26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T477,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample 38eb22363f19… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 38eb22363f19…. Malware family: Malware. Threat score 100/100. 16/28 AV engines flagged this file. 3 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/38eb22363f19b0361ab3762fb95132e72a148dd68505fb6e0860f0363e820f2c","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","38eb22363f19b0361ab3762fb95132e72a148dd68505fb6e0860f0363e820f2c"],"about":{"@type":"SoftwareApplication","name":"bounty-34566852479141902","applicationCategory":["peexe","executable"],"identifier":"38eb22363f19b0361ab3762fb95132e72a148dd68505fb6e0860f0363e820f2c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":16,"total":28},"behavioralIndicators":{"malicious":3,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T621,".exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" ".exe" touched file "C:\Windows\System32\en-US\shell32.dll.mui" ".exe" touched file "C:\Windows\System32\38eb22363f19b0361ab3762fb95132e72a148dd68505fb6e0860f0363e820f2c.exe" ".exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\38eb22363f19b0361ab3762fb95132e72a148dd68505fb6e0860f0363e820f2c.exe" ".exe" touched file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\38eb22363f19b0361ab3762fb95132e72a148dd68505fb6e0860f0363e820f2c.exe" ".exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\38eb22363f19b0361ab3762fb95132e72a148dd68505fb6e0860f0363e820f2c.exe" ".exe" touched file "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\38eb22363f19b0361ab3762fb95132e72a148dd68505fb6e0860f0363e820f2c.exe" "cmd.exe" touched file "C:\Windows\Branding\Basebrd\basebrd.dll" "cmd.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "cmd.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "cmd.exe" touched file "C:\Windows\System32\mode.com" "cmd.exe" touched file "C:\Windows\System32\vssadmin.exe" "mode.com" touched file "C:\Windows\System32\en-US\ulib.dll.mui" "vssadmin.exe" touched file "C:\Windows\System32\en-US\vssadmin.exe.mui" "vssadmin.exe" touched file "C:\Windows\System32\rsaenh.dll" "vssadmin.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls"28:T4e6,"C:\38eb22363f19b0361ab3762fb95132e72a148dd68505fb6e0860f0363e820f2c.exe" marked "C:\$Recycle.Bin\S-1-5-21-2092356043-4041700817-663127204-1001\desktop.ini" for deletion "C:\38eb22363f19b0361ab3762fb95132e72a148dd68505fb6e0860f0363e820f2c.exe" marked "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml" for deletion "C:\38eb22363f19b0361ab3762fb95132e72a148dd68505fb6e0860f0363e820f2c.exe" marked "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Setup.xml" for deletion "C:\38eb22363f19b0361ab3762fb95132e72a148dd68505fb6e0860f0363e820f2c.exe" marked "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml" for deletion "C:\38eb22363f19b0361ab3762fb95132e72a148dd68505fb6e0860f0363e820f2c.exe" marked "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml" for deletion "C:\38eb22363f19b0361ab3762fb95132e72a148dd68505fb6e0860f0363e820f2c.exe" marked "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Setup.xml" for deletion "C:\38eb22363f19b0361ab3762fb95132e72a148dd68505fb6e0860f0363e820f2c.exe" marked "C:\autoexec.bat" for deletion "C:\38eb22363f19b0361ab3762fb95132e72a148dd68505fb6e0860f0363e820f2c.exe" marked "C:\config.sys" for deletion29:T56e,".exe" opened "C:\$Recycle.Bin\S-1-5-21-2092356043-4041700817-663127204-1001\desktop.ini" with delete access ".exe" opened "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml" with delete access ".exe" opened "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Setup.xml" with delete access ".exe" opened "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml" with delete access ".exe" opened "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml" with delete access ".exe" opened "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Setup.xml" with delete access ".exe" opened "C:\autoexec.bat" with delete access ".exe" opened "C:\config.sys" with delete access ".exe" opened "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab" with delete access ".exe" opened "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi" with delete access ".exe" opened "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi" with delete access ".exe" opened "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi" with delete access2a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD////////x//+D4f/+AMB/+AAAP/AAAB/wAQEP4QGBh+Mfj8fHH8fHxg/Hx8YDwcfHA8AHx4fAB+PPhg/jx4+P8ccPx/BEH8fgAD/j4AB/4+OB/+Pj4//j4+P/4+Px/8fhgf+H8ID/D/gAPg/8AAAf/gMAf/+Hwf//j////////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"38eb22363f19b0361ab3762fb95132e72a148dd68505fb6e0860f0363e820f2c","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790733826006,"unified_at":"2026-09-30T02:03:46.006Z","metadata":{"hashes":{"sha256":"38eb22363f19b0361ab3762fb95132e72a148dd68505fb6e0860f0363e820f2c","sha1":"084c7ad1123f21234bb1173e8ed89945574a1de6","md5":"e564144e85523c1dffb233c608ab28b4","sha512":"057ab3efdfeda801d38663b1f5945b5bccfd079e4903d1bceceaf072bc77b02b05760b6958a5db44ff904c48bee55a97282ca1064de9dc895769c6ea17064d85","ssdeep":"12288:OgRRq78j/lG1z2heCsxIN/k/Qg5l0cC5fxwm46RlE6epf6HhSvuCvWjsA2P6MGNo:az+ZKQqC5f9lE6epf6HhfCeglZGNo","ssdeep_chunks":["12288:OgRRq78","12288:gRRq78j","12288:RRq78j/","12288:Rq78j/l","12288:q78j/lG","12288:78j/lG1","12288:8j/lG1z","12288:j/lG1z2","12288:/lG1z2h","12288:lG1z2he","12288:G1z2heC","12288:1z2heCs","12288:z2heCsx","12288:2heCsxI","12288:heCsxIN","12288:eCsxIN/","12288:CsxIN/k","12288:sxIN/k/","12288:xIN/k/Q","12288:IN/k/Qg","12288:N/k/Qg5","12288:/k/Qg5l","12288:k/Qg5l0","12288:/Qg5l0c","12288:Qg5l0cC","12288:g5l0cC5","12288:5l0cC5f","12288:l0cC5fx","12288:0cC5fxw","12288:cC5fxwm","12288:C5fxwm4","12288:5fxwm46","12288:fxwm46R","12288:xwm46Rl","12288:wm46RlE","12288:m46RlE6","12288:46RlE6e","12288:6RlE6ep","12288:RlE6epf","12288:lE6epf6","12288:E6epf6H","12288:6epf6Hh","12288:epf6HhS","12288:pf6HhSv","12288:f6HhSvu","12288:6HhSvuC","12288:HhSvuCv","12288:hSvuCvW","12288:SvuCvWj","12288:vuCvWjs","12288:uCvWjsA","12288:CvWjsA2","12288:vWjsA2P","12288:WjsA2P6","12288:jsA2P6M","12288:sA2P6MG","12288:A2P6MGN","12288:2P6MGNo","24576:OgRRq78","24576:gRRq78j","24576:RRq78j/","24576:Rq78j/l","24576:q78j/lG","24576:78j/lG1","24576:8j/lG1z","24576:j/lG1z2","24576:/lG1z2h","24576:lG1z2he","24576:G1z2heC","24576:1z2heCs","24576:z2heCsx","24576:2heCsxI","24576:heCsxIN","24576:eCsxIN/","24576:CsxIN/k","24576:sxIN/k/","24576:xIN/k/Q","24576:IN/k/Qg","24576:N/k/Qg5","24576:/k/Qg5l","24576:k/Qg5l0","24576:/Qg5l0c","24576:Qg5l0cC","24576:g5l0cC5","24576:5l0cC5f","24576:l0cC5fx","24576:0cC5fxw","24576:cC5fxwm","24576:C5fxwm4","24576:5fxwm46","24576:fxwm46R","24576:xwm46Rl","24576:wm46RlE","24576:m46RlE6","24576:46RlE6e","24576:6RlE6ep","24576:RlE6epf","24576:lE6epf6","24576:E6epf6H","24576:6epf6Hh","24576:epf6HhS","24576:pf6HhSv","24576:f6HhSvu","24576:6HhSvuC","24576:HhSvuCv","24576:hSvuCvW","24576:SvuCvWj","24576:vuCvWjs","24576:uCvWjsA","24576:CvWjsA2","24576:vWjsA2P","24576:WjsA2P6","24576:jsA2P6M","24576:sA2P6MG","24576:A2P6MGN","24576:2P6MGNo","12288:az+ZKQq","12288:z+ZKQqC","12288:+ZKQqC5","12288:ZKQqC5f","12288:KQqC5f9","12288:QqC5f9l","12288:qC5f9lE","12288:C5f9lE6","12288:5f9lE6e","12288:f9lE6ep","12288:9lE6epf","12288:epf6Hhf","12288:pf6HhfC","12288:f6HhfCe","12288:6HhfCeg","12288:HhfCegl","12288:hfCeglZ","12288:fCeglZG","12288:CeglZGN","12288:eglZGNo"],"imphash":"fdca66e76a0c96cd81b0954eaf8e1f33"},"file_info":{"file_name":"bounty-34566852479141902","file_type":["peexe","executable"],"file_type_id":"exe","file_size":867328,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1568245752000,"last_seen":1652013979000,"last_multi_scan":1652013979000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ransomware"]},"stats":{"av":{"malicious_count":16,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":10},"sandbox_signatures":{"informative_count":14,"suspicious_count":15,"malicious_count":3,"total":32},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Exploit]/Win32.Shellcode","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/AD.MalwareCrypter.gmk","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.41155732","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.41155732 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.GRHW trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.GandCrab","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0054a9e81 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Exploit.Win32.Shellcode.akc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Ransom-Dharma!E564144E8552","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Exploit.Win32.Shellcode.foscnk","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Ransom.Crysis","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.CryptDharma.BRU","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Download","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Malware","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Service Execution","attack_id":"T1035","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","identifiers":[{"type":"suspicious","value":"Opened the service control manager"}],"sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"},{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Start Folder","attack_id":"T1060","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1060","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"suspicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","identifiers":[{"type":"malicious","value":"Deletes volume snapshots (often used by ransomware)"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Contains ability to query information about shared network resources"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"informative","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","identifiers":[{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"vssadmin.exe\" at 00079541-00000300-00000105-42434200881","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 21739-1696-00443AC0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\".exe\" queries volume information of \"C:\\\" at 00078231-00002644-0000010C-25924486439\n \".exe\" queries volume information of \"C:\\\" at 00078231-00002644-0000010C-25931211835\n \".exe\" queries volume information of \"C:\\\" at 00078231-00002644-0000010C-25958183897\n \".exe\" queries volume information of \"C:\\\" at 00078231-00002644-0000010C-25985048356\n \".exe\" queries volume information of \"C:\\\" at 00078231-00002644-0000010C-25992949590\n \".exe\" queries volume information of \"C:\\\" at 00078231-00002644-0000010C-26050940418","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\".exe\" queries volume information of \"C:\\\" at 00078231-00002644-0000010C-25924486439\n \".exe\" queries volume information of \"C:\\\" at 00078231-00002644-0000010C-25931211835\n \".exe\" queries volume information of \"C:\\\" at 00078231-00002644-0000010C-25958183897\n \".exe\" queries volume information of \"C:\\\" at 00078231-00002644-0000010C-25985048356\n \".exe\" queries volume information of \"C:\\\" at 00078231-00002644-0000010C-25992949590\n \".exe\" queries volume information of \"C:\\\" at 00078231-00002644-0000010C-26050940418","origin":"API Call","mitre_attack_id":"T1120","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\acquire\\Release\\demand.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Global\\syncronize_4915O4A\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\syncronize_4915O4U\"\n \"Global\\syncronize_4915O4U\"\n \"Global\\syncronize_4915O4A\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"vssadmin.exe\" touched \"VSSCoordinator Class\" (Path: \"HKCU\\CLSID\\{E579AB5F-1CC4-44B4-BED9-DE0991FF0623}\")\n \"vssadmin.exe\" touched \"PSFactoryBuffer\" (Path: \"HKCU\\CLSID\\{F2C2787D-95AB-40D4-942D-298F5F757874}\")","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" (UID: 00079162-00003728)\n Spawned process \"mode.com\" with commandline \"mode con cp select=1251\" (UID: 00079208-00002192)\n Spawned process \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00079541-00000300)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"cmd.exe\" (UID: 00079162-00003728)\n Spawned process \"mode.com\" with commandline \"mode con cp select=1251\" (UID: 00079208-00002192)\n Spawned process \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00079541-00000300)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"\n \"mode.com\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$27","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"vssadmin.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"38eb22363f19b0361ab3762fb95132e72a148dd68505fb6e0860f0363e820f2c.bin\" was detected as \"Visual C++ 2003 DLL -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\".exe\" queried SystemProcessInformation at 00078231-00002644-00000105-24910658829\n \".exe\" queried SystemProcessInformation at 00078231-00002644-00000105-25787058935\n \".exe\" queried SystemProcessInformation at 00078231-00002644-00000105-29777989250","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"ecdsa\" (Indicator: \"ecdsa\"; File: \"38eb22363f19b0361ab3762fb95132e72a148dd68505fb6e0860f0363e820f2c.bin\")\n \"rc4\" (Indicator: \"rc4\"; File: \"38eb22363f19b0361ab3762fb95132e72a148dd68505fb6e0860f0363e820f2c.bin\")\n \"RC4\" (Indicator: \"rc4\"; File: \"38eb22363f19b0361ab3762fb95132e72a148dd68505fb6e0860f0363e820f2c.bin\")\n \"DES\" (Indicator: \"des\"; File: \"38eb22363f19b0361ab3762fb95132e72a148dd68505fb6e0860f0363e820f2c.bin\")","origin":"File/Memory","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query information about shared network resources","description":"EnumPrintersA@WINSPOOL.DRV at 21739-2471-0041FF90\n EnumPrintersA@WINSPOOL.DRV at 21739-2470-0041EAF9","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1012","relevance":10,"id":"stream-63","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\".exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_ENUMERATE_SERVICE\" (0x4)\n \".exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","mitre_attack_id":"T1035","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\".exe\" read file \"C:\\$Recycle.Bin\\S-1-5-21-2092356043-4041700817-663127204-1001\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\".exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"38EB22363F19B0361AB3762FB95132E72A148DD68505FB6E0860F0363E820F2C.EXE\"; Value: \"%WINDIR%\\System32\\38eb22363f19b0361ab3762fb95132e72a148dd68505fb6e0860f0363e820f2c.exe\")","origin":"Registry Access","mitre_attack_id":"T1060","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"cmd.exe\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\mode.com\" (Handle: 80)\n \"cmd.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\mode.com\" (Handle: 80)\n \"cmd.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\mode.com\" (Handle: 80)\n \"cmd.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\vssadmin.exe\" (Handle: 76)\n \"cmd.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\vssadmin.exe\" (Handle: 76)\n \"cmd.exe\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\vssadmin.exe\" (Handle: 76)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"7.8.3.226\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.dll at 21739-1873-0041FF8A\n CreateToolhelp32Snapshot@KERNEL32.dll at 21739-1868-0041BFA0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1215","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$28","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$29","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n WriteFile\n OutputDebugStringA\n OutputDebugStringW\n GetModuleFileNameW\n CopyFileA\n GetModuleFileNameA\n UnhandledExceptionFilter\n TerminateProcess\n CreateToolhelp32Snapshot\n LoadLibraryW\n GetTickCount\n LoadLibraryA\n Process32Next\n Process32First\n CreateDirectoryA\n GetStartupInfoW\n FindFirstFileA\n FindNextFileA\n GetProcAddress\n CreateFileW\n IsDebuggerPresent\n CreateFileA\n LockResource\n GetCommandLineA\n GetModuleHandleA\n GetModuleHandleW\n FindResourceA\n VirtualAlloc\n ShellExecuteA\n GetCursorPos\n EnumPrintersA\n WSAStartup","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"c04e567720545777e0655777b53858770000000000d0497700000000c5ea49770000000088ea497700000000e9684a7582285877ee29587700000000d2694a75000000007dbb49770000000009be4a7500000000ba18497700000000\" to virtual address \"0x76E31000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"mode.com\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"13/70 Antivirus vendors marked sample as malicious (18% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"13/70 Antivirus vendors marked sample as malicious (18% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00079541-00000300)","origin":"Monitored Target","mitre_attack_id":"T1107","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Deletes volume snapshots (often used by ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Deletes volume snapshots (often used by ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries process information"},{"detail":"Reads the active computer name"},{"detail":"Contains ability to query information about shared network resources"}],"sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":64,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":19,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ransomware"],"sample_flags":["Multi-Process"],"sandbox_reports":[{"id":"5d7987f6038838c79633d586","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"38eb22363f19b0361ab3762fb95132e72a148dd68505fb6e0860f0363e820f2c","analysis_start_time":"2019-09-11T23:49:15+00:00","indicators_count":{"informative":14,"suspicious":19,"malicious":5},"tags":["Multi-Process"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}],"processes":[{"pid":2644,"ppid":0,"name":"38eb22363f19b0361ab3762fb95132e72a148dd68505fb6e0860f0363e820f2c.exe","command_line":"","sha256":"38eb22363f19b0361ab3762fb95132e72a148dd68505fb6e0860f0363e820f2c","normalized_path":"C:\\38eb22363f19b0361ab3762fb95132e72a148dd68505fb6e0860f0363e820f2c.exe","uid":"00078231-00002644","icon":"$2a"},{"pid":3728,"ppid":2644,"name":"cmd.exe","command_line":"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00078231-00002644","uid":"00079162-00003728"},{"pid":2192,"ppid":3728,"name":"mode.com","command_line":"mode con cp select=1251","sha256":"efc11f8fcdd0a8649ebee758b105db10536e895ea6d586a07b61f68b1e5dbd20","normalized_path":"%WINDIR%\\System32\\mode.com","parent_uid":"00079162-00003728","uid":"00079208-00002192"},{"pid":300,"ppid":3728,"name":"vssadmin.exe","command_line":"vssadmin delete shadows /all /quiet","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","parent_uid":"00079162-00003728","uid":"00079541-00000300"}],"all_imported_dlls":["usp10.dll","winbrand.dll","cryptsp.dll","winmm.dll","netutils.dll","tapi32.dll","activeds.dll","adsldpc.dll","msctf.dll","setupapi.dll","sechost.dll","browcli.dll","msvcrt.dll","basebrd.dll","ole32.dll","rpcss.dll","cryptbase.dll","pdh.dll","gdi32.dll","comctl32.dll","powrprof.dll","ntlanman.dll","cscapi.dll","dwmapi.dll","msacm32.dll","uxtheme.dll","kernel32.dll","imm32.dll","devobj.dll","davhlpr.dll","rsaenh.dll","ntdll.dll","shlwapi.dll","vss_ps.dll","Wldap32.dll","atl.dll","shell32.dll","clbcatq.dll","rpcrt4.dll","cfgmgr32.dll","comdlg32.dll","ws2_32.dll","nsi.dll","sspicli.dll","drprov.dll","lpk.dll","vssapi.dll","vsstrace.dll","version.dll","msasn1.dll","mpr.dll","davclnt.dll","user32.dll","oleaut32.dll","ulib.dll","ureg.dll","GdiPlus.dll","advapi32.dll","RpcRtRemote.dll","crypt32.dll","apphelp.dll","winsta.dll","wkscli.dll","KernelBase.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"C:\\AAAA1111\\univer\\spovm_kursovoi\\spovm_kursovoi\\Debug\\taskDirs.txt","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"path":"%WINDIR%\\System32\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"path":"C:\\38eb22363f19b0361ab3762fb95132e72a148dd68505fb6e0860f0363e820f2c.exe","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"path":"%WINDIR%\\System32\\38eb22363f19b0361ab3762fb95132e72a148dd68505fb6e0860f0363e820f2c.exe","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\38eb22363f19b0361ab3762fb95132e72a148dd68505fb6e0860f0363e820f2c.exe","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\38eb22363f19b0361ab3762fb95132e72a148dd68505fb6e0860f0363e820f2c.exe","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.xml","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.xml.id-5CB89B29.[veracrypt@foxmail.com].adobe","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml.id-5CB89B29.[veracrypt@foxmail.com].adobe","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab.id-5CB89B29.[veracrypt@foxmail.com].adobe","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"path":"%WINDIR%\\Branding\\Basebrd\\basebrd.dll","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"path":"%WINDIR%\\System32\\mode.com","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"path":"%WINDIR%\\System32\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"path":"%WINDIR%\\System32\\en-US\\ulib.dll.mui","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"path":"%WINDIR%\\System32\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\syncronize_4915O4A","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\syncronize_4915O4U","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"name":"Global\\syncronize_4915O4U","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]},{"name":"Global\\syncronize_4915O4A","sources":[{"report_type":"sandbox","report_id":"5d7987f6038838c79633d586"}]}]}},"report_ids":{"sandbox_job_ids":["5d7987f6038838c79633d586"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Malware Sample 38eb22363f19… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 38eb22363f19…. Malware family: Malware. Threat score 100/100. 16/28 AV engines flagged this file. 3 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/38eb22363f19b0361ab3762fb95132e72a148dd68505fb6e0860f0363e820f2c"}],["$","meta","4",{"property":"og:title","content":"Malicious Malware Sample 38eb22363f19… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 38eb22363f19…. Malware family: Malware. Threat score 100/100. 16/28 AV engines flagged this file. 3 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/38eb22363f19b0361ab3762fb95132e72a148dd68505fb6e0860f0363e820f2c"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Malware Sample 38eb22363f19… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 38eb22363f19…. Malware family: Malware. Threat score 100/100. 16/28 AV engines flagged this file. 3 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]