File name:

UDS-Trojan-Ransom.Win32.Generic-b9a33e0225555e2d41582f81a7fa73fe431817f6e169d55540b250907dec7aaf.7z

Full analysis: https://app.any.run/tasks/be15edda-8df4-4c0b-8831-06dfdfb60a62
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: April 13, 2025, 12:22:34
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
ransomware
golang
upx
stealer
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

8806450EA6DDDF5495176AAA678199F4

SHA1:

91FAF857E29B87B8FE8AD02F7A43A38449B1CAA1

SHA256:

EF128D5091A6384E8F8FFA17395E100196539F0C75D73BBDC4A36A5498966C87

SSDEEP:

24576:+xPBkFZtpkj9RFCa8X6aIEL8k0qDGHli1y7EM/o1kKlV3k8Q4F9Sv3a/vLfS0MWJ:+xPBkFZtpkj9RFCa8X9IEL8k/DGHli1n

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 7316)

    • RANSOMWARE has been detected

      • UDS-Trojan-Ransom.Win32.Generic-b9a33e0225555e2d41582f81a7fa73fe431817f6e169d55540b250907dec7aaf.exe (PID: 7996)

    • Deletes shadow copies

      • cmd.exe (PID: 4776)

    • Starts NET.EXE for service management

      • net.exe (PID: 7152)
      • net.exe (PID: 1240)
      • net.exe (PID: 5072)
      • net.exe (PID: 7856)
      • net.exe (PID: 7984)
      • net.exe (PID: 8112)
      • net.exe (PID: 2136)
      • net.exe (PID: 7244)
      • net.exe (PID: 496)
      • net.exe (PID: 7224)
      • net.exe (PID: 2140)
      • net.exe (PID: 6652)
      • net.exe (PID: 5608)
      • net.exe (PID: 8056)
      • net.exe (PID: 8028)
      • net.exe (PID: 2096)
      • net.exe (PID: 5260)
      • net.exe (PID: 7788)
      • cmd.exe (PID: 728)
      • net.exe (PID: 7400)
      • net.exe (PID: 2268)
      • net.exe (PID: 3060)
      • net.exe (PID: 7136)
      • net.exe (PID: 6592)
      • net.exe (PID: 7952)
      • net.exe (PID: 8036)
      • net.exe (PID: 7228)
      • net.exe (PID: 7620)
      • net.exe (PID: 6808)
      • net.exe (PID: 4696)
      • net.exe (PID: 968)
      • net.exe (PID: 8184)
      • net.exe (PID: 6040)
      • net.exe (PID: 6964)
      • net.exe (PID: 7084)
      • net.exe (PID: 1196)
      • net.exe (PID: 5772)
      • net.exe (PID: 4776)
      • net.exe (PID: 2516)
      • net.exe (PID: 672)
      • net.exe (PID: 5392)
      • net.exe (PID: 3732)
      • net.exe (PID: 8016)
      • net.exe (PID: 3568)
      • net.exe (PID: 6108)
      • net.exe (PID: 6940)
      • net.exe (PID: 5744)
      • net.exe (PID: 2656)
      • net.exe (PID: 968)
      • net.exe (PID: 2656)
      • net.exe (PID: 7788)
      • net.exe (PID: 7952)
      • net.exe (PID: 7400)
      • net.exe (PID: 6592)
      • net.exe (PID: 2268)
      • net.exe (PID: 3060)
      • net.exe (PID: 7136)
      • net.exe (PID: 8184)
      • net.exe (PID: 8060)
      • net.exe (PID: 8036)
      • net.exe (PID: 7228)
      • net.exe (PID: 6040)
      • net.exe (PID: 6964)
      • net.exe (PID: 5936)
      • net.exe (PID: 3384)
      • net.exe (PID: 7752)
      • net.exe (PID: 2096)
      • net.exe (PID: 5260)
      • net.exe (PID: 5772)
      • net.exe (PID: 1196)
      • net.exe (PID: 4776)
      • net.exe (PID: 2516)
      • net.exe (PID: 3732)
      • net.exe (PID: 5392)
      • net.exe (PID: 672)
      • net.exe (PID: 7084)
      • net.exe (PID: 8016)
      • net.exe (PID: 4164)
      • net.exe (PID: 6940)
      • net.exe (PID: 6108)
      • net.exe (PID: 5744)
      • net.exe (PID: 5936)
      • net.exe (PID: 7400)
      • net.exe (PID: 3384)
      • net.exe (PID: 7752)
      • net.exe (PID: 2268)
      • net.exe (PID: 5260)
      • net.exe (PID: 968)
      • net.exe (PID: 6592)
      • net.exe (PID: 7952)
      • net.exe (PID: 3060)
      • net.exe (PID: 1760)
      • net.exe (PID: 3676)
      • net.exe (PID: 6240)
      • net.exe (PID: 8004)
      • net.exe (PID: 4300)
      • net.exe (PID: 812)
      • net.exe (PID: 644)
      • net.exe (PID: 6572)
      • net.exe (PID: 4008)
      • net.exe (PID: 4408)
      • net.exe (PID: 672)
      • net.exe (PID: 1184)
      • net.exe (PID: 8020)
      • net.exe (PID: 4748)
      • net.exe (PID: 3568)
      • net.exe (PID: 8036)
      • net.exe (PID: 7788)
      • net.exe (PID: 2096)
      • net.exe (PID: 8032)
      • net.exe (PID: 7136)
      • net.exe (PID: 8104)
      • net.exe (PID: 7832)
      • net.exe (PID: 3416)
      • net.exe (PID: 7644)
      • net.exe (PID: 7676)
      • net.exe (PID: 6032)
      • net.exe (PID: 4188)
      • net.exe (PID: 5384)
      • net.exe (PID: 7820)
      • net.exe (PID: 6776)
      • net.exe (PID: 676)
      • net.exe (PID: 7964)
      • net.exe (PID: 7856)
      • net.exe (PID: 8068)
      • net.exe (PID: 5408)
      • net.exe (PID: 7192)
      • net.exe (PID: 6136)
      • net.exe (PID: 7432)
      • net.exe (PID: 6040)
      • net.exe (PID: 7248)
      • net.exe (PID: 4844)
      • net.exe (PID: 8120)
      • net.exe (PID: 7596)
      • net.exe (PID: 1180)
      • net.exe (PID: 6712)
      • net.exe (PID: 8124)
      • net.exe (PID: 7084)
      • net.exe (PID: 616)
      • net.exe (PID: 5960)
      • net.exe (PID: 7692)
      • net.exe (PID: 2344)
      • net.exe (PID: 7784)
      • net.exe (PID: 7872)
      • net.exe (PID: 3884)
      • net.exe (PID: 2656)
      • net.exe (PID: 2192)
      • net.exe (PID: 6964)
      • net.exe (PID: 5680)
      • net.exe (PID: 632)
      • net.exe (PID: 5360)
      • net.exe (PID: 5596)
      • net.exe (PID: 4036)
      • net.exe (PID: 4756)
      • net.exe (PID: 7916)
      • net.exe (PID: 4880)
      • net.exe (PID: 7984)
      • net.exe (PID: 7312)
      • net.exe (PID: 6620)
      • net.exe (PID: 5428)
      • net.exe (PID: 6028)
      • net.exe (PID: 2152)
      • net.exe (PID: 7196)
      • net.exe (PID: 7708)
      • net.exe (PID: 8108)
      • net.exe (PID: 7276)
      • net.exe (PID: 3304)
      • net.exe (PID: 3732)
      • net.exe (PID: 1452)
      • net.exe (PID: 5608)
      • net.exe (PID: 7756)
      • net.exe (PID: 3764)
      • net.exe (PID: 4488)
      • net.exe (PID: 8020)
      • net.exe (PID: 6724)
      • net.exe (PID: 7864)
      • net.exe (PID: 3200)
      • net.exe (PID: 2316)
      • net.exe (PID: 4284)
      • net.exe (PID: 7036)
      • net.exe (PID: 4736)
      • net.exe (PID: 2752)
      • net.exe (PID: 5972)
      • net.exe (PID: 6512)
      • net.exe (PID: 6080)

    • Uses TASKKILL.EXE to kill security tools

      • cmd.exe (PID: 728)

    • Actions looks like stealing of personal data

      • cmd.exe (PID: 728)

  • SUSPICIOUS

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 8032)

    • Write to the desktop.ini file (may be used to cloak folders)

      • UDS-Trojan-Ransom.Win32.Generic-b9a33e0225555e2d41582f81a7fa73fe431817f6e169d55540b250907dec7aaf.exe (PID: 7996)

    • Creates file in the systems drive root

      • UDS-Trojan-Ransom.Win32.Generic-b9a33e0225555e2d41582f81a7fa73fe431817f6e169d55540b250907dec7aaf.exe (PID: 7996)

    • Starts CMD.EXE for commands execution

      • UDS-Trojan-Ransom.Win32.Generic-b9a33e0225555e2d41582f81a7fa73fe431817f6e169d55540b250907dec7aaf.exe (PID: 7996)

    • Executes as Windows Service

      • VSSVC.exe (PID: 4688)

    • Uses TASKKILL.EXE to kill Office Apps

      • cmd.exe (PID: 728)

    • Executing commands from a ".bat" file

      • UDS-Trojan-Ransom.Win32.Generic-b9a33e0225555e2d41582f81a7fa73fe431817f6e169d55540b250907dec7aaf.exe (PID: 7996)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 728)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7316)

    • Reads the computer name

      • UDS-Trojan-Ransom.Win32.Generic-b9a33e0225555e2d41582f81a7fa73fe431817f6e169d55540b250907dec7aaf.exe (PID: 7996)
      • identity_helper.exe (PID: 7836)

    • Reads the machine GUID from the registry

      • UDS-Trojan-Ransom.Win32.Generic-b9a33e0225555e2d41582f81a7fa73fe431817f6e169d55540b250907dec7aaf.exe (PID: 7996)

    • Checks supported languages

      • UDS-Trojan-Ransom.Win32.Generic-b9a33e0225555e2d41582f81a7fa73fe431817f6e169d55540b250907dec7aaf.exe (PID: 7996)
      • identity_helper.exe (PID: 7836)

    • Manual execution by a user

      • UDS-Trojan-Ransom.Win32.Generic-b9a33e0225555e2d41582f81a7fa73fe431817f6e169d55540b250907dec7aaf.exe (PID: 7996)
      • notepad.exe (PID: 4756)
      • notepad.exe (PID: 5324)
      • msedge.exe (PID: 7424)

    • Create files in a temporary directory

      • UDS-Trojan-Ransom.Win32.Generic-b9a33e0225555e2d41582f81a7fa73fe431817f6e169d55540b250907dec7aaf.exe (PID: 7996)

    • Drops encrypted JS script (Microsoft Script Encoder)

      • UDS-Trojan-Ransom.Win32.Generic-b9a33e0225555e2d41582f81a7fa73fe431817f6e169d55540b250907dec7aaf.exe (PID: 7996)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 6640)
      • notepad.exe (PID: 4756)
      • notepad.exe (PID: 5324)

    • Application based on Golang

      • UDS-Trojan-Ransom.Win32.Generic-b9a33e0225555e2d41582f81a7fa73fe431817f6e169d55540b250907dec7aaf.exe (PID: 7996)

    • UPX packer has been detected

      • UDS-Trojan-Ransom.Win32.Generic-b9a33e0225555e2d41582f81a7fa73fe431817f6e169d55540b250907dec7aaf.exe (PID: 7996)

    • Reads Environment values

      • identity_helper.exe (PID: 7836)

    • Reads the software policy settings

      • slui.exe (PID: 7484)

    • Application launched itself

      • msedge.exe (PID: 7424)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
ModifyDate: 2021:04:25 12:05:16+00:00
ArchivedFileName: UDS-Trojan-Ransom.Win32.Generic-b9a33e0225555e2d41582f81a7fa73fe431817f6e169d55540b250907dec7aaf.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
590
Monitored processes
457
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe THREAT uds-trojan-ransom.win32.generic-b9a33e0225555e2d41582f81a7fa73fe431817f6e169d55540b250907dec7aaf.exe cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs wmic.exe no specs vssvc.exe no specs notepad.exe no specs cmd.exe conhost.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs notepad.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs slui.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
496net stop ΓÇ£Sophos AutoUpdate ServiceΓÇ¥ /yC:\Windows\SysWOW64\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
616C:\WINDOWS\system32\net1 stop VeeamDeploymentService /yC:\Windows\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
616net stop SQLSafeOLRService /yC:\Windows\SysWOW64\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
632net stop AVP /yC:\Windows\SysWOW64\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
632C:\WINDOWS\system32\net1 stop ΓÇ£Sophos Safestore ServiceΓÇ¥ /yC:\Windows\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
644net stop IISAdmin /yC:\Windows\SysWOW64\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
660C:\WINDOWS\system32\net1 stop SQLWriter /yC:\Windows\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
672net stop AcrSch2Svc /yC:\Windows\SysWOW64\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
672net stop MSSQL$SBSMONITORING /yC:\Windows\SysWOW64\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
672net stop BackupExecJobEngine /yC:\Windows\SysWOW64\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
14 857
Read events
14 823
Write events
34
Delete events
0

Modification events

(PID) Process:(7316) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7316) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7316) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7316) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\UDS-Trojan-Ransom.Win32.Generic-b9a33e0225555e2d41582f81a7fa73fe431817f6e169d55540b250907dec7aaf.7z
(PID) Process:(7316) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7316) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7316) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7316) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7316) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(7316) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
Executable files
7
Suspicious files
424
Text files
44
Unknown types
0

Dropped files

PID
Process
Filename
Type
7316WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb7316.27364\UDS-Trojan-Ransom.Win32.Generic-b9a33e0225555e2d41582f81a7fa73fe431817f6e169d55540b250907dec7aaf.exeexecutable
MD5:D63DE35D8CF9B12C28D3D5509DD16AAE
SHA256:B9A33E0225555E2D41582F81A7FA73FE431817F6E169D55540B250907DEC7AAF
7996UDS-Trojan-Ransom.Win32.Generic-b9a33e0225555e2d41582f81a7fa73fe431817f6e169d55540b250907dec7aaf.exeC:\Users\admin\AppData\Local\Temp\AfterImageApply_BDB0C1E8-6951-46C4-AB7F-C07B29F462FD.cmdbinary
MD5:751BEB038E95CA86210EE0CC3FC5F97D
SHA256:BE4D204B18D33F99DDD4F6BB15D39AFDD4B386D2C2E4F8DA06C91D9C1D217B97
7996UDS-Trojan-Ransom.Win32.Generic-b9a33e0225555e2d41582f81a7fa73fe431817f6e169d55540b250907dec7aaf.exeC:\$WinREAgent\RollbackInfo.inibinary
MD5:66FC2B68E3E7D0438B1C245C6B342773
SHA256:EC2B68E5CF21CFF168D23E141A3FAF453AC8A52EF09AAFE66E228E08ABCB2F0E
7996UDS-Trojan-Ransom.Win32.Generic-b9a33e0225555e2d41582f81a7fa73fe431817f6e169d55540b250907dec7aaf.exeC:\Users\admin\AppData\Local\Temp\Rollback.xmlbinary
MD5:5474AE3426FD4E2F203F68FE6D75A15D
SHA256:80B2DD0D54EAF545C17B41601DD68C933BBE8DE7785759F8238628628C6B1960
7996UDS-Trojan-Ransom.Win32.Generic-b9a33e0225555e2d41582f81a7fa73fe431817f6e169d55540b250907dec7aaf.exeC:\Users\admin\AppData\Local\Temp\location.txtbinary
MD5:8C79056E61B66105514DA12DE437C170
SHA256:5519A33A39906A15F5B633C115432233B9233FDB7038778A91A2AF0F36B867D5
7996UDS-Trojan-Ransom.Win32.Generic-b9a33e0225555e2d41582f81a7fa73fe431817f6e169d55540b250907dec7aaf.exeC:\Users\admin\AppData\Local\Temp\ReAgent.xmlbinary
MD5:A94C68661BB1FA1E794F50C7692EB2A1
SHA256:699A9038D0C91AEBFCC0FBFA776EB284E4208D2FA9BF52259E7FDAA779D06696
7996UDS-Trojan-Ransom.Win32.Generic-b9a33e0225555e2d41582f81a7fa73fe431817f6e169d55540b250907dec7aaf.exeC:\Users\admin\AppData\Local\Temp\ResetConfig.xmlbinary
MD5:CF2E44497C7C4857A4DA837E9FC0B761
SHA256:B4F511FEFF810AAF97CE6F5E0F33C4CED29143809E71E59F6C7B954AC271E459
7996UDS-Trojan-Ransom.Win32.Generic-b9a33e0225555e2d41582f81a7fa73fe431817f6e169d55540b250907dec7aaf.exeC:\$WinREAgent\Backup\ReAgent.xmlbinary
MD5:A94C68661BB1FA1E794F50C7692EB2A1
SHA256:699A9038D0C91AEBFCC0FBFA776EB284E4208D2FA9BF52259E7FDAA779D06696
7996UDS-Trojan-Ransom.Win32.Generic-b9a33e0225555e2d41582f81a7fa73fe431817f6e169d55540b250907dec7aaf.exeC:\$WinREAgent\Rollback.xmlbinary
MD5:5474AE3426FD4E2F203F68FE6D75A15D
SHA256:80B2DD0D54EAF545C17B41601DD68C933BBE8DE7785759F8238628628C6B1960
7996UDS-Trojan-Ransom.Win32.Generic-b9a33e0225555e2d41582f81a7fa73fe431817f6e169d55540b250907dec7aaf.exeC:\Users\admin\AppData\Local\Temp\ReAgentOld.xmlbinary
MD5:6364175FB3B365CF4FBBF0A2060A5232
SHA256:A9EFFD29A735B18F304872AA9A726B72F5BD6B615AA2127C16F78FE0503F570F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
35
DNS requests
37
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.26:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7772
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7772
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.26:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.159.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7772
SIHClient.exe
20.12.23.50:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.216.77.26
  • 23.216.77.19
  • 23.216.77.29
  • 23.216.77.6
  • 23.216.77.5
  • 23.216.77.13
  • 23.216.77.16
  • 23.216.77.25
  • 23.216.77.20
whitelisted
google.com
  • 216.58.206.46
whitelisted
login.live.com
  • 20.190.159.128
  • 40.126.31.69
  • 20.190.159.130
  • 40.126.31.1
  • 40.126.31.3
  • 40.126.31.67
  • 20.190.159.2
  • 20.190.159.23
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
www.microsoft.com
  • 69.192.161.161
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 150.171.27.11
  • 150.171.28.11
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
UDS-Trojan-Ransom.Win32.Generic-b9a33e0225555e2d41582f81a7fa73fe431817f6e169d55540b250907dec7aaf.7z