File name:

MLG Virus by pokeyoshi3 v2.rar

Full analysis: https://app.any.run/tasks/df6035f5-cc80-4939-b416-59aa4072e3be
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: May 09, 2020, 14:32:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

9D4E2F55B1E2736B7AC0CE39D046B508

SHA1:

C554D7D2CA1EEF1923B2E23B2768C35CF3041351

SHA256:

E3324C584228EF9CAC621DA89DFAA21567541549126958BD0CE885B1AB744E27

SSDEEP:

196608:7mAPNhXpHwubPrXDPUeDxxh7z4PBedRkCJjofaaBw5oZ6BNcRHhq34nPPhn:7NXnjD9Vb7zEBMaC9oZgoh/n1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • MLG.exe (PID: 180)
      • MLG.exe (PID: 3140)
      • MLG.exe (PID: 1340)
      • MLG.exe (PID: 1428)
      • MLG.exe (PID: 1880)
      • MLG.exe (PID: 3336)
      • MLG.exe (PID: 2132)
      • MLG.exe (PID: 1784)
      • MLG.exe (PID: 2192)
      • MLG.exe (PID: 3000)
      • MLG.exe (PID: 2112)
      • MLG.exe (PID: 2860)
      • MLG.exe (PID: 1352)
      • MLG.exe (PID: 3604)
      • MLG.exe (PID: 2244)
      • MLG.exe (PID: 740)

  • SUSPICIOUS

    • Changes the desktop background image

      • MLG.exe (PID: 1340)
      • MLG.exe (PID: 1428)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3104)

    • Creates files like Ransomware instruction

      • WinRAR.exe (PID: 3104)

  • INFO

    • Manual execution by user

      • MLG.exe (PID: 1340)
      • MLG.exe (PID: 1352)
      • MLG.exe (PID: 2132)
      • MLG.exe (PID: 1880)
      • MLG.exe (PID: 1428)
      • MLG.exe (PID: 3140)
      • MLG.exe (PID: 3336)
      • MLG.exe (PID: 2192)
      • MLG.exe (PID: 1784)
      • MLG.exe (PID: 3000)
      • MLG.exe (PID: 2112)
      • MLG.exe (PID: 2860)
      • MLG.exe (PID: 180)
      • NOTEPAD.EXE (PID: 3160)
      • MLG.exe (PID: 740)
      • MLG.exe (PID: 3604)
      • MLG.exe (PID: 2244)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

CompressedSize: 536
UncompressedSize: 756
OperatingSystem: Win32
ModifyDate: 2016:04:04 05:15:17
PackingMethod: Normal
ArchivedFileName: README.txt
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
75
Monitored processes
18
Malicious processes
15
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe notepad.exe no specs mlg.exe no specs mlg.exe no specs mlg.exe mlg.exe mlg.exe mlg.exe mlg.exe mlg.exe mlg.exe mlg.exe mlg.exe mlg.exe mlg.exe mlg.exe mlg.exe mlg.exe

Process information

PID
CMD
Path
Indicators
Parent process
180"C:\Users\admin\Desktop\MLG.exe" C:\Users\admin\Desktop\MLG.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
WindowsFormsApplication1
Exit code:
3762504530
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\mlg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
740"C:\Users\admin\Desktop\MLG.exe" C:\Users\admin\Desktop\MLG.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
WindowsFormsApplication1
Exit code:
3762504530
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\mlg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1340"C:\Users\admin\Desktop\MLG.exe" C:\Users\admin\Desktop\MLG.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
WindowsFormsApplication1
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\mlg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1352"C:\Users\admin\Desktop\MLG.exe" C:\Users\admin\Desktop\MLG.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
WindowsFormsApplication1
Exit code:
3762504530
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\mlg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1428"C:\Users\admin\Desktop\MLG.exe" C:\Users\admin\Desktop\MLG.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
WindowsFormsApplication1
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\mlg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1784"C:\Users\admin\Desktop\MLG.exe" C:\Users\admin\Desktop\MLG.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
WindowsFormsApplication1
Exit code:
3762504530
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\mlg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1880"C:\Users\admin\Desktop\MLG.exe" C:\Users\admin\Desktop\MLG.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
WindowsFormsApplication1
Exit code:
3762504530
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\mlg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2112"C:\Users\admin\Desktop\MLG.exe" C:\Users\admin\Desktop\MLG.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
WindowsFormsApplication1
Exit code:
3762504530
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\mlg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2132"C:\Users\admin\Desktop\MLG.exe" C:\Users\admin\Desktop\MLG.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
WindowsFormsApplication1
Exit code:
3762504530
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\mlg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2192"C:\Users\admin\Desktop\MLG.exe" C:\Users\admin\Desktop\MLG.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
WindowsFormsApplication1
Exit code:
3762504530
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\mlg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
740
Read events
708
Write events
32
Delete events
0

Modification events

(PID) Process:(3104) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3104) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3104) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3104) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12D\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(3104) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\MLG Virus by pokeyoshi3 v2.rar
(PID) Process:(3104) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3104) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3104) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3104) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3104) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12D\52C64B7E
Operation:writeName:@C:\Windows\system32\notepad.exe,-469
Value:
Text Document
Executable files
1
Suspicious files
0
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
3104WinRAR.exeC:\Users\admin\Desktop\README.txttext
MD5:02A69F9E1444A3BD315412D9AF32A3F9
SHA256:B905219E9BFFD8F22383CC73424273C5562F67EC175FCC0E85967B52DF03FD5A
3104WinRAR.exeC:\Users\admin\Desktop\MLG.exeexecutable
MD5:634728F2FE391F5369BF655CC7C2B482
SHA256:F6D1641642CEBCDBEF6BB2F110D0E3C6B592679D18F9DEA71AC484C518417EA8
1428MLG.exeC:\Users\admin\AppData\Local\Temp\wallpaper.bmpimage
MD5:E872957408CEA6C2C184194E0535CA06
SHA256:2B988A18EE5902767450BF0C0EA9E3AFEBD7F7690F57E083F0AB4705FD5463FE
1340MLG.exeC:\Users\admin\AppData\Local\Temp\wallpaper.bmpimage
MD5:E872957408CEA6C2C184194E0535CA06
SHA256:2B988A18EE5902767450BF0C0EA9E3AFEBD7F7690F57E083F0AB4705FD5463FE
1340MLG.exeC:\Users\admin\Desktop\bg.pngimage
MD5:97C0AEA63702E320DA9B2141C2B05322
SHA256:1480300097AC39FD997419D648EA463C7A511CF50C98E5CDFF151D674D9C63C5
1428MLG.exeC:\Users\admin\Desktop\bg.pngimage
MD5:97C0AEA63702E320DA9B2141C2B05322
SHA256:1480300097AC39FD997419D648EA463C7A511CF50C98E5CDFF151D674D9C63C5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
MLG Virus by pokeyoshi3 v2.rar