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /KOR /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
2172"C:\Users\admin\1886015021\1886015021.EXE" C:\Users\admin\1886015021\1886015021.EXE—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\1886015021\1886015021.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2420rEg aDd HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v f18860150211886015021a1886015021 /d "C:\Users\admin\1886015021\1886015021.EXE" /FC:\Windows\System32\reg.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2744"C:\Windows\System32\cmd.exe" /C rEg aDd HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v f18860150211886015021a1886015021 /d "C:\Users\admin\1886015021\1886015021.EXE" /FC:\Windows\System32\cmd.exe—Trojan-Ransom.Win32.HmBlocker.azp-2fb0e82639a4251e2edd7c5fe134fe20f6a50a1599b00b441b09e7076752be9d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2840"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\Trojan-Ransom.Win32.HmBlocker.azp-2fb0e82639a4251e2edd7c5fe134fe20f6a50a1599b00b441b09e7076752be9d.7zC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
2 325
Read events
2 282
Write events
42
Delete events
1

Modification events

(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2840) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Trojan-Ransom.Win32.HmBlocker.azp-2fb0e82639a4251e2edd7c5fe134fe20f6a50a1599b00b441b09e7076752be9d.7z
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2840) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
1
Suspicious files
2
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
288sipnotify.exeC:\Users\admin\AppData\Local\Microsoft\Windows\SipNotify\eoscontent\en-us.htmlhtml
MD5:5001C5247AF7E35AC35ACE61B87E8040
SHA256:2920ED0DDFE475884703A5AE7B835F40398E509AA26B52A8DDD7F25DCD4B3D2E
288sipnotify.exeC:\Users\admin\AppData\Local\Microsoft\Windows\SipNotify\default.cabcompressed
MD5:340674F6A3D1562E28A011EC11E40D83
SHA256:259880E2346D986ABEED46AA9C2917C53E969AAE6927F2CA0A2AD0967736DF98
21721886015021.EXEC:\Users\admin\1886015021\ztext
MD5:CEE631121C2EC9232F3A2F028AD5C89B
SHA256:0604CD3138FEED202EF293E062DA2F4720F77A05D25EE036A7A01C9CFCDD1F0A
288sipnotify.exeC:\Users\admin\AppData\Local\Microsoft\Windows\SipNotify\eoscontent\script.jstext
MD5:A2682382967C351F7ED21762F9E5DE9E
SHA256:36B1D26F1EC69685648C0528C2FCE95A3C2DBECF828CDFA4A8B4239A15B644A2
2840WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2840.33044\Trojan-Ransom.Win32.HmBlocker.azp-2fb0e82639a4251e2edd7c5fe134fe20f6a50a1599b00b441b09e7076752be9d.exeexecutable
MD5:6783BAE7B65102AB0840CE24819060A3
SHA256:95BCBCF97C7E70ABBD5226E9C4835A0F481FCB69F653396A8AA7B0E67BAADC1A
288sipnotify.exeC:\Users\admin\AppData\Local\Microsoft\Windows\SipNotify\eoscontent\microsoft-logo.pngimage
MD5:B7C73A0CFBA68CC70C35EF9C63703CE4
SHA256:1D8B27A0266FF526CF95447F3701592A908848467D37C09A00A2516C1F29A013
288sipnotify.exeC:\Users\admin\AppData\Local\Microsoft\Windows\SipNotify\eoscontent\styles.csstext
MD5:3383EEF350240253D7C2C2564381B3CB
SHA256:85443493D86D6D7FB0E07BC9705DFC9C858086FBA1B0E508092AB328D5F145E8
21721886015021.EXEC:\Users\admin\1886015021\dtext
MD5:3D6CF41728C82A8A0701BB2DEA37CCD1
SHA256:62D21A51A17A0256FD332F744E40E2FF36E29FE897D18A46F106F9AB88F9701D
288sipnotify.exeC:\Users\admin\AppData\Local\Microsoft\Windows\SipNotify\eoscontent\main.jpgimage
MD5:C8BCC2041232DA45C1367F1FEED51370
SHA256:C0EC6771F923E7B85F6E2E7AA58D6BA51D322E78F53CEE8108DBBFD352BE7B25
288sipnotify.exeC:\Users\admin\AppData\Local\Microsoft\Windows\SipNotify\eoscontent\metadata.jsonbinary
MD5:253EDC8EC7674BD78293FF3B21866074
SHA256:51C3A033F0160A30C1773F1E5A9CD01AB018B151EDA1BB64D0226B2437106A56
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
15
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
288
sipnotify.exe
HEAD
503
104.82.90.147:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133895772656400000
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1088
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
1440
svchost.exe
239.255.255.250:3702
—
—
—
whitelisted
288
sipnotify.exe
104.82.90.147:80
query.prod.cms.rt.microsoft.com
Akamai International B.V.
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.23.110
whitelisted
query.prod.cms.rt.microsoft.com
  • 104.82.90.147
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Trojan-Ransom.Win32.HmBlocker.azp-2fb0e82639a4251e2edd7c5fe134fe20f6a50a1599b00b441b09e7076752be9d.7z