File name:

eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe

Full analysis: https://app.any.run/tasks/82473257-55ed-4396-9433-f5ac9f5bd406
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: May 23, 2024, 09:15:07
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
ransomware
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (console) x86-64, for MS Windows
MD5:

733A762B6D42C5DA00EBFBE66AD74EF9

SHA1:

F3C60EA82D5F2BD27C77E5645BBD352F3B0043B9

SHA256:

EB58CBFCA307A9D3CFE718D772F7A53079DB87BC8936023D6B7ADB8CF7206711

SSDEEP:

98304:tpUOHSJJ5w5SgxpnaOhGZSC2rliLjK2bCwYpW5q9in+YGlE8FPJW8NrHj18Ikqcr:

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe (PID: 5036)

    • Deletes shadow copies

      • eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe (PID: 5036)

    • Renames files like ransomware

      • eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe (PID: 5036)

  • SUSPICIOUS

    • Uses TASKKILL.EXE to kill Office Apps

      • eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe (PID: 5036)

    • Creates file in the systems drive root

      • eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe (PID: 5036)

    • Uses TASKKILL.EXE to kill process

      • eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe (PID: 5036)

  • INFO

    • Checks supported languages

      • eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe (PID: 5036)

    • Reads the computer name

      • eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe (PID: 5036)

    • Creates files in the program directory

      • eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe (PID: 5036)

    • Creates files or folders in the user directory

      • eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe (PID: 5036)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 3
CodeSize: 1138176
InitializedDataSize: 76288
UninitializedDataSize: -
EntryPoint: 0x65c40
OSVersion: 6.1
ImageVersion: 1
SubsystemVersion: 6.1
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
146
Monitored processes
22
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe no specs conhost.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs vssadmin.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
428taskkill /f /im sql.exeC:\Windows\System32\taskkill.exe—eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
472\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1512taskkill /f /im dbsnmp.exeC:\Windows\System32\taskkill.exe—eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1616taskkill /f /im winword.exeC:\Windows\System32\taskkill.exe—eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3608taskkill /f /im outlook.exeC:\Windows\System32\taskkill.exe—eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3912taskkill /f /im steam.exeC:\Windows\System32\taskkill.exe—eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4024taskkill /f /im thunderbird.exeC:\Windows\System32\taskkill.exe—eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4416taskkill /f /im onenote.exeC:\Windows\System32\taskkill.exe—eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4432vssadmin delete shadows /all /quietC:\Windows\System32\vssadmin.exe—eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Command Line Interface for Microsoft® Volume Shadow Copy Service
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4500taskkill /f /im wordpad.exeC:\Windows\System32\taskkill.exe—eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
2 677
Read events
2 677
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
47
Text files
48
Unknown types
2

Dropped files

PID
Process
Filename
Type
5036eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exeC:\ProgramData\ВОССТАНОВИТЬ ФАЙЛЫ.txt —
MD5:—
SHA256:—
5036eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exeC:\Users\Default\AppData\Local\Microsoft\Windows\INetCookies\ВОССТАНОВИТЬ ФАЙЛЫ.txt —
MD5:—
SHA256:—
5036eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exeC:\Users\Default\Pictures\ВОССТАНОВИТЬ ФАЙЛЫ.txt —
MD5:—
SHA256:—
5036eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exeC:\Users\Default\Videos\ВОССТАНОВИТЬ ФАЙЛЫ.txt —
MD5:—
SHA256:—
5036eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exeC:\Users\Default\Documents\ВОССТАНОВИТЬ ФАЙЛЫ.txt —
MD5:—
SHA256:—
5036eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exeC:\Users\Public\Videos\ВОССТАНОВИТЬ ФАЙЛЫ.txttext
MD5:2B26A07BE5F798730B0922D21666764C
SHA256:DE9283CE34C53E0C1AFE4BE38F4D22C8FBF9800A2539085827CDCB769E4373F8
5036eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exeC:\Users\admin\Desktop\augustf.rtf.locktext
MD5:281795F452684DD73ECDA0204EB3B81C
SHA256:E346906A0E4C77D762E04FB11A49140107CEE20E14CABAD93C1922563A8B91D0
5036eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exeC:\Users\admin\AppData\Roaming\ВОССТАНОВИТЬ ФАЙЛЫ.txttext
MD5:2B26A07BE5F798730B0922D21666764C
SHA256:DE9283CE34C53E0C1AFE4BE38F4D22C8FBF9800A2539085827CDCB769E4373F8
5036eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exeC:\Users\admin\Desktop\playersleather.rtf.locktext
MD5:B539C94383DC6E8CF657828B0A1BC83A
SHA256:6EC287C3AB11116E5FD0CF3E0993BFBA925603194571910A6DE8C7611B1E0C13
5036eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exeC:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\ВОССТАНОВИТЬ ФАЙЛЫ.txttext
MD5:2B26A07BE5F798730B0922D21666764C
SHA256:DE9283CE34C53E0C1AFE4BE38F4D22C8FBF9800A2539085827CDCB769E4373F8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
46
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2392
svchost.exe
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
2392
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
4680
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
—
—
unknown
5260
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
4196
SIHClient.exe
GET
200
88.221.125.143:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
4196
SIHClient.exe
GET
200
88.221.125.143:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
239.255.255.250:1900
—
—
—
unknown
—
—
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5612
RUXIMICS.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5140
MoUsoCoreWorker.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2392
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2392
svchost.exe
2.16.164.120:80
crl.microsoft.com
Akamai International B.V.
NL
unknown
2392
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
5140
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 2.16.164.120
  • 2.16.164.72
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 88.221.125.143
whitelisted
www.bing.com
  • 2.19.96.66
  • 2.19.96.75
  • 2.19.96.82
  • 2.19.96.83
  • 2.19.96.73
  • 2.19.96.65
  • 2.19.96.67
  • 2.19.96.74
  • 2.19.96.58
whitelisted
r.bing.com
  • 2.19.96.73
  • 2.19.96.75
  • 2.19.96.82
  • 2.19.96.58
  • 2.19.96.67
  • 2.19.96.65
  • 2.19.96.66
  • 2.19.96.83
  • 2.19.96.74
whitelisted
login.live.com
  • 20.190.159.23
  • 40.126.31.71
  • 40.126.31.67
  • 20.190.159.0
  • 20.190.159.2
  • 20.190.159.4
  • 20.190.159.71
  • 40.126.31.69
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 23.43.62.58
  • 184.28.89.167
whitelisted
slscr.update.microsoft.com
  • 40.68.123.157
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe