File name:

eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe

Full analysis: https://app.any.run/tasks/82473257-55ed-4396-9433-f5ac9f5bd406
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: May 23, 2024, 09:15:07
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
ransomware
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (console) x86-64, for MS Windows
MD5:

733A762B6D42C5DA00EBFBE66AD74EF9

SHA1:

F3C60EA82D5F2BD27C77E5645BBD352F3B0043B9

SHA256:

EB58CBFCA307A9D3CFE718D772F7A53079DB87BC8936023D6B7ADB8CF7206711

SSDEEP:

98304:tpUOHSJJ5w5SgxpnaOhGZSC2rliLjK2bCwYpW5q9in+YGlE8FPJW8NrHj18Ikqcr:

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe (PID: 5036)

    • Deletes shadow copies

      • eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe (PID: 5036)

    • Renames files like ransomware

      • eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe (PID: 5036)

  • SUSPICIOUS

    • Uses TASKKILL.EXE to kill Office Apps

      • eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe (PID: 5036)

    • Uses TASKKILL.EXE to kill process

      • eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe (PID: 5036)

    • Creates file in the systems drive root

      • eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe (PID: 5036)

  • INFO

    • Checks supported languages

      • eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe (PID: 5036)

    • Creates files in the program directory

      • eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe (PID: 5036)

    • Creates files or folders in the user directory

      • eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe (PID: 5036)

    • Reads the computer name

      • eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe (PID: 5036)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 3
CodeSize: 1138176
InitializedDataSize: 76288
UninitializedDataSize: -
EntryPoint: 0x65c40
OSVersion: 6.1
ImageVersion: 1
SubsystemVersion: 6.1
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
146
Monitored processes
22
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe no specs conhost.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs vssadmin.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
428taskkill /f /im sql.exeC:\Windows\System32\taskkill.exe—eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
472\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1512taskkill /f /im dbsnmp.exeC:\Windows\System32\taskkill.exe—eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1616taskkill /f /im winword.exeC:\Windows\System32\taskkill.exe—eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3608taskkill /f /im outlook.exeC:\Windows\System32\taskkill.exe—eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3912taskkill /f /im steam.exeC:\Windows\System32\taskkill.exe—eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4024taskkill /f /im thunderbird.exeC:\Windows\System32\taskkill.exe—eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4416taskkill /f /im onenote.exeC:\Windows\System32\taskkill.exe—eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4432vssadmin delete shadows /all /quietC:\Windows\System32\vssadmin.exe—eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4500taskkill /f /im wordpad.exeC:\Windows\System32\taskkill.exe—eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
2 677
Read events
2 677
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
47
Text files
48
Unknown types
2

Dropped files

PID
Process
Filename
Type
5036eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exeC:\ProgramData\ВОССТАНОВИТЬ ФАЙЛЫ.txt —
MD5:—
SHA256:—
5036eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exeC:\Users\Default\AppData\Local\Microsoft\Windows\INetCookies\ВОССТАНОВИТЬ ФАЙЛЫ.txt —
MD5:—
SHA256:—
5036eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exeC:\Users\Default\Pictures\ВОССТАНОВИТЬ ФАЙЛЫ.txt —
MD5:—
SHA256:—
5036eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exeC:\Users\Default\Videos\ВОССТАНОВИТЬ ФАЙЛЫ.txt —
MD5:—
SHA256:—
5036eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exeC:\Users\Default\Documents\ВОССТАНОВИТЬ ФАЙЛЫ.txt —
MD5:—
SHA256:—
5036eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exeC:\Users\Default\Music\ВОССТАНОВИТЬ ФАЙЛЫ.txttext
MD5:2B26A07BE5F798730B0922D21666764C
SHA256:DE9283CE34C53E0C1AFE4BE38F4D22C8FBF9800A2539085827CDCB769E4373F8
5036eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exeC:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\ВОССТАНОВИТЬ ФАЙЛЫ.txttext
MD5:2B26A07BE5F798730B0922D21666764C
SHA256:DE9283CE34C53E0C1AFE4BE38F4D22C8FBF9800A2539085827CDCB769E4373F8
5036eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exeC:\Users\admin\Desktop\workset.rtf.locktext
MD5:4615C2706D2BFEE4CF7CEC68EC1364A6
SHA256:D29EE472D77E47E34B1F5BA66D52B2F422ABF97264853E0406ACD4261129B6F4
5036eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exeC:\Users\admin\Desktop\thingscomponents.rtf.locktext
MD5:06DC2E1FAD92E2D02B5C8B7FC29CE677
SHA256:860045E8B192920F88BE04534909EA702FC082A0F2330D644620669334B24B9C
5036eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exeC:\Users\admin\Desktop\viewsexchange.jpg.lockimage
MD5:23B8B879668498CD953920FB1B8C9CF2
SHA256:ACF3299E690C03511F66B3ABE9DE3FBCFADA637A3B777AB6665CBF4DE6CD02E8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
46
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2392
svchost.exe
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
2392
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
4680
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
—
—
unknown
5260
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
4196
SIHClient.exe
GET
200
88.221.125.143:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
4196
SIHClient.exe
GET
200
88.221.125.143:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
239.255.255.250:1900
—
—
—
unknown
—
—
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5612
RUXIMICS.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5140
MoUsoCoreWorker.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2392
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2392
svchost.exe
2.16.164.120:80
crl.microsoft.com
Akamai International B.V.
NL
unknown
2392
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
5140
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 2.16.164.120
  • 2.16.164.72
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 88.221.125.143
whitelisted
www.bing.com
  • 2.19.96.66
  • 2.19.96.75
  • 2.19.96.82
  • 2.19.96.83
  • 2.19.96.73
  • 2.19.96.65
  • 2.19.96.67
  • 2.19.96.74
  • 2.19.96.58
whitelisted
r.bing.com
  • 2.19.96.73
  • 2.19.96.75
  • 2.19.96.82
  • 2.19.96.58
  • 2.19.96.67
  • 2.19.96.65
  • 2.19.96.66
  • 2.19.96.83
  • 2.19.96.74
whitelisted
login.live.com
  • 20.190.159.23
  • 40.126.31.71
  • 40.126.31.67
  • 20.190.159.0
  • 20.190.159.2
  • 20.190.159.4
  • 20.190.159.71
  • 40.126.31.69
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 23.43.62.58
  • 184.28.89.167
whitelisted
slscr.update.microsoft.com
  • 40.68.123.157
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe