23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T481,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample 2f5dec0a8e1d… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2f5dec0a8e1d…. Malware family: Malware. Threat score 100/100. 22/28 AV engines flagged this file. 8 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc"],"about":{"@type":"SoftwareApplication","name":"2018-10-20_21-10-02.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":22,"total":28},"behavioralIndicators":{"malicious":8,"suspicious":25},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T839,".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")25:T789,".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA"; Key: "BLOB") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135"; Key: "BLOB") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") ".exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")26:T69e,".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch" ".exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" ".exe" touched file "C:\Windows\assembly\NativeImages_v2.0.50727_32\index23c.dat" ".exe" touched file "C:\Windows\System32\rsaenh.dll" ".exe" touched file "C:\Windows\System32\l_intl.nls" ".exe" touched file "C:\Windows\assembly\pubpol47.dat" ".exe" touched file "C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp"27:T45e,"ww.torproject.org/dist/torbrowser/8.0.2/tor-win32-0.3.4.8.zip" "polipo": "http://raw.githubusercontent.com/turbo/TorGateway/master/polipo.exe" "user_agent": "Kraken web request agent/v%1" "proxy": "127.0.0.1:9050" "listener": "127.0.0.1:8123" "host": "http://kraken656kn6wyyx.onion/api/%1" "api": "status=%1&os=%2&username=%3&hwid=%4&ip=%5&country=%6&city=%7&language=%8&hdcount=%9&hdtype=%a&hdname=%b&hdfull=%c&hdfree=%d&privilege=%e&operate=%f&beta=%g" } "help_note": { "name": "Instructions-%1" "txt": "# All your files has been encrypted by \"KRAKEN CRYPTOR\".\r\n# Read the following instructions carefully to decrypt your files.\r\n\r\n-----BEGIN KRAKEN ENCRYPTED UNIQUE KEY-----\r\n%Encrypted\r\n-----END KRAKEN ENCRYPTED UNIQUE KEY-----\r\n\r\nExtension: %Extension\r\n\r\n(What happened to my computer)?\r\n\r\nAll of your files such as documents, images, videos and other files with the different names and extensions are encrypted by \"KRA" (Source: 2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc.bin, Indicator: "decrypt your files")28:T951,".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") ".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") ".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") ".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") ".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") ".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") ".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") ".exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") ".exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")29:T506,".exe" wrote bytes "77393d7779a84177be724177d62d41771de23c7705a24177c868407757d14777bee33c77616f417768413f7700503f7700000000ad3750778b2d5077b641507700000000" to virtual address "0x74F41000" (part of module "WSHIP6.DLL") ".exe" wrote bytes "40533f7758584077186a4077653c41770000000000bf25770000000056cc2577000000007cca257700000000376873756a2c4177d62d417700000000206973750000000029a6257700000000a48d737500000000f70e257700000000" to virtual address "0x75A71000" (part of module "NSI.DLL") ".exe" wrote bytes "92e63c7779a84177be724177d62d41771de23c7705a24177bee33c77616f417768413f7700503f7700000000ad3750778b2d5077b641507700000000" to virtual address "0x74A71000" (part of module "WSHTCPIP.DLL") ".exe" wrote bytes "db4dd86d00000000" to virtual address "0x01382000" (part of module "2F5DEC0A8E1DA5F23B818D48EFB0B9B7065023D67C617A78CD8B14808A79C0DC.EXE") ".exe" wrote bytes "6a4ee485" to virtual address "0x6A711FDC" (part of module "MSCORWKS.DLL") "PING.EXE" wrote bytes "40533f7758584077186a4077653c41770000000000bf25770000000056cc2577000000007cca257700000000376873756a2c4177d62d417700000000206973750000000029a6257700000000a48d737500000000f70e257700000000" to virtual address "0x75A71000" (part of module "NSI.DLL")2a:T754,Found malicious artifacts related to "216.239.36.21": ... URL: http://search2torrent.com/2014/05/1337xto-download-verified-torrents.html (AV positives: 4/68 scanned on 10/20/2018 11:44:03) URL: http://servisborair.com/2018/03/jasa-pengeboran-air-jet-pump-artesis.html (AV positives: 4/68 scanned on 10/20/2018 10:43:46) URL: http://gnbc.ky/ttbu/IMBuch/gate.php (AV positives: 3/68 scanned on 10/20/2018 10:00:43) URL: http://irfansyahputra.web.id/2014/10/pengertian-dan-contoh-paragraf-deskripsi.html (AV positives: 3/68 scanned on 10/20/2018 09:47:36) URL: http://thehelpvn.org/2014/02/the-joy-of-generosity-ten-reasons.html (AV positives: 5/68 scanned on 10/20/2018 09:37:49) File SHA256: f855958f01d5d0ceaa379ce5034b7cdeb60ccae8caa1bb7e438cd98b246f9154 (AV positives: 43/58 scanned on 10/20/2018 08:10:46) File SHA256: 70c65bd0e084398a87baa298c1fafa52afff402096cb350d563d309565c07e83 (AV positives: 1/57 scanned on 10/20/2018 03:43:12) File SHA256: 950f22e72b08cb9c51e5b6a0455ff5fceb2fd26367bcd5c86be503ab38eb08bb (AV positives: 47/68 scanned on 10/20/2018 06:42:52) File SHA256: dae5f64a40d766ec826dbdb5e15b85750db691a1a632d026b50ff4e0bb41cb29 (AV positives: 51/67 scanned on 10/20/2018 03:34:26) File SHA256: e3b4f1767f79de976124a6758147565633667b50845bd1613d5faa3217aaad4a (AV positives: 32/68 scanned on 10/20/2018 00:11:51) File SHA256: 331cc2c2ff6959ae22e912712688fcf9c89efd074bdd4a167f3699c726ad205f (Date: 10/18/2018 09:25:52) File SHA256: 5e94db0bb1bd45337bed3774a1e87f31a74b7cf115c13bcea62f1af20b86bb65 (Date: 10/18/2018 06:51:10) File SHA256: 2eacbe3dd84ce97215415eb0de672a2ad6298e0bbb839d9ce4af0276fe454a9f (Date: 10/17/2018 05:29:05) File SHA256: 510ee55b704aeb40ad57596983da14a0a5cd7a543f7488a858ffbe446edac3f7 (Date: 10/14/2018 20:05:46) File SHA256: 50d5bd884ac287ff3278c01954c804fe0a33af83530be6976c5d9d7bc222d9ce (Date: 10/14/2018 20:05:13)2b:T744,".exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\RASAPI32" (Filter: 14; Subtree: 851200) ".exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\RASAPI32" (Filter: 14; Subtree: 4826880) ".exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9" (Filter: 1; Subtree: 4575744) ".exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\NameSpace_Catalog5" (Filter: 1; Subtree: 4575744) ".exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\RASMANCS" (Filter: 14; Subtree: 851200) ".exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\RASAPI32" (Filter: 14; Subtree: 4849664) ".exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\RASMANCS" (Filter: 14; Subtree: 4849664) ".exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" (Filter: 4; Subtree: 851201) ".exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" (Filter: 4; Subtree: 851201) ".exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" (Filter: 4; Subtree: 851201) "tasklist.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder" (Filter: 4; Subtree: 2612736) "PING.EXE" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9" (Filter: 1; Subtree: 5368064) "PING.EXE" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\NameSpace_Catalog5" (Filter: 1; Subtree: 5368064)2c:Ta36,"C:\2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc.exe" marked "C:\PerfLogs\Touch" for deletion "C:\2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc.exe" marked "C:\PerfLogs\Admin\Touch" for deletion "C:\2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc.exe" marked "C:\Program Files\Touch" for deletion "C:\2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc.exe" marked "C:\Program Files (x86)\Touch" for deletion "C:\2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc.exe" marked "C:\setuppackages\Touch" for deletion "C:\2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc.exe" marked "C:\Users\Touch" for deletion "C:\2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc.exe" marked "C:\Users\%OSUSER%\Touch" for deletion "C:\2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc.exe" marked "C:\Users\%OSUSER%\Contacts\Touch" for deletion "C:\2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc.exe" marked "C:\Users\%OSUSER%\Desktop\Touch" for deletion "C:\2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc.exe" marked "C:\Users\%OSUSER%\Documents\Touch" for deletion "C:\2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc.exe" marked "C:\Users\%OSUSER%\Documents\Outlook Files\Touch" for deletion "C:\2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc.exe" marked "C:\Users\%OSUSER%\Downloads\Touch" for deletion "C:\2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc.exe" marked "C:\Users\%OSUSER%\Favorites\Touch" for deletion "C:\2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc.exe" marked "C:\Users\%OSUSER%\Favorites\Links\Touch" for deletion "C:\2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc.exe" marked "C:\Users\%OSUSER%\Favorites\Links for United States\Touch" for deletion "C:\2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc.exe" marked "C:\Users\%OSUSER%\Favorites\Microsoft Websites\Touch" for deletion "C:\2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc.exe" marked "C:\Users\%OSUSER%\Favorites\MSN Websites\Touch" for deletion "C:\2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc.exe" marked "C:\Users\%OSUSER%\Favorites\Windows Live\Touch" for deletion "C:\2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc.exe" marked "C:\Users\%OSUSER%\Links\Touch" for deletion "C:\2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc.exe" marked "C:\Users\%OSUSER%\Music\Touch" for deletion2d:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791208922353,"unified_at":"2026-10-05T14:02:02.353Z","metadata":{"hashes":{"sha256":"2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc","sha1":"d8d8fad628b871ddfcddb01730456d03e67188ee","md5":"34add6e208c0b4efbb87d42fc7eb99c6","sha512":"387f5bdb37668c2e1a9e39564ee7b88d3e461a1c3d1f1b3dc0217d0411bf760b4f5e67587f3fe83dde1fce750061246529623f90472566236379883b0a8eb7b9","ssdeep":"3072:z8kKioE17C73VycIJprT5bxadKJwMHL29Y:dKiosw3JmB9bZHr29","ssdeep_chunks":["3072:z8kKioE","3072:8kKioE1","3072:kKioE17","3072:KioE17C","3072:ioE17C7","3072:oE17C73","3072:E17C73V","3072:17C73Vy","3072:7C73Vyc","3072:C73VycI","3072:73VycIJ","3072:3VycIJp","3072:VycIJpr","3072:ycIJprT","3072:cIJprT5","3072:IJprT5b","3072:JprT5bx","3072:prT5bxa","3072:rT5bxad","3072:T5bxadK","3072:5bxadKJ","3072:bxadKJw","3072:xadKJwM","3072:adKJwMH","3072:dKJwMHL","3072:KJwMHL2","3072:JwMHL29","3072:wMHL29Y","6144:z8kKioE","6144:8kKioE1","6144:kKioE17","6144:KioE17C","6144:ioE17C7","6144:oE17C73","6144:E17C73V","6144:17C73Vy","6144:7C73Vyc","6144:C73VycI","6144:73VycIJ","6144:3VycIJp","6144:VycIJpr","6144:ycIJprT","6144:cIJprT5","6144:IJprT5b","6144:JprT5bx","6144:prT5bxa","6144:rT5bxad","6144:T5bxadK","6144:5bxadKJ","6144:bxadKJw","6144:xadKJwM","6144:adKJwMH","6144:dKJwMHL","6144:KJwMHL2","6144:JwMHL29","6144:wMHL29Y","3072:dKiosw3","3072:Kiosw3J","3072:iosw3Jm","3072:osw3JmB","3072:sw3JmB9","3072:w3JmB9b","3072:3JmB9bZ","3072:JmB9bZH","3072:mB9bZHr","3072:B9bZHr2","3072:9bZHr29"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"2018-10-20_21-10-02.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":139776,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1540038035000,"last_seen":1632942900000,"last_multi_scan":1632942900000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["bladabindi","faceliker","filecoder","njrat","occamy","ransomware","rat","crypt","downloader","genasom","kraken","krakencryptor","krakenrat","cerber","evasive"]},"stats":{"av":{"malicious_count":22,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":12},"sandbox_signatures":{"informative_count":16,"suspicious_count":25,"malicious_count":8,"total":49},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"Ahnlab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Genasom","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.Torjok","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Ransom.sogzl","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"BitDefender","success":true,"verdict":"malicious","threat_name":"Trojan.Ransomware.GenericKD.42029849","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Ransomware.GenericKD.42029849 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Filecoder.PI trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/MSIL.LockFile.c","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"Ikarus","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.FileCrypter","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0053d3441 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.MSIL.TorJok.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.dzk","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.TorJok.fjkbmp","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Trojan.Kraken.S4164858","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Threat-Generic://Malicious-Confidence_95","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Ransom-FCD","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Ransom.Kraken","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"TrendMicro","success":true,"verdict":"malicious","threat_name":"Ransom_.81545C40","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"TrendMicro House Call","success":true,"verdict":"malicious","threat_name":"Ransom_.81545C40","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TScope.Trojan.MSIL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xviruspersonalguard":{"name":"Xvirus Personal Guard","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.TorJok.Win32.25","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Malware","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Service Execution","attack_id":"T1035","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","identifiers":[{"type":"suspicious","value":"Opened the service control manager"}],"sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"},{"type":"suspicious","value":"References suspicious system modules"}],"sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"suspicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"malicious","value":"Modifies file/console tracing settings (often used to hide footprints on system)"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Reads the registry for installed applications"},{"type":"suspicious","value":"Monitors specific registry key for changes"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1018","identifiers":[{"type":"suspicious","value":"Checks network status using ping"}],"sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","identifiers":[{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$24","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$25","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"216.239.36.21:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking\"\n \"\\Sessions\\1\\BaseNamedObjects\\MSVI64\"\n \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\".exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\d40b99d82652dbbc000d378a824ae296\\mscorlib.ni.dll\" at 69C10000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/C ping 127.0.0.1 -n 3 > NUL&&del /Q /F /S \"C:\\2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc.exe\"\" on 2018-10-20.16:09:00.250","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/C ping 127.0.0.1 -n 3 > NUL&&del /Q /F /S \"C:\\2f5dec0a8e1da5f23 ...\" (UID: 00091229-00000260), Spawned process \"PING.EXE\" with commandline \"ping 127.0.0.1 -n 3\" (UID: 00091503-00003684)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"cmd.exe\" with commandline \"/C ping 127.0.0.1 -n 3 > NUL&&del /Q /F /S \"C:\\2f5dec0a8e1da5f23 ...\" (UID: 00091229-00000260), Spawned process \"PING.EXE\" with commandline \"ping 127.0.0.1 -n 3\" (UID: 00091503-00003684)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$26","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"Yandex.ru\"\n Pattern match: \"ww.torproject.org/dist/torbrowser/8.0.2/tor-win32-0.3.4.8.zip\"\n Pattern match: \"en.wikipedia.org/wiki/Bitcoin\\r\\nThis\"\n Pattern match: \"http://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit\\\"\n Pattern match: \"http://schemas.microsoft.com/SMI/2005/WindowsSettings\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\".exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\".exe\" at 00088690-00003292-00000105-15179563690","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\".exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"\"rw2\", \"rwl\", \"rwz\", \"s3db\", \"safe\", \"sas7bdat\", \"sav\", \"save\", \"say\", \"sd0\", \"sda\", \"sdb\", \"sdf\", \"sh\", \"sldm\", \"sldx\", \"sql\", \"sqlite\", \"sqlite-shm\", \"sqlite-wal\", \"sqlite3\", \"sqlitedb\", \"sr2\", \"srb\", \"srf\", \"srs\", \"srt\", \"srw\", \"st4\", \"st5\", \"st6\", \"st7\", \"st8\", \"stc\", \"std\", \"sti\", \"stm\", \"stw\", \"stx\", \"svg\", \"swf\", \"sxc\", \"sxd\", \"sxg\", \"sxi\", \"sxm\", \"sxw\", \"tbb\", \"tbn\", \"tex\", \"tga\", \"thm\", \"tlg\", \"tlx\", \"txt\", \"usr\", \"vbox\", \"vdi\", \"vhd\", \"vhdx\", \"vmdk\", \"vmsd\", \"vmx\", \"vmxf\", \"vob\", \"wab\", \"wad\", \"wallet\", \"war\", \"wav\",\" (Indicator: \"vbox\")","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\".exe\" called \"OpenSCManager\" requesting access rights \"0X0\"\n \".exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","mitre_attack_id":"T1035","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\".exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"cmd.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\PING.EXE\" (Handle: 88)\n \"cmd.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\PING.EXE\" (Handle: 88)\n \"cmd.exe\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\PING.EXE\" (Handle: 88)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"System.Core,3.5.0.0,,b77a5c561934e089,MSIL\"\n Heuristic match: \"Pinging 127.0.0.1\"\n Heuristic match: \"Reply from 127.0.0.1:\"\n Heuristic match: \"Ping statistics for 127.0.0.1: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),\"\n Heuristic match: \"/C ping 127.0.0.1 -n 3 > NUL&&del /Q /F /S \"C:\\2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc.exe\"\"\n Heuristic match: \"ping 127.0.0.1 -n 3\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 216.239.36.21 on port 443 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"$27","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Checks network status using ping","description":"Process \"PING.EXE\" with commandline \"ping 127.0.0.1 -n 3\" (UID: 00091503-00003684)","origin":"Monitored Target","mitre_attack_id":"T1018","relevance":5,"id":"target-22","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\".exe\" opened \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch.3292.4494676\" with delete access\n \".exe\" opened \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch.3292.4494676\" with delete access\n \".exe\" opened \"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3292.4495277\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$28","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\".exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"GetDeviceCaps\" (Source: 2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc.bin, API is part of module: GDI32.DLL)\n Found string \"StrongNameSignatureVerificationEx\" (Source: 2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc.bin, API is part of module: MSCORWKS.DLL)\n Found string \"GetLogicalDrives\" (Source: 2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc.bin, API is part of module: KERNELBASE.DLL)\n Found string \"DriveType\" (Source: 2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc.bin, API is part of module: SHELL32.DLL)","origin":"File/Memory","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$29","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Modifies file/console tracing settings (often used to hide footprints on system)","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLEFILETRACING\"; Value: \"00000000\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLECONSOLETRACING\"; Value: \"00000000\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"FILETRACINGMASK\"; Value: \"0000FFFF\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"CONSOLETRACINGMASK\"; Value: \"0000FFFF\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":5,"id":"registry-30","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"level":"malicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)\" (SID: 2025331, Rev: 3, Severity: 1) categorized as \"A Network Trojan was detected\"\n Detected alert \"ET POLICY Possible External IP Lookup SSL Cert Observed (ipinfo.io)\" (SID: 2025330, Rev: 2, Severity: 1) categorized as \"Potential Corporate Privacy Violation\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"12/67 Antivirus vendors marked sample as malicious (17% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"12/67 Antivirus vendors marked sample as malicious (17% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\".exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2a","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"Instructions-CIZ84.html\" has type \"HTML document ASCII text with very long lines with CRLF line terminators\"\n \"Outlook.pst\" has type \"data\"\n \"Database1.accdb\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\".exe\" queried SystemProcessInformation at 00034147-00000664-00000033-72469185941\n \"tasklist.exe\" queried SystemProcessInformation at 00035886-00002692-00000033-63211958940\n \"tasklist.exe\" queried SystemProcessInformation at 00035886-00002692-00000033-63213554028","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"\"https://download.sysinternals.com/files/SDelete.zip\" (Indicator: \"sysinternals\")\n \"REM [Microsoft Sysinternals Eula Accepted]\" (Indicator: \"sysinternals\")\n \"REG ADD \\\"HKEY_CURRENT_USER\\\\Software\\\\Sysinternals\\\\SDelete\\\"\" (Indicator: \"sysinternals\")\n \"REG ADD \\\"HKEY_CURRENT_USER\\\\Software\\\\Sysinternals\\\\SDelete\\\" /v EulaAccepted /t REG_DWORD /d 1 /f\" (Indicator: \"sysinternals\")\n \"Sysinternals: www.sysinternals.com\" (Indicator: \"sysinternals\")","origin":"File/Memory","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"nikolatesla@cock.li\"\n Pattern match: \"nikolateslaproton@protonmail.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\".exe\" is creating a new process (Name: \"%WINDIR%\\SysWOW64\\tasklist.exe\", Handle: 920)\n \"cmd.exe\" is creating a new process (Name: \"%WINDIR%\\SysWOW64\\PING.EXE\", Handle: 128)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"$2b","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"%WINDIR%\\system32\\wbem\\wmiprvse.exe\" (Indicator: \"wmiprvse.exe\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$2c","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"References suspicious system modules","description":"\"csrss.exe\"\n \"lsass.exe\"","origin":"File/Memory","mitre_attack_id":"T1215","relevance":5,"id":"string-24","sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"\"https://ipinfo.io/json\" (Indicator: \"ipinfo.io\"; File: \"2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc.bin\")","origin":"File/Memory","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"cerber\" classified file \"all.bstring\" as \"ransomware,cerber\" based on indicators: \"torproject,netsh,taskkill\" (Author: Leo Fernandes - iDefense)","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Modifies file/console tracing settings (often used to hide footprints on system)"},{"detail":"Possibly tries to implement anti-virtualization techniques"},{"detail":"Checks network status using ping"}],"sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":7,"imported_dlls_count":118,"dropped_files_count":0,"extracted_files_count":5,"files_written_count":63,"files_deleted_count":0,"registry_keys_created_count":6,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":6,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["bladabindi","faceliker","filecoder","njrat","occamy","ransomware","rat","crypt","downloader","genasom","kraken","krakencryptor","krakenrat","cerber","evasive"],"sample_flags":["Network Traffic","TOR analysis","Extracted Files","Sample not shared"],"sandbox_reports":[{"id":"5bd9c6c07ca3e16a48507b8e","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc.exe","analysis_start_time":"2018-10-31T16:17:20+00:00","indicators_count":{"informative":12,"suspicious":23,"malicious":7},"tags":["Extracted Files","Sample not shared","TOR analysis"],"is_in_unified_schema":true},{"id":"5bcb1d927ca3e118bf326833","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"HEUR:Trojan.MSIL.TorJok","contacted_countries":["USA"],"submit_name":"2018-10-20_21-10-02.exe","analysis_start_time":"2018-10-20T14:20:48+00:00","indicators_count":{"informative":15,"suspicious":22,"malicious":7},"tags":["Network Traffic","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"216.239.36.21","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}],"processes":[{"pid":664,"ppid":0,"name":"2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc.exe","command_line":"","sha256":"2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc","normalized_path":"C:\\2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc.exe","uid":"00034147-00000664","icon":"$2d"},{"pid":2692,"ppid":664,"name":"tasklist.exe","command_line":"\"tasklist\" /V /FO CSV","sha256":"ad3e811249da750d80f2762c3aeb403780c1b69d05911e3c9950a7daed9e6670","normalized_path":"%WINDIR%\\SysWOW64\\tasklist.exe","parent_uid":"00034147-00000664","uid":"00035886-00002692"},{"pid":2080,"ppid":664,"name":"cmd.exe","command_line":"/C ping 127.0.0.1 -n 3 > NUL&&del /Q /F /S \"C:\\2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00034147-00000664","uid":"00037698-00002080"},{"pid":856,"ppid":2080,"name":"PING.EXE","command_line":"ping 127.0.0.1 -n 3","sha256":"4ca10dba7ff487fdb3f1362a3681d7d929f5aa1262cdfd31b04c30826983fb1d","normalized_path":"%WINDIR%\\SysWOW64\\PING.EXE","parent_uid":"00037698-00002080","uid":"00037705-00000856"}],"all_imported_dlls":["ieframe.dll","ntmarta.dll","wshqos.dll","msvcr80.dll","webio.dll","IPHLPAPI.DLL","dhcpcsvc.dll","msasn1.dll","userenv.dll","apphelp.dll","usp10.dll","mscorrc.dll","System.Configuration.ni.dll","winnsi.dll","credssp.dll","cfgmgr32.dll","dnsapi.dll","bcryptprimitives.dll","oleaut32.dll","security.dll","ntdll.dll","shlwapi.dll","mscorwks.dll","mscorlib.ni.dll","rpcss.dll","ws2_32.dll","WSHTCPIP.DLL","dhcpcsvc6.dll","advapi32.dll","sechost.dll","user32.dll","winhttp.dll","schannel.dll","ncrypt.dll","devobj.dll","Wldap32.dll","gdi32.dll","profapi.dll","rasapi32.dll","tzres.dll","sspicli.dll","crypt32.dll","propsys.dll","oleacc.dll","msvcrt.dll","msctf.dll","clbcatq.dll","iertutil.dll","winbrand.dll","cryptsp.dll","System.ni.dll","System.Xml.ni.dll","rasadhlp.dll","System.Drawing.ni.dll","comctl32.dll","oleaccrc.dll","shell32.dll","cryptbase.dll","System.Core.ni.dll","bcrypt.dll","mscoreei.dll","rsaenh.dll","psapi.dll","urlmon.dll","KernelBase.dll","rpcrt4.dll","lpk.dll","rtutils.dll","RpcRtRemote.dll","mscoree.dll","kernel32.dll","ole32.dll","rasman.dll","setupapi.dll","uxtheme.dll","mscorjit.dll","secur32.dll","imm32.dll","nsi.dll","wship6.dll","FWPUCLNT.DLL","System.Windows.Forms.ni.dll","wininet.dll","mswsock.dll","gpapi.dll","wbemsvc.dll","GdiPlus.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","wmiutils.dll","wow64.dll","netapi32.dll","cscapi.dll","IconCodecService.dll","wbemcomn.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","WindowsCodecs.dll","dbghelp.dll","api-ms-win-downlevel-user32-l1-1-0.dll","ntdsapi.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","mpr.dll","wtsapi32.dll","winsta.dll","wow64cpu.dll","framedynos.dll","version.dll","wow64win.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","Culture.dll","normaliz.dll","wbemprox.dll","shfolder.dll","srvcli.dll","wkscli.dll","netutils.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","fastprox.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Instructions-CIZ84.html","sha256":"1dee0f7282478b6462fc6eb0d85c018b34fe71867dede8596cec3b5dcd3982b2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"name":"HAPUBWS.contact","sha256":"dc2b36cf3f6ada355f04afb2ee7975376b4985585fd70aeced8d5565b706cf7d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"name":"Database1.accdb","sha256":"c01436b7c50afbe9c2499fb0f973c77c468ecbfae16a0a567998781c2f8abae9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"name":"Outlook.pst","sha256":"3f7ee5ca5fefda5ffc2c335346b17654eba8b39a912d49a38348bc6e314ee537","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"name":"tmpF20A.tmpFD977D626EDE1CE8F5914854A9F0AF85.bmp","sha256":"fc9903cee7435a12d425ed7833b0d7c61938db4b281a09cf095bedaf0441266c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]}],"files_written":[{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"path":"C:\\2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc.exe.config","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"path":"C:\\2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc.exe","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\machine.config","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index23c.dat","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]},{"path":"%WINDIR%\\System32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]},{"path":"%WINDIR%\\System32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]},{"path":"%WINDIR%\\System32\\en-US\\crypt32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]},{"path":"%WINDIR%\\System32\\en-US\\propsys.dll.mui","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]},{"path":"%WINDIR%\\System32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"path":"%WINDIR%\\System32\\PING.EXE","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]},{"path":"%WINDIR%\\System32\\en-US\\ping.exe.mui","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index256.dat","sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"path":"%WINDIR%\\SysWOW64\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"path":"%WINDIR%\\assembly\\pubpol107.dat","sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"path":"%WINDIR%\\SysWOW64\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"path":"%WINDIR%\\SysWOW64\\tasklist.exe","sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\tasklist.exe.mui","sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"path":"%WINDIR%\\SysWOW64\\wbem\\en-US\\wmiutils.dll.mui","sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"path":"%USERPROFILE%\\Contacts\\%OSUSER%.contact","sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"path":"%USERPROFILE%\\Documents\\Database1.accdb","sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"path":"%USERPROFILE%\\Documents\\Outlook Files\\Outlook.pst","sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"path":"%WINDIR%\\SysWOW64\\PING.EXE","sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\ping.exe.mui","sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\FUSION\\GACCHANGENOTIFICATION\\DEFAULT\\","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\TRACING\\RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MSVI64","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5bcb1d927ca3e118bf326833"},{"report_type":"sandbox","report_id":"5bd9c6c07ca3e16a48507b8e"}]}]}},"report_ids":{"sandbox_job_ids":["5bd9c6c07ca3e16a48507b8e","5bcb1d927ca3e118bf326833"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious Malware Sample 2f5dec0a8e1d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 2f5dec0a8e1d…. Malware family: Malware. Threat score 100/100. 22/28 AV engines flagged this file. 8 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc"}],["$","meta","4",{"property":"og:title","content":"Malicious Malware Sample 2f5dec0a8e1d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 2f5dec0a8e1d…. Malware family: Malware. Threat score 100/100. 22/28 AV engines flagged this file. 8 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/2f5dec0a8e1da5f23b818d48efb0b9b7065023d67c617a78cd8b14808a79c0dc"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Malware Sample 2f5dec0a8e1d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 2f5dec0a8e1d…. Malware family: Malware. Threat score 100/100. 22/28 AV engines flagged this file. 8 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2e","11",{}]]