26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T48f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom_.52C0D2B3 Sample 09fabf74cfc9… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 09fabf74cfc9…. Malware family: Ransom_.52C0D2B3. Threat score 100/100. 22/28 AV engines flagged this file. 5 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/09fabf74cfc942501d1ccebace1d3ef575a2265f3047381c3bbfb4c45892861a","keywords":["Malicious","Ransom_.52C0D2B3","malware analysis","sandbox report","threat intelligence","09fabf74cfc942501d1ccebace1d3ef575a2265f3047381c3bbfb4c45892861a"],"about":{"@type":"SoftwareApplication","name":"rad21C10.exe","applicationCategory":["peexe","executable"],"identifier":"09fabf74cfc942501d1ccebace1d3ef575a2265f3047381c3bbfb4c45892861a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom_.52C0D2B3","antivirusDetections":{"malicious":22,"total":28},"behavioralIndicators":{"malicious":5,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T410,"\Sessions\1\BaseNamedObjects\Local\ZonesCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZoneAttributeCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "m3280878823" "Local\MidiMapper_modLongMessage_RefCnt" "\Sessions\1\BaseNamedObjects\Local\MidiMapper_modLongMessage_RefCnt" "\Sessions\1\BaseNamedObjects\m3280878823" "\Sessions\1\BaseNamedObjects\Local\c:!users!21rkebp!appdata!roaming!microsoft!windows!cookies!" "\Sessions\1\BaseNamedObjects\Local\WininetConnectionMutex" "\Sessions\1\BaseNamedObjects\Local\WininetProxyRegistryMutex" "\Sessions\1\BaseNamedObjects\Local\WininetStartupMutex" "\Sessions\1\BaseNamedObjects\IESQMMUTEX_0_208" "\Sessions\1\BaseNamedObjects\Local\_!MSFTHISTORY!_" "\Sessions\1\BaseNamedObjects\Local\c:!users!21rkebp!appdata!local!microsoft!windows!temporary internet files!content.ie5!" "\Sessions\1\BaseNamedObjects\Local\c:!users!21rkebp!appdata!local!microsoft!windows!history!history.ie5!"28:Tb88,"" wrote bytes "4246f676593ef67600000000" to virtual address "0x00401194" (part of module "RAD21C10.EXE") "" wrote bytes "d3869475d54192750b9d947536b691753b36927500000000" to virtual address "0x0040117C" (part of module "RAD21C10.EXE") "" wrote bytes "f419a174d919a174511ba17400000000" to virtual address "0x0040116C" (part of module "RAD21C10.EXE") "" wrote bytes "473fcb756d42cc7500000000" to virtual address "0x00401160" (part of module "RAD21C10.EXE") "" wrote bytes "2de5f0755bc4f275f03ef17500000000" to virtual address "0x00401150" (part of module "RAD21C10.EXE") "" wrote bytes "273ee775efb2eb7551c1e5759498e575ee9ce57575dce7750000000046badb75013ddc7538eddc75cfcddb753123db75de2fdc75c4cadb7580bbdb7552badb759fbbdb7592bbdb750abfdb7500000000" to virtual address "0x6B671000" (part of module "NDDEAPI.DLL") "" wrote bytes "461ef8756579fb756804f87500000000" to virtual address "0x00401140" (part of module "RAD21C10.EXE") "" wrote bytes "062f007258300072d62d007200000000" to virtual address "0x00401130" (part of module "RAD21C10.EXE") "" wrote bytes "18d75f750e6c6075153662757f5a627546a56275775d6275c5a8627500000000" to virtual address "0x00401054" (part of module "RAD21C10.EXE") "" wrote bytes "ea91b1757edfb17536dfb1754edfb175b4a4b3751ac5b1759b77b375e98eb17514dfb17524e1b1758d46b27531cfb1759d46b2750443b2751c43b2750c0eb275240eb2757831b57532c5b17566dfb17500000000" to virtual address "0x00401000" (part of module "RAD21C10.EXE") "WMIC.exe" wrote bytes "40532f7758583077186a3077653c31770000000000bfdb750000000056ccdb75000000007ccadb7500000000376849756a2c3177d62d317700000000206949750000000029a6db7500000000a48d497500000000f70edb7500000000" to virtual address "0x77401000" (part of module "NSI.DLL") "iexplore.exe" wrote bytes "e9e89a73f9" to virtual address "0x75CAE30C" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e9652b7af9" to virtual address "0x75CAADF9" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "40532f7758583077186a3077653c31770000000000bfdb750000000056ccdb75000000007ccadb7500000000376849756a2c3177d62d317700000000206949750000000029a6db7500000000a48d497500000000f70edb7500000000" to virtual address "0x77401000" (part of module "NSI.DLL") "iexplore.exe" wrote bytes "e9b94369f9" to virtual address "0x75CC3B9B" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e955a54df8" to virtual address "0x76F63EAE" (part of module "OLEAUT32.DLL") "iexplore.exe" wrote bytes "e937f285f9" to virtual address "0x75CFE963" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e96ff185f9" to virtual address "0x75CFE9C9" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e9c20a87f9" to virtual address "0x75CED274" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e9b296adf9" to virtual address "0x75949D0B" (part of module "OLE32.DLL")29:T608,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAQaSURBVFhH7VdLV1NXGPV/OadWWxV5KPiMaItdC5eCCBR0QULegRgDWCQYwiMEQkBqayu1U1uIHTjSkc7oBEhyc1954O537s3jAjdN0C6YNGvtdZJzc8+3v/09zjlHjvz/OWwFrE43+vptB4p+iwPktwqLzYF379fx5u0Hwvv/FN92epT1do/M4QIBq30Qf6xGPwura6+xFv0La69VrNL3P2mOQW/tHQRMZgeSgoR0SkZKlj4B6nuyDnavx2yIqYwS7oICJrNdmTxI7CGQyWYVAisrr/Dy9zcVYeW3V8hm0gqi0agu8gocvTEBBvZbV4FsjgAzXtOzgNp7YdT1zqPeOIez5hDOWUNodAbRODCDC54pXPROKiT/Xl9HShLKhm1fBK7YlmFwPIXBuYSmwUVc80Rw3buAb0bm0Tw6hxu+EL7zz2oI8J+nAIvHtkaBFu/PaBn+CTcfPcOtxwTfMlr9T9EWWMKd6UW0ByPomAsXCKQlPpeEojpK6qgFU6DKNKwfAkaAF9XYMFk7xl+gy/8rugK/oHv6OW6T8Zv+MJrHg7g65ofBN46mCV+RgCiUVYAZP/3IWZoAx4sFAsbgS9yfeYGmoRBO2sbwhWUIXzoe4sSAB189cOOkdwCnR5waAjkFyHOlFNm4SwVmvHGmtzICrU9+xAnzKKr6h3HM5sVxJxkffICvHw7i1LBL8eTMY7uGQLKsAsx48/OW0gSSGgWqjCOq13YyXvCajI+4UP2DA2fGbKh9YtmRA7IsQ6JQlGpkzPi/ExCKIThmzUnOvPaQ5EMkOXldPWpHjc+KOr8ZZwOmYhWI5augAgLFJDzuoli7NZIzr0ny2nEr6if6cW7SiAaStNAHBH5fbXxPI2JVwPaCfBVoE6161IEakryOJK8PkPGpPkqm+7gQ6tlXH9CGpiwBbaLV5iWfNKFhuhfng/dwca4bl8OdOwikchVQyWZWloA20RTJp4yq17M9uDT/PS4vdMKw2F4gIFEOsATUa0BsTqRnHMchHo8jEY/t3Qt2h0CbaA3TfeQ1k7wbl8JduBLpwNWldjQttxUIyGLpMpQlCi0RTCTiiMViiMe2ShDQdEJtop2fZZKT1yS5IXKXjN/BteVWXH92S0OA0/U+35YFSlLm+ebmJra2NvUJCKJ6UJicWqxoK2YVMBGIKLuhRAZKbccCzyPJJcjwlkqAoJsDiaRaBWxvZ4vuB0KyqACLOcsHnk+Co3kWd+b1xsaGgpIEYpwEdibAdgppmQeQBrI0lxKQIWBbprmPhG0C/Y89RwofM2qS5fu/JIrgSZEkGefI8zjFnsU/D6aGrgKMwKEdydgZvafP/Mn3AhO9b7G7YHe5YXW4YbY6YSxzz7jddrd4KC2cTvMXhYMfczeUgzecV+GwL4eHbP8fuv0VoZ+XlYMAAAAASUVORK5CYII=2a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB3d3AAB2ZnAAAAAAAAAAAAeHh3AAZ3dgAAAAAAAAAAB3d3d3cGd3YAAAAAAAB3d3d4d3eHdnd2AAAAAHd3d3d3f4d3iHZ3dgAAd3d3d3d3d3+Hd4iGd3YAd3d3d3d3d3d/h3eIh4eHAHiIiId3d3d3f4d3iIeIhwB4iIiIiHd3d3+Hd3iHiIcAiIiIiIiId4d/h3eHd3h2AIiId4iIiIf3eId3iId4cACIh4eIiIiHh3iHd3eIeHAAiIf3iIh3d3d4h3d3d3hgAIiHh3eIiIiIeId3d3d3dgCHh3eIiIiIiHiHd3d3iHYAiIiIj//4iIh4h3d3d4hwAI/////4iIiIeId3d3eIcACI/4iId4iIiHiId3cAiHAAd4iIh/d3h3d3d3AAAIhwAAd3iIiIAHAAeIhwAACIcAAAAHd3cAAAB4iIdwAAiHAAAAAAAAAAAHiIiIdwAIhwAAAAAAAAAAeP+IiIdwCIcAAAAAAAAAAAd4/4iIcAiHAAAAAAAAAAAAh3j/iHAIhwAAAAAAAAAAAIiIePhwCIcAAAAAAAAAAACIhwf/cAj3AAAAAAAAAAAAf3AH93AI9wAAAAAAAAAAAPgAeIcACIcAAAAAAAAAAAAAB4hwAAiIAAAAAAAAAAAAAAAAAAAAAAD///////+Dwf//gcH//wBB/+AAAf4AAAHgAAABgAAAAYAAAAGAAAAAgAAAAIAAAACAAAAAgAAAAIAAAAGAAAABgAAAA4AAAAOAAABjgAAD48AAA+P4IAHj//4A4//8AGP//gBj//8AY///AGP//whj//8YY///MOP//+Hj/////w==2b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAIiwAAAAAAAAAAAAAAAAAAiIu7M7sAAAAAAAAAAAAAD4iLM7uzMwAAAAAAAAAAAA+IszcAC7uzBmYAAAAAAAAPiLMwAAAHd2ZmZmYAAAAAD4izMAAEZmZu7mZmRAAAAA+IszAERGbu6IjuZmRAAAAIiLOwQEZu7oiI7uZmQEAACIizswRmbu6IiO7mZmQAAAiLu7NGZm7u5mZu5mZmAAAIi7uzRmZm5kAARuZmZkAAAIu7u3ZmbmAAAABuZmZgBgCLu7u2Zm5gAAAARmZEQAcACLuLt2ZmQAAAAAQAAAAHAAC7e7tmZkZmZmZmZEQACAAAi3i7dkZmZmZmZmZmZAcAAAM3i7dEZmZmZmZmZmQAAAAAN4u7ZEZmZmZmZmZkAAAAAAd4u3YARERmZmZmZAAAAAAEeIu3QAAAAGZmZmQEAAAAAGeIuzcAAAZmZmZkAAAAAABmeIu3ePiGZmZmYEAAAAAARmeIu2ZmZmZmZkQAAAAAAAZ2eIu3d3d3d3YAAAAAAAAAd3eIu4iId3dkYANwAAAAAAeIiIu4iIiGBgALMAAAAAAAR4j4u4iHQEAACzAAAAAAAABHeIe7cEAAAAAwAAAAAAAAAAAAi7MwAAADMAAAAAAAAAAAAAi7uzNzMzAAAAAAAAAAAAAACLu7O7MAAAAAAAAAAAAAAAAAAAAADH////gB///wAH//8BwR//A/AB/wPAAH8DAAAfAgAADwAAAAcAAAAHAAAAA4AA8AGAAfgBwAP8AeAAAAHgAAAB8AAAAfAAAAHwAAAB8AP4AfAB8AP4AAAD+AAAB/wAAA/+AAAM/wAAHP+AADz/4AD+//gA/P//8AD///wB/////w==2c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAIiwAAAAAAAAAAAAAAAAAAiIu7M7sAAAAAAAAAAAAAD4iLM7uzMwAAAAAAAAAAAA+IszcAC7uzBmYAAAAAAAAPiLMwAAAHd2ZmZmYAAAAAD4izMAAEZmZu7mZmRAAAAA+IszAERGbu6IjuZmRAAAAIiLOwQEZu7oiI7uZmQEAACIizswRmbu6IiO7mZmQAAAiLu7NGZm7u5mZu5mZmAAAIi7uzRmZm5kAARuZmZkAAAIu7u3ZmbmAAAABuZmZgBgCLu7u2Zm5gAAAARmZEQAcACLuLt2ZmQAAAAAQAAAAHAAC7e7tmZkZmZmZmZEQACAAAi3i7dkZmZmZmZmZmZAcAAAM3i7dEZmZmZmZmZmQAAAAAN4u7ZEZmZmZmZmZkAAAAAAd4u3YARERmZmZmZAAAAAAEeIu3QAAAAGZmZmQEAAAAAGeIuzcAAAZmZmZkAAAAAABmeIu3ePiGZmZmYEAAAAAARmeIu2ZmZmZmZkQAAAAAAAZ2eIu3d3d3d3YAAAAAAAAAd3eIu4iId3dkYANwAAAAAAeIiIu4iIiGBgALMAAAAAAAR4j4u4iHQEAACzAAAAAAAABHeIe7cEAAAAAwAAAAAAAAAAAAi7MwAAADMAAAAAAAAAAAAAi7uzNzMzAAAAAAAAAAAAAACLu7O7MAAAAAAAAAAAAAAAAAAAAADH////gB///wAH//8BwR//A/AB/wPAAH8DAAAfAgAADwAAAAcAAAAHAAAAA4AA8AGAAfgBwAP8AeAAAAHgAAAB8AAAAfAAAAHwAAAB8AP4AfAB8AP4AAAD+AAAB/wAAA/+AAAM/wAAHP+AADz/4AD+//gA/P//8AD///wB/////w==2d:T608,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAQaSURBVFhH7VdLV1NXGPV/OadWWxV5KPiMaItdC5eCCBR0QULegRgDWCQYwiMEQkBqayu1U1uIHTjSkc7oBEhyc1954O537s3jAjdN0C6YNGvtdZJzc8+3v/09zjlHjvz/OWwFrE43+vptB4p+iwPktwqLzYF379fx5u0Hwvv/FN92epT1do/M4QIBq30Qf6xGPwura6+xFv0La69VrNL3P2mOQW/tHQRMZgeSgoR0SkZKlj4B6nuyDnavx2yIqYwS7oICJrNdmTxI7CGQyWYVAisrr/Dy9zcVYeW3V8hm0gqi0agu8gocvTEBBvZbV4FsjgAzXtOzgNp7YdT1zqPeOIez5hDOWUNodAbRODCDC54pXPROKiT/Xl9HShLKhm1fBK7YlmFwPIXBuYSmwUVc80Rw3buAb0bm0Tw6hxu+EL7zz2oI8J+nAIvHtkaBFu/PaBn+CTcfPcOtxwTfMlr9T9EWWMKd6UW0ByPomAsXCKQlPpeEojpK6qgFU6DKNKwfAkaAF9XYMFk7xl+gy/8rugK/oHv6OW6T8Zv+MJrHg7g65ofBN46mCV+RgCiUVYAZP/3IWZoAx4sFAsbgS9yfeYGmoRBO2sbwhWUIXzoe4sSAB189cOOkdwCnR5waAjkFyHOlFNm4SwVmvHGmtzICrU9+xAnzKKr6h3HM5sVxJxkffICvHw7i1LBL8eTMY7uGQLKsAsx48/OW0gSSGgWqjCOq13YyXvCajI+4UP2DA2fGbKh9YtmRA7IsQ6JQlGpkzPi/ExCKIThmzUnOvPaQ5EMkOXldPWpHjc+KOr8ZZwOmYhWI5augAgLFJDzuoli7NZIzr0ny2nEr6if6cW7SiAaStNAHBH5fbXxPI2JVwPaCfBVoE6161IEakryOJK8PkPGpPkqm+7gQ6tlXH9CGpiwBbaLV5iWfNKFhuhfng/dwca4bl8OdOwikchVQyWZWloA20RTJp4yq17M9uDT/PS4vdMKw2F4gIFEOsATUa0BsTqRnHMchHo8jEY/t3Qt2h0CbaA3TfeQ1k7wbl8JduBLpwNWldjQttxUIyGLpMpQlCi0RTCTiiMViiMe2ShDQdEJtop2fZZKT1yS5IXKXjN/BteVWXH92S0OA0/U+35YFSlLm+ebmJra2NvUJCKJ6UJicWqxoK2YVMBGIKLuhRAZKbccCzyPJJcjwlkqAoJsDiaRaBWxvZ4vuB0KyqACLOcsHnk+Co3kWd+b1xsaGgpIEYpwEdibAdgppmQeQBrI0lxKQIWBbprmPhG0C/Y89RwofM2qS5fu/JIrgSZEkGefI8zjFnsU/D6aGrgKMwKEdydgZvafP/Mn3AhO9b7G7YHe5YXW4YbY6YSxzz7jddrd4KC2cTvMXhYMfczeUgzecV+GwL4eHbP8fuv0VoZ+XlYMAAAAASUVORK5CYII=1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"09fabf74cfc942501d1ccebace1d3ef575a2265f3047381c3bbfb4c45892861a","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790749214470,"unified_at":"2026-09-30T06:20:14.470Z","metadata":{"hashes":{"sha256":"09fabf74cfc942501d1ccebace1d3ef575a2265f3047381c3bbfb4c45892861a","sha1":"2405d8128b25586d1a185a6ba647a1290d9ef85f","md5":"60ea7936b17131949828658c638722f8","sha512":"0659f0b18695bc0efb8b7259e984cda66a38f0d62858c10a9533c70d7a0e356681b721e6cd63d774c692f2f57c3bd9960da699f3be9098d1b16b7bafb3a3ae58","ssdeep":"768:Ypop5IRX+2Wm4ceC0HJtmu0R1Uft92EQ+KPYwdYrJD:Ypy81B4cefKS192zFY","ssdeep_chunks":["768:Ypop5IR","768:pop5IRX","768:op5IRX+","768:p5IRX+2","768:5IRX+2W","768:IRX+2Wm","768:RX+2Wm4","768:X+2Wm4c","768:+2Wm4ce","768:2Wm4ceC","768:Wm4ceC0","768:m4ceC0H","768:4ceC0HJ","768:ceC0HJt","768:eC0HJtm","768:C0HJtmu","768:0HJtmu0","768:HJtmu0R","768:Jtmu0R1","768:tmu0R1U","768:mu0R1Uf","768:u0R1Uft","768:0R1Uft9","768:R1Uft92","768:1Uft92E","768:Uft92EQ","768:ft92EQ+","768:t92EQ+K","768:92EQ+KP","768:2EQ+KPY","768:EQ+KPYw","768:Q+KPYwd","768:+KPYwdY","768:KPYwdYr","768:PYwdYrJ","768:YwdYrJD","1536:Ypop5IR","1536:pop5IRX","1536:op5IRX+","1536:p5IRX+2","1536:5IRX+2W","1536:IRX+2Wm","1536:RX+2Wm4","1536:X+2Wm4c","1536:+2Wm4ce","1536:2Wm4ceC","1536:Wm4ceC0","1536:m4ceC0H","1536:4ceC0HJ","1536:ceC0HJt","1536:eC0HJtm","1536:C0HJtmu","1536:0HJtmu0","1536:HJtmu0R","1536:Jtmu0R1","1536:tmu0R1U","1536:mu0R1Uf","1536:u0R1Uft","1536:0R1Uft9","1536:R1Uft92","1536:1Uft92E","1536:Uft92EQ","1536:ft92EQ+","1536:t92EQ+K","1536:92EQ+KP","1536:2EQ+KPY","1536:EQ+KPYw","1536:Q+KPYwd","1536:+KPYwdY","1536:KPYwdYr","1536:PYwdYrJ","1536:YwdYrJD","768:Ypy81B4","768:py81B4c","768:y81B4ce","768:81B4cef","768:1B4cefK","768:B4cefKS","768:4cefKS1","768:cefKS19","768:efKS192","768:fKS192z","768:KS192zF","768:S192zFY"],"imphash":"ef2dd965c8111a567e96b3efc50681dd"},"file_info":{"file_name":"rad21C10.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":69632,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499287651000,"last_seen":1696627030000,"last_multi_scan":1696627030000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":22,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":12,"suspicious_count":16,"malicious_count":5,"total":33},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Spora.toAY","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Spora","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.TSGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1342257","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Symmi.73169","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.Enchanim.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Symmi.73169 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Filecoder.Spora.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005085ed1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Ransom-Spora!60EA7936B171","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Spora.emgsdr","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Elenoocka-E","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_.52C0D2B3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_.52C0D2B3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/S-26bbd9ea!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.CryptoSpora.I","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Hoax.Spora","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Kryptik.Win32.1119251","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom_.52C0D2B3","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.DLL at 00017434-00001496-43815-23-00404F52\n GetLocalTime@KERNEL32.DLL at 00017434-00001496-49489-28-00404F52","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"\" queries volume information of \"C:\\\" at 00017434-00001496-0000010C-39973671","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"\" queries volume information of \"C:\\\" at 00017434-00001496-0000010C-39973671","origin":"API Call","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"ikoplika.pdb\"\n \"WMIC.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$27","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"iexplore.exe\" (UID: 00022300-00000868)\n Launches browser \"iexplore.exe\" (UID: 00022565-00003372)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c vssadmin.exe delete shadows /quiet /all\" on 2017-3-10.15:11:00.270","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"WMIC.exe\" with commandline \"process call create \"cmd.exe /c vssadmin.exe delete shadows /quiet /all\"\" (UID: 00022181-00001780)\n Spawned process \"iexplore.exe\" with commandline \"%USERPROFILE%\\Desktop\\US76E-7CAAT-AFTZT-XFTEF-THRYY.html\" (UID: 00022300-00000868)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:868 CREDAT:79873\" (UID: 00022565-00003372)\n Spawned process \"cmd.exe\" with commandline \"/c vssadmin.exe delete shadows /quiet /all\" (UID: 00022634-00003800)\n Spawned process \"vssadmin.exe\" with commandline \"delete shadows /quiet /all\" (UID: 00022658-00003824)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameA@ADVAPI32.DLL at 00017434-00001496-43815-23-00404F52","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"ocNqp38QzZ.jpg\" has type \"data\"\n \"healthreport.sqlite\" has type \"data\"\n \"Peacock.jpg\" has type \"data\"\n \"Tulips.jpg\" has type \"data\"\n \"fnHklmDjE.pdf\" has type \"data\"\n \"qn6N701ce7yPWi2.jpg\" has type \"MySQL table definition file Version 157\"\n \"RTgAfRGNR0qKZtig.jpg\" has type \"data\"\n \"MElB1FKqC2cxb6AE.rar\" has type \"Atari ATR image\"\n \"Jellyfish.jpg\" has type \"data\"\n \"ar6cEZyyC.rar\" has type \"data\"\n \"White_Chocolate.jpg\" has type \"data\"\n \"Jm34QKUSbOJ.pdf\" has type \"data\"\n \"DZ1I0FX.rar\" has type \"data\"\n \"rRgk91Ih5n.doc\" has type \"data\"\n \"Hqee3DDn6LduWwwM.pdf\" has type \"data\"\n \"dH1rDN9f9.doc\" has type \"data\"\n \"OONBpjCfe.pdf\" has type \"data\"\n \"hCmeX1Ct3FFL6dk.jpg\" has type \"data\"\n \"Small_News.jpg\" has type \"data\"\n \"rbfKgDSibNA52.rar\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\SYSTEM32\\en-US\\ntdll.dll.mui\"\n \"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" touched file \"%WINDIR%\\system32\\rsaenh.dll\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00017434-00001496-00000105-39978492","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"WMIC.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")\n \"iexplore.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text with unusual entropies 7.37469598168","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"WMIC.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"iexplore.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"iexplore.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_ENUMERATE_SERVICE\" (0x4)\n \"iexplore.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"\" called \"OpenService\" to access the \"LanmanWorkstation\" service\n \"iexplore.exe\" called \"OpenService\" to access the \"rasman\" service\n \"iexplore.exe\" called \"OpenService\" to access the \"Sens\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"iexplore.exe\" called \"OpenService\" to access the \"RASMAN\" service\n \"iexplore.exe\" called \"OpenService\" to access the \"ServicesActive\" service requesting \"SERVICE_QUERY_CONFIG\" (0X1) access rights\n \"iexplore.exe\" called \"OpenService\" to access the \"WSearch\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"level":"suspicious","category":"General","name":"Sent a control code to a service","description":"\"iexplore.exe\" called \"ControlService\" and sent control code \"0X24\" to the service \"WSearch\"\n \"iexplore.exe\" called \"ControlService\" and sent control code \"0XDC\" to the service \"WSearch\"","origin":"API Call","relevance":10,"id":"api-75","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\"\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\HwOrder\" (Filter: 4; Subtree: 0)","origin":"API Call","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"root\\cimv2\" (Indicator: \"root\\cimv2\")","origin":"File/Memory","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Reads system information using Windows Management Instrumentation Commandline (WMIC)","description":"Process \"WMIC.exe\" with commandline \"process call create \"cmd.exe /c vssadmin.exe delete shadows /quiet /all\"\" (UID: 00022181-00001780)","origin":"Monitored Target","relevance":3,"id":"target-10","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"iexplore.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"CopyFileA\n GetFileAttributesW\n GetStartupInfoW\n GetProcAddress\n GetModuleHandleA\n WriteFile\n CreateFileMappingA\n CreateFileW\n OutputDebugStringA\n SleepEx","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$28","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"iexplore.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process using WMIC","description":"Process \"WMIC.exe\" with commandline \"process call create \"cmd.exe /c vssadmin.exe delete shadows /quiet /all\"\" (UID: 00022181-00001780)","origin":"Monitored Target","relevance":5,"id":"target-23","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Deletes the shortcut icon for lnk files (often used by Worms to hide infection)","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCR\\SOFTWARE\\CLASSES\\LNKFILE\"; Key: \"ISSHORTCUT\")","origin":"Registry Access","relevance":10,"id":"registry-59","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"21/60 Antivirus vendors marked sample as malicious (35% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"21/60 Antivirus vendors marked sample as malicious (35% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by Ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"delete shadows /quiet /all\" (UID: 00022658-00003824)","origin":"Monitored Target","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Deletes volume snapshots (often used by Ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the windows installation date"},{"detail":"Reads the active computer name"},{"detail":"Reads system information using Windows Management Instrumentation Commandline (WMIC)"}],"sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Deletes the shortcut icon for lnk files (often used by Worms to hide infection)"}],"sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]}]},"activity":{"stats":{"process_count":6,"spawned_processes_count":6,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":20,"imported_dlls_count":112,"dropped_files_count":0,"extracted_files_count":47,"files_written_count":60,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"58c2a27daac2ed0f6f31fe51","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan","submit_name":"rad21C10.exe","analysis_start_time":"2017-03-10T13:57:50+00:00","indicators_count":{"informative":12,"suspicious":17,"malicious":7},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}],"processes":[{"pid":1496,"ppid":0,"name":"rad21C10.exe","command_line":"","normalized_path":"C:\\rad21C10.exe","uid":"00017434-00001496","icon":"$29"},{"pid":1780,"ppid":1496,"name":"WMIC.exe","command_line":"process call create \"cmd.exe /c vssadmin.exe delete shadows /quiet /all\"","normalized_path":"%WINDIR%\\System32\\wbem\\WMIC.exe","parent_uid":"00017434-00001496","uid":"00022181-00001780","icon":"$2a"},{"pid":868,"ppid":1496,"name":"iexplore.exe","command_line":"C:\\Users\\PSPUBWS\\Desktop\\US76E-7CAAT-AFTZT-XFTEF-THRYY.html","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00017434-00001496","uid":"00022300-00000868","icon":"$2b"},{"pid":3372,"ppid":868,"name":"iexplore.exe","command_line":"SCODEF:868 CREDAT:79873","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00022300-00000868","uid":"00022565-00003372","icon":"$2c"},{"pid":3800,"ppid":0,"name":"cmd.exe","command_line":"/c vssadmin.exe delete shadows /quiet /all","normalized_path":"%WINDIR%\\System32\\cmd.exe","uid":"00022634-00003800","icon":"$2d"},{"pid":3824,"ppid":3800,"name":"vssadmin.exe","command_line":"delete shadows /quiet /all","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","parent_uid":"00022634-00003800","uid":"00022658-00003824"}],"all_imported_dlls":["vssapi.dll","usp10.dll","rpcss.dll","ieframe.dll","dnsapi.dll","wbemsvc.dll","mswsock.dll","ntdll.dll","nddeapi.dll","winmm.dll","sechost.dll","RpcRtRemote.dll","nlaapi.dll","winrnr.dll","duser.dll","authz.dll","shlwapi.dll","oleaut32.dll","cscapi.dll","comctl32.dll","setupapi.dll","cfgmgr32.dll","oleaccrc.dll","KernelBase.dll","msctf.dll","netprofm.dll","rasapi32.dll","msimg32.dll","url.dll","ONBTTN~1.DLL","userenv.dll","gdi32.dll","urlmon.dll","dwmapi.dll","wbemprox.dll","NapiNSP.dll","vss_ps.dll","ole32.dll","davclnt.dll","netutils.dll","ntmarta.dll","ws2_32.dll","sqmapi.dll","rtutils.dll","xmllite.dll","shell32.dll","psapi.dll","Wldap32.dll","secur32.dll","msvcr90.dll","fastprox.dll","mlang.dll","IEShims.dll","cryptdll.dll","advapi32.dll","msasn1.dll","browcli.dll","propsys.dll","npmproxy.dll","SensApi.dll","linkinfo.dll","kernel32.dll","lpk.dll","winsta.dll","wininet.dll","ieproxy.dll","dui70.dll","normaliz.dll","atl.dll","imm32.dll","cryptsp.dll","drprov.dll","davhlpr.dll","sspicli.dll","oleacc.dll","msxml3r.dll","rasadhlp.dll","user32.dll","crypt32.dll","mpr.dll","profapi.dll","iertutil.dll","MSOXMLMF.DLL","WSHTCPIP.DLL","wship6.dll","cryptbase.dll","uxtheme.dll","ExplorerFrame.dll","msvcrt.dll","rpcrt4.dll","clbcatq.dll","wtsapi32.dll","winnsi.dll","wbemcomn.dll","winbrand.dll","midimap.dll","apphelp.dll","devobj.dll","IPHLPAPI.DLL","msxml3.dll","rsaenh.dll","ntlanman.dll","wkscli.dll","nsi.dll","ntdsapi.dll","comdlg32.dll","rasman.dll","pnrpnsp.dll","version.dll","framedynos.dll","ieui.dll","vsstrace.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"3280878823","sha256":"a05e88be9a5d11c92113b88ec027d92134b7c74854e5b5e548a2e374f9c07449","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"RecoveryStore.{BABC3283-05E6-11E7-9104-0A0027618C1B}.dat","sha256":"5687b81e06f5cdd399ed13f480b00dcd1fd500b13b531ed5618fb043528b7c22","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"{BABC3284-05E6-11E7-9104-0A0027618C1B}.dat","sha256":"2f024ab4ad7c44f8642fd7654e7cdf08359d58bdfb62079ca3060f8d528b6eac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"frameiconcache.dat","sha256":"453dc1a6f88ef04ec42e96791fba660eadcaf6a6b194af882206e57297e8ec64","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"ocNqp38QzZ.jpg","sha256":"4845f930bd3d57d8946d8f998e22a5397d1e5571eec48551e2f582078deef611","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"healthreport.sqlite","sha256":"7a666b2fb946c35365e327023c2d7810499f6268f79eb5ddc379e8363e1ed332","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"Peacock.jpg","sha256":"f063c17dcc958036b07aa310f1ff5b1e3f3aaec3667a2a983b7340b1fb27a955","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"Tulips.jpg","sha256":"30154b758e0f031539720b618de7b7f16699c844179e4b0542f82fbebbbd4c73","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"fnHklmDjE.pdf","sha256":"7011ef841a5c4b97df1f6a35f77b2fb25da2d16022fb82190f3effdb0224e591","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"qn6N701ce7yPWi2.jpg","sha256":"7205bd3fc2652429e4cc14436705490eb9ac3f10f2f0c6b202a74b0b4e461de7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"RTgAfRGNR0qKZtig.jpg","sha256":"48224f298d6829a3edcd1119546d7e91b58979305cafce1f6f52ca2fdd5591e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"MElB1FKqC2cxb6AE.rar","sha256":"76e97e77734122ae7dc338a8641b03c12f6eea4a820574185f892e2fd304524d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"Jellyfish.jpg","sha256":"43370a1656c8deacd31da3b265914e4d096a4b2fb268aa2759ed1dfd35dbd9df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"ar6cEZyyC.rar","sha256":"4731fbd1f8cb748dc69680abc026d40c5a95842004dd45d4fee284ebabc3e30f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"White_Chocolate.jpg","sha256":"fc34a04ca5cc8d99c0e2b2d26151dfb14c22a1f7967ce8e301ea096ec87995a7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"Jm34QKUSbOJ.pdf","sha256":"7566acdf79bc873972fc8a2277484933ac4ddf8986fe2c267a4bb20bc600fabc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"DZ1I0FX.rar","sha256":"4329f70bef148ed84e074a5106f832b83bc3207dba239e4f4257195306db9005","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"rRgk91Ih5n.doc","sha256":"4d240e7b3879052713c07c6490e39ef6e0b5c80b80359e7b6f80624ad9fb9055","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"Hqee3DDn6LduWwwM.pdf","sha256":"263455417c5c595cfe2c5727c7d09eae247cbe22d010309715cea537a5566a74","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"dH1rDN9f9.doc","sha256":"d117b8da37ef41d778fa40bf59072bb189c0874ad04595c0ffd8bec30c56bdcc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"Windows.lnk","sha256":"255c41b0c0565dd712bd766434209f21e71a352bdab5ba026767a17f3b04ddec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"PerfLogs.lnk","sha256":"fb22bd46da0299d52173956970c83d6c797a1b52fcc65c9fdb2eb58139512a0e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"6SZfLTu9z.doc","sha256":"7acd4d57ad8bd6d1e6480b5ca320a37ef93a15a0c41bbf8457abf586080f4996","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"lCEf83Wf7e4nuIMk.doc","sha256":"7d3be3bfe685e25fececa378912fac1f3db2b6f5734c457243f73ac261646afb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"C04T72pR0Bcl.doc","sha256":"7fe84cc8f66483de6355dfa33f5c1a63c3ee4fe5b85cbc637220354f1cd2989d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"w5JaoO.doc","sha256":"36edb1bf4c478ac34bf759071eaab522b4a1df2048c38dc8095e835722ba2d85","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"NNDFu.lnk","sha256":"3489496caa50e69a654357a15324cc1169be6099ff4ee55a2797a6d6952877cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"obSP1kkndHWX46p.doc","sha256":"6d77e0595d4dc248cd7d907bbc2d4cc8c312749b0a435ece630cbc8a5e1c9cfe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"yhdKAQbz.lnk","sha256":"ad119c941e1eef05312bf50f2dc59f24f886552f8b0e7e856b6b7f10f729550d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"2Gd1Iqvl2kr.doc","sha256":"966f65c107276126f2fd512af0da037fe37b89d655670b748be1d3b3afafdcb0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"bg3oTe.doc","sha256":"94a4e43be42ca480a9aa8c38404cc6d002362bf821c964761a576b06278500f1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"0zIG0D.doc","sha256":"35141b3e6c7c7188cc5c15e32bf3a8fef0f18acc747ea552fb267d55a1922175","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"Program Files.lnk","sha256":"03d3c5e4c69b3f37cae70709121c40691ece194ca05d0d4b76b6d13dff6ef917","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"Iggb26po.lnk","sha256":"7b8ad5d235746068da0032f4b369dfde0b9f0eba871531bd006bce9bd9f00057","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"vyi8eCg.doc","sha256":"50260df4e7f124ed0fa914041eeeff2430551a3d21ef94ec8e669851a33a9302","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"klmqz.doc","sha256":"c9a9d6c7585020faee62ed1894389061006ffdc93091303843785b5472a50ef2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"mtgFs8Za.doc","sha256":"0db00712d5a934bb89442c863047c5e4686b0f09bf7ca6ec743cc6ca4b75ba05","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"4Pmmh3HlYKPz20b.doc","sha256":"c652c0f028d206be63f98ba17ba85f2203770b0b3f571abacedb5e8f3563f8ac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"F3hzum1.doc","sha256":"d292a98cb6539f52d16e639403d058d0f6f125e2905abd06f82fa95ef207c148","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"Tmg2wsFHYf9ioO.doc","sha256":"9b0e4a534e63eed4441644be51ff064550a08490729312b10b1ad8b536c9ffb8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"hKY8.doc","sha256":"588521ef1605f46fdb4d41935fa02a18b04fdcefc01b595b4c5c57a1659a5d61","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"5F1yaAIKfUGQcmmt.doc","sha256":"517ab01407ef47a1f5dad294780010a2d723e78ec8c55680621c5cb5813338b0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"Users.lnk","sha256":"ac2db0d6d1e84d1c9c005dd9d67eb7f0280ba6e21eaa9c482d538f49ad2b8ffa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"0gakl8ixtWMkw.doc","sha256":"e1fafab1e96566a33ba0a7fc71cede0eaf057039b0428bf5e1006a2c229e835d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"EKeaJO.doc","sha256":"69704153edb9a0d98b4b0965fd9384bc28f7846d1440102725d414ba6b3a1619","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"FksnKO3nPLqbqw.doc","sha256":"e28a114bef46980513f0a39d27075752c95ef97a7efd83514702767665bcf76e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"3Fbc.doc","sha256":"918670968d51cfe11077d6545ecff413f38db00c1b3ca4a4915dd62967cba3aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]}],"files_written":[{"path":"C:\\jcqvtlcgekcjvmvk","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%WINDIR%\\SYSTEM32\\en-US\\ntdll.dll.mui","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%APPDATA%\\3280878823","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%WINDIR%\\System32\\wbem\\en-US\\WMIC.exe.mui","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%WINDIR%\\system32\\wbem\\XSL-Mappings.xml","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%USERPROFILE%\\Desktop","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\en\\iexplore.exe.mui","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\en-US\\iexplore.exe.mui","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%WINDIR%\\system32\\OLEACCRC.DLL","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"C:\\Users\\21RkEBP","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%WINDIR%\\system32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%WINDIR%\\system32\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%WINDIR%\\system32\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%WINDIR%\\system32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%USERPROFILE%\\Favorites","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\frameiconcache.dat","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%PROGRAMFILES%\\MICROS~3\\Office14\\ONBttnIE.dll","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%PROGRAMFILES%\\MICROS~3\\Office14\\ONBTTN~1.DLL","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%USERPROFILE%\\Favorites\\Links","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%WINDIR%\\system32\\en-US\\IEFRAME.dll.mui","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\Suggested Sites.url","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\Suggested Sites.url:favicon","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\Web Slice Gallery.url","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\4shared.com.url","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\5pk.com.url","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\7k7k.com.url","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\17kuxun.com.url","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\27.cn.url","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%WINDIR%\\system32\\url.dll","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%TEMP%\\~DF13D77C64360C8E39.TMP","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{BABC3284-05E6-11E7-9104-0A0027618C1B}.dat","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%TEMP%\\~DF75C3A6910A1A0E8F.TMP","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{BABC3283-05E6-11E7-9104-0A0027618C1B}.dat","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.HTML\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"key":"HKLM\\SOFTWARE\\REGISTEREDAPPLICATIONS\\","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.HTML\\OPENWITHLIST\\","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"m3280878823","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"Local\\MidiMapper_modLongMessage_RefCnt","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MidiMapper_modLongMessage_RefCnt","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\m3280878823","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!21rkebp!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!21rkebp!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!21rkebp!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ConnHashTable<868>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"58c2a27daac2ed0f6f31fe51"}]}]}},"report_ids":{"sandbox_job_ids":["58c2a27daac2ed0f6f31fe51"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Ransom_.52C0D2B3 Sample 09fabf74cfc9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 09fabf74cfc9…. Malware family: Ransom_.52C0D2B3. Threat score 100/100. 22/28 AV engines flagged this file. 5 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/09fabf74cfc942501d1ccebace1d3ef575a2265f3047381c3bbfb4c45892861a"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom_.52C0D2B3 Sample 09fabf74cfc9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 09fabf74cfc9…. Malware family: Ransom_.52C0D2B3. Threat score 100/100. 22/28 AV engines flagged this file. 5 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/09fabf74cfc942501d1ccebace1d3ef575a2265f3047381c3bbfb4c45892861a"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom_.52C0D2B3 Sample 09fabf74cfc9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 09fabf74cfc9…. Malware family: Ransom_.52C0D2B3. Threat score 100/100. 22/28 AV engines flagged this file. 5 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2e","11",{}]]