File name:

Trojan-Ransom.Win32.HmBlocker.afi-068ebb2a4a39b84ac9029ed20ba5c0f3ba280dd385d4603741ad129612e96df6.7z

Full analysis: https://app.any.run/tasks/47101f18-5e4f-4ce5-bf9f-70f8886dc9ed
Verdict: Malicious activity
Analysis date: April 22, 2025, 21:24:37
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

37F041515F6D750F968F8E3FCE9C8960

SHA1:

A78802285FAEA4577A554AE99F3BCA106D29C531

SHA256:

F09C52E8A160F3AC5B95498371092A1320F8A1C59BC654579A468C3BBA50656B

SSDEEP:

768:DTXk91SJrAQlvQVzQ95eVpFFMKlgUJ/uM15Bk99YHg4vpxH1ehvg+5YBKlfVpPC1:DTKSVvHoVpQIgMhkEZRqvg+59BXq1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • reg.exe (PID: 2464)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • Trojan-Ransom.Win32.HmBlocker.afi-068ebb2a4a39b84ac9029ed20ba5c0f3ba280dd385d4603741ad129612e96df6.exe (PID: 1648)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 984)

    • The system shut down or reboot

      • Trojan-Ransom.Win32.HmBlocker.afi-068ebb2a4a39b84ac9029ed20ba5c0f3ba280dd385d4603741ad129612e96df6.exe (PID: 1648)

    • Reads the Internet Settings

      • Trojan-Ransom.Win32.HmBlocker.afi-068ebb2a4a39b84ac9029ed20ba5c0f3ba280dd385d4603741ad129612e96df6.exe (PID: 1648)
      • sipnotify.exe (PID: 1924)

    • The process executes via Task Scheduler

      • ctfmon.exe (PID: 1692)
      • sipnotify.exe (PID: 1924)

    • Reads security settings of Internet Explorer

      • Trojan-Ransom.Win32.HmBlocker.afi-068ebb2a4a39b84ac9029ed20ba5c0f3ba280dd385d4603741ad129612e96df6.exe (PID: 1648)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1224)

    • Manual execution by a user

      • Trojan-Ransom.Win32.HmBlocker.afi-068ebb2a4a39b84ac9029ed20ba5c0f3ba280dd385d4603741ad129612e96df6.exe (PID: 1648)
      • IMEKLMG.EXE (PID: 2204)
      • IMEKLMG.EXE (PID: 2212)
      • 695729899.exe (PID: 2228)

    • Reads the computer name

      • Trojan-Ransom.Win32.HmBlocker.afi-068ebb2a4a39b84ac9029ed20ba5c0f3ba280dd385d4603741ad129612e96df6.exe (PID: 1648)
      • IMEKLMG.EXE (PID: 2204)
      • IMEKLMG.EXE (PID: 2212)

    • Checks supported languages

      • Trojan-Ransom.Win32.HmBlocker.afi-068ebb2a4a39b84ac9029ed20ba5c0f3ba280dd385d4603741ad129612e96df6.exe (PID: 1648)
      • IMEKLMG.EXE (PID: 2212)
      • IMEKLMG.EXE (PID: 2204)
      • 695729899.exe (PID: 2228)

    • Process checks whether UAC notifications are on

      • IMEKLMG.EXE (PID: 2212)
      • IMEKLMG.EXE (PID: 2204)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
ModifyDate: 2012:07:06 14:34:36+00:00
ArchivedFileName: Trojan-Ransom.Win32.HmBlocker.afi-068ebb2a4a39b84ac9029ed20ba5c0f3ba280dd385d4603741ad129612e96df6.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
95
Monitored processes
10
Malicious processes
0
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe trojan-ransom.win32.hmblocker.afi-068ebb2a4a39b84ac9029ed20ba5c0f3ba280dd385d4603741ad129612e96df6.exe shutdown.exe no specs cmd.exe no specs reg.exe ctfmon.exe no specs sipnotify.exe imeklmg.exe no specs imeklmg.exe no specs 695729899.exe

Process information

PID
CMD
Path
Indicators
Parent process
984"C:\Windows\System32\cmd.exe" /C rEg adD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v vn8695729899h67695729899 /d "C:\Users\admin\695729899\695729899.exe" /FC:\Windows\System32\cmd.exe—Trojan-Ransom.Win32.HmBlocker.afi-068ebb2a4a39b84ac9029ed20ba5c0f3ba280dd385d4603741ad129612e96df6.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1224"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\Trojan-Ransom.Win32.HmBlocker.afi-068ebb2a4a39b84ac9029ed20ba5c0f3ba280dd385d4603741ad129612e96df6.7zC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1648"C:\Users\admin\Desktop\Trojan-Ransom.Win32.HmBlocker.afi-068ebb2a4a39b84ac9029ed20ba5c0f3ba280dd385d4603741ad129612e96df6.exe" C:\Users\admin\Desktop\Trojan-Ransom.Win32.HmBlocker.afi-068ebb2a4a39b84ac9029ed20ba5c0f3ba280dd385d4603741ad129612e96df6.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
3221225786
Modules
Images
c:\users\admin\desktop\trojan-ransom.win32.hmblocker.afi-068ebb2a4a39b84ac9029ed20ba5c0f3ba280dd385d4603741ad129612e96df6.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1692C:\Windows\System32\ctfmon.exe C:\Windows\System32\ctfmon.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CTF Loader
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msctfmonitor.dll
c:\windows\system32\msctf.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1924C:\Windows\system32\sipnotify.exe -LogonOrUnlockC:\Windows\System32\sipnotify.exe
taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
sipnotify
Exit code:
0
Version:
6.1.7602.20480 (win7sp1_ldr_escrow.191010-1716)
Modules
Images
c:\windows\system32\sipnotify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2204"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /JPN /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
2212"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /KOR /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
2228"C:\Users\admin\695729899\695729899.exe" C:\Users\admin\695729899\695729899.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\695729899\695729899.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
2432SHUTDOWN /R /F /T 05C:\Windows\System32\shutdown.exe—Trojan-Ransom.Win32.HmBlocker.afi-068ebb2a4a39b84ac9029ed20ba5c0f3ba280dd385d4603741ad129612e96df6.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Shutdown and Annotation Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\shutdown.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\secur32.dll
2464rEg adD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v vn8695729899h67695729899 /d "C:\Users\admin\695729899\695729899.exe" /FC:\Windows\System32\reg.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
2 261
Read events
2 226
Write events
34
Delete events
1

Modification events

(PID) Process:(1224) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1224) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1224) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1224) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(1224) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(1224) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(1224) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Trojan-Ransom.Win32.HmBlocker.afi-068ebb2a4a39b84ac9029ed20ba5c0f3ba280dd385d4603741ad129612e96df6.7z
(PID) Process:(1224) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1224) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1224) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
1
Suspicious files
2
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
1924sipnotify.exeC:\Users\admin\AppData\Local\Microsoft\Windows\SipNotify\eoscontent\microsoft-logo.pngimage
MD5:B7C73A0CFBA68CC70C35EF9C63703CE4
SHA256:1D8B27A0266FF526CF95447F3701592A908848467D37C09A00A2516C1F29A013
2228695729899.exeC:\Users\admin\695729899\ztext
MD5:CEE631121C2EC9232F3A2F028AD5C89B
SHA256:0604CD3138FEED202EF293E062DA2F4720F77A05D25EE036A7A01C9CFCDD1F0A
1924sipnotify.exeC:\Users\admin\AppData\Local\Microsoft\Windows\SipNotify\eoscontent\main.jpgimage
MD5:C8BCC2041232DA45C1367F1FEED51370
SHA256:C0EC6771F923E7B85F6E2E7AA58D6BA51D322E78F53CEE8108DBBFD352BE7B25
1924sipnotify.exeC:\Users\admin\AppData\Local\Microsoft\Windows\SipNotify\default.cabcompressed
MD5:340674F6A3D1562E28A011EC11E40D83
SHA256:259880E2346D986ABEED46AA9C2917C53E969AAE6927F2CA0A2AD0967736DF98
1224WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1224.39821\Trojan-Ransom.Win32.HmBlocker.afi-068ebb2a4a39b84ac9029ed20ba5c0f3ba280dd385d4603741ad129612e96df6.exeexecutable
MD5:24632B600095453CB520F9717838F5C8
SHA256:E4AD625087EECC83F6E75FA7EDE44388AD7EDD6BA533E989422AC333385201F5
1924sipnotify.exeC:\Users\admin\AppData\Local\Microsoft\Windows\SipNotify\eoscontent\metadata.jsonbinary
MD5:253EDC8EC7674BD78293FF3B21866074
SHA256:51C3A033F0160A30C1773F1E5A9CD01AB018B151EDA1BB64D0226B2437106A56
1924sipnotify.exeC:\Users\admin\AppData\Local\Microsoft\Windows\SipNotify\eoscontent\styles.csstext
MD5:3383EEF350240253D7C2C2564381B3CB
SHA256:85443493D86D6D7FB0E07BC9705DFC9C858086FBA1B0E508092AB328D5F145E8
1924sipnotify.exeC:\Users\admin\AppData\Local\Microsoft\Windows\SipNotify\eoscontent\script.jstext
MD5:A2682382967C351F7ED21762F9E5DE9E
SHA256:36B1D26F1EC69685648C0528C2FCE95A3C2DBECF828CDFA4A8B4239A15B644A2
1924sipnotify.exeC:\Users\admin\AppData\Local\Microsoft\Windows\SipNotify\eoscontent\en-us.htmlhtml
MD5:5001C5247AF7E35AC35ACE61B87E8040
SHA256:2920ED0DDFE475884703A5AE7B835F40398E509AA26B52A8DDD7F25DCD4B3D2E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
15
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1924
sipnotify.exe
HEAD
503
104.102.43.250:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133898343363280000
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
1448
svchost.exe
239.255.255.250:3702
—
—
—
whitelisted
1100
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
1924
sipnotify.exe
104.102.43.250:80
query.prod.cms.rt.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.18.14
whitelisted
query.prod.cms.rt.microsoft.com
  • 104.102.43.250
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Trojan-Ransom.Win32.HmBlocker.afi-068ebb2a4a39b84ac9029ed20ba5c0f3ba280dd385d4603741ad129612e96df6.7z