File name:

SISSERVER8095711_2025-04-28_23_54_14.002.zip

Full analysis: https://app.any.run/tasks/041b275b-3d1a-45d7-af50-23b80a17e621
Verdict: Malicious activity
Threats:

Mallox is a ransomware strain that emerged in 2021, known for its ability to encrypt files and target database servers using vulnerabilities like RDP. Often distributed through phishing campaigns and exploiting exposed SQL servers, it locks victims' data and demands a ransom. Mallox operates as a Ransomware-as-a-Service (RaaS), making it accessible to affiliates who use it to conduct attacks.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 00:05:16
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
evasion
ransomware
mallox
Indicators:
MIME: application/zip
File info: Zip archive data, at least v4.5 to extract, compression method=deflate
MD5:

53880DA1AEC20B39D9EDEDE655FA1F98

SHA1:

396E871524C8B541EC1CE2CCDC82D57331BE75E5

SHA256:

EF13A982EF3537A9388613C96934C08CF92B0B6D2BF947889B9F8A6CBB5828AC

SSDEEP:

12288:re8TMN56vOJ8BvH1XIF9Pb0cfd0l629kRKFWU:y2MN5+OJ8BtYF9b0Ud0lPyRaWU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • MALLOX mutex has been found

      • OneDrive.exe (PID: 1196)

    • RANSOMWARE has been detected

      • OneDrive.exe (PID: 1196)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 4696)

    • Connects to the server without a host name

      • OneDrive.exe (PID: 1196)

    • There is functionality for capture public ip (YARA)

      • OneDrive.exe (PID: 1196)

    • Checks for external IP

      • OneDrive.exe (PID: 1196)

  • INFO

    • Reads the computer name

      • OneDrive.exe (PID: 1196)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4696)

    • Checks supported languages

      • OneDrive.exe (PID: 1196)

    • Reads product name

      • OneDrive.exe (PID: 1196)

    • Reads CPU info

      • OneDrive.exe (PID: 1196)

    • Reads Environment values

      • OneDrive.exe (PID: 1196)

    • Creates files in the program directory

      • OneDrive.exe (PID: 1196)

    • Create files in a temporary directory

      • OneDrive.exe (PID: 1196)

    • Creates files or folders in the user directory

      • OneDrive.exe (PID: 1196)

    • Manual execution by a user

      • mspaint.exe (PID: 4944)
      • WINWORD.EXE (PID: 2772)
      • notepad.exe (PID: 4812)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0801
ZipCompression: Deflated
ZipModifyDate: 1980:00:00 00:00:00
ZipCRC: 0x56756c8a
ZipCompressedSize: 308462
ZipUncompressedSize: 642048
ZipFileName: Device/HarddiskVolume3/Users/OneDrive.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
8
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe no specs THREAT onedrive.exe mspaint.exe no specs winword.exe ai.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1072C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1196"C:\Users\admin\AppData\Local\Temp\Rar$EXb4696.43765\Device\HarddiskVolume3\Users\OneDrive.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb4696.43765\Device\HarddiskVolume3\Users\OneDrive.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb4696.43765\device\harddiskvolume3\users\onedrive.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
2344"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "6C7C0CCD-6C16-4857-A068-83611B778389" "5A7B2141-FCBD-4DE8-B9F9-CF8DCBE12A09" "2772"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Exit code:
0
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\advapi32.dll
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\sechost.dll
2772"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\admin\Desktop\hourfloor.rtf" /o ""C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\rpcrt4.dll
4696"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\SISSERVER8095711_2025-04-28_23_54_14.002.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4812"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\FILE RECOVERY.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
4944"C:\WINDOWS\system32\mspaint.exe" "C:\Users\admin\Desktop\ratingschange.png"C:\Windows\System32\mspaint.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Paint
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mspaint.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5512"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
13 413
Read events
13 101
Write events
287
Delete events
25

Modification events

(PID) Process:(4696) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(4696) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(4696) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(4696) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\SISSERVER8095711_2025-04-28_23_54_14.002.zip
(PID) Process:(4696) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4696) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4696) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4696) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4696) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(4944) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:WindowPlacement
Value:
2C00000000000000010000000000000000000000FFFFFFFFFFFFFFFF7F000000470000007F04000087020000
Executable files
2
Suspicious files
32
Text files
561
Unknown types
1

Dropped files

PID
Process
Filename
Type
1196OneDrive.exeC:\Users\admin\Pictures\FILE RECOVERY.txttext
MD5:D13B6D3E28F4DFBEC45EF4E0BEB66432
SHA256:22877D65A8EE1C3BDFFFADA20F0FCF3ADFE32AFDF8E721907683F6D39D23F1AB
4696WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb4696.43765\manifest.jsontext
MD5:C2A1319F3D99F077EAB26D2914EBFD6E
SHA256:DCB7CE019DAB4E4A9B1E8775EB1B33AF80DE5B25DBB3F5291F45E929D02176BA
1196OneDrive.exeC:\Users\admin\Documents\OneNote Notebooks\My Notebook\FILE RECOVERY.txttext
MD5:D13B6D3E28F4DFBEC45EF4E0BEB66432
SHA256:22877D65A8EE1C3BDFFFADA20F0FCF3ADFE32AFDF8E721907683F6D39D23F1AB
1196OneDrive.exeC:\Users\admin\Documents\Outlook Files\FILE RECOVERY.txttext
MD5:D13B6D3E28F4DFBEC45EF4E0BEB66432
SHA256:22877D65A8EE1C3BDFFFADA20F0FCF3ADFE32AFDF8E721907683F6D39D23F1AB
1196OneDrive.exeC:\Users\admin\Desktop\FILE RECOVERY.txttext
MD5:D13B6D3E28F4DFBEC45EF4E0BEB66432
SHA256:22877D65A8EE1C3BDFFFADA20F0FCF3ADFE32AFDF8E721907683F6D39D23F1AB
1196OneDrive.exeC:\Users\admin\Documents\PowerShell\Modules\PSSQLite\1.1.0\core\win-x86\FILE RECOVERY.txttext
MD5:D13B6D3E28F4DFBEC45EF4E0BEB66432
SHA256:22877D65A8EE1C3BDFFFADA20F0FCF3ADFE32AFDF8E721907683F6D39D23F1AB
1196OneDrive.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb4696.43765\Device\HarddiskVolume3\Users\weax.txttext
MD5:EF6214CDA04A83F706C13C63A12A4557
SHA256:75710BDE21662E8B536A330EA18CC22E0AE98F3343AFFE200F4085573F382EBD
1196OneDrive.exeC:\Users\admin\Documents\PowerShell\Modules\PSSQLite\1.1.0\core\linux-x64\FILE RECOVERY.txttext
MD5:D13B6D3E28F4DFBEC45EF4E0BEB66432
SHA256:22877D65A8EE1C3BDFFFADA20F0FCF3ADFE32AFDF8E721907683F6D39D23F1AB
1196OneDrive.exeC:\Users\admin\Documents\PowerShell\Modules\PSSQLite\1.1.0\core\osx-x64\FILE RECOVERY.txttext
MD5:D13B6D3E28F4DFBEC45EF4E0BEB66432
SHA256:22877D65A8EE1C3BDFFFADA20F0FCF3ADFE32AFDF8E721907683F6D39D23F1AB
1196OneDrive.exeC:\Users\admin\Documents\PowerShell\Modules\PSSQLite\1.1.0\x64\FILE RECOVERY.txttext
MD5:D13B6D3E28F4DFBEC45EF4E0BEB66432
SHA256:22877D65A8EE1C3BDFFFADA20F0FCF3ADFE32AFDF8E721907683F6D39D23F1AB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
33
DNS requests
25
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.42:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1196
OneDrive.exe
POST
200
193.143.1.153:80
http://193.143.1.153/Ujdu8jjooue/biweax.php
unknown
—
—
unknown
1196
OneDrive.exe
GET
200
104.26.12.205:80
http://api.ipify.org/
unknown
—
—
malicious
6192
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6192
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2772
WINWORD.EXE
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
23.216.77.42:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.129:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
whitelisted
google.com
  • 142.250.185.142
whitelisted
crl.microsoft.com
  • 23.216.77.42
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 2.23.246.101
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 40.126.31.129
  • 20.190.159.131
  • 40.126.31.67
  • 20.190.159.23
  • 20.190.159.64
  • 40.126.31.130
  • 20.190.159.73
  • 20.190.159.68
  • 40.126.32.72
  • 20.190.160.128
  • 40.126.32.74
  • 40.126.32.138
  • 40.126.32.76
  • 20.190.160.64
  • 20.190.160.5
  • 20.190.160.67
whitelisted
ocsp.digicert.com
  • 184.30.131.245
  • 2.23.77.188
whitelisted
api.ipify.org
  • 104.26.12.205
  • 172.67.74.152
  • 104.26.13.205
shared
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
1196
OneDrive.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup api.ipify.org
1196
OneDrive.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External IP Lookup by HTTP (api .ipify .org)
1196
OneDrive.exe
Misc activity
SUSPICIOUS [ANY.RUN] Sent Host Name in HTTP POST Body
1196
OneDrive.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 38
1196
OneDrive.exe
Device Retrieving External IP Address Detected
SUSPICIOUS [ANY.RUN] An IP address was received from the server as a result of an HTTP request
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SISSERVER8095711_2025-04-28_23_54_14.002.zip