24:I[10321,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/3h6zdc-it88if.js","/_next/static/chunks/2vw2j18d9u3gs.js","/_next/static/chunks/3l_wb6il5gi_h.js"],"ReportDetailWrapper"] a0:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T534,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.DelShad — Falcon Sandbox Report — Score 100/100 — Sample 3a5b015655f3…","description":"Malicious verdict for sandbox report 5dafa2810388…. Malware family: Trojan.DelShad. Threat score 100/100. 10 malicious and 16 suspicious behavioral indicators across 56 signatures. Detonated in Windows 7 32 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT\u0026CK mappings.","url":"/sample/3a5b015655f3aad4b4fd647aa34fda4ce784d75a20d12a73f8dc0e0d866e7e01/5dafa2810388385403bb09a3","keywords":["Malicious","Trojan.DelShad","sandbox report","malware analysis","MITRE ATT\u0026CK","3a5b015655f3aad4b4fd647aa34fda4ce784d75a20d12a73f8dc0e0d866e7e01"],"about":{"@type":"SoftwareApplication","name":"3a5b015655f3aad4b4fd647aa34fda4ce784d75a20d12a73f8dc0e0d866e7e01","applicationCategory":"PE32 executable (GUI) Intel 80386, for MS Windows","identifier":"3a5b015655f3aad4b4fd647aa34fda4ce784d75a20d12a73f8dc0e0d866e7e01","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.DelShad","sandboxEnvironment":"Windows 7 32 bit","behavioralIndicators":{"malicious":10,"suspicious":16,"totalSignatures":56},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==26:T539,".exe" touched "TaskScheduler class" (Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}") ".exe" touched "Copy/Move/Rename/Delete/Link Object" (Path: "HKCU\CLSID\{3AD05575-8857-4850-9277-11B85BDB8E09}") ".exe" touched "Memory Mapped Cache Mgr" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") ".exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DEFAULTICON") "vssadmin.exe" touched "VSSCoordinator Class" (Path: "HKCU\CLSID\{E579AB5F-1CC4-44B4-BED9-DE0991FF0623}") "vssadmin.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{F2C2787D-95AB-40D4-942D-298F5F757874}") "WMIC.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "WMIC.exe" touched "Free Threaded XML DOM Document" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{F6D90F12-9C73-11D3-B32E-00C04F990BB4}") "WMIC.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "WMIC.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "WMIC.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS")27:T570,".exe" touched file "C:\Windows\System32\tzres.dll" ".exe" touched file "C:\Users\FD4zD7B\AppData\Local\Microsoft\Windows\Caches" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001f.db" ".exe" touched file "C:\Windows\AppPatch\sysmain.sdb" ".exe" touched file "C:\Windows\System32\vssadmin.exe" ".exe" touched file "C:\Windows\System32\bcdedit.exe" ".exe" touched file "C:\Windows\System32\rsaenh.dll" ".exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001f.db" "vssadmin.exe" touched file "C:\Windows\System32\en-US\vssadmin.exe.mui" "vssadmin.exe" touched file "C:\Windows\System32\rsaenh.dll" "vssadmin.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "bcdedit.exe" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui"28:T786,".exe" queried SystemProcessInformation at 00556380-00004540-00000105-4269715732 ".exe" queried SystemProcessInformation at 00556380-00004540-00000105-4283805871 ".exe" queried SystemProcessInformation at 00556380-00004540-00000105-4294856824 ".exe" queried SystemProcessInformation at 00556380-00004540-00000105-4305913289 ".exe" queried SystemProcessInformation at 00556380-00004540-00000105-4316034285 ".exe" queried SystemProcessInformation at 00556380-00004540-00000105-4326596523 ".exe" queried SystemProcessInformation at 00556380-00004540-00000105-4337542976 ".exe" queried SystemProcessInformation at 00556380-00004540-00000105-4348120551 ".exe" queried SystemProcessInformation at 00556380-00004540-00000105-4358656347 ".exe" queried SystemProcessInformation at 00556380-00004540-00000105-4368843239 ".exe" queried SystemProcessInformation at 00556380-00004540-00000105-4380210748 ".exe" queried SystemProcessInformation at 00556380-00004540-00000105-4391203847 ".exe" queried SystemProcessInformation at 00556380-00004540-00000105-79857833261 ".exe" queried SystemProcessInformation at 00556380-00004540-00000105-79869850382 ".exe" queried SystemProcessInformation at 00556380-00004540-00000105-79881353146 ".exe" queried SystemProcessInformation at 00556380-00004540-00000105-79892529135 ".exe" queried SystemProcessInformation at 00556380-00004540-00000105-79903894666 ".exe" queried SystemProcessInformation at 00556380-00004540-00000105-79916604206 ".exe" queried SystemProcessInformation at 00556380-00004540-00000105-79927820213 ".exe" queried SystemProcessInformation at 00556380-00004540-00000105-7993897317229:T969,"ht: auto; padding-right: 50px; line-height: 1.5; } .text div { padding: 0 15px; } .footer { background: none; } }

All your data are encrypted!

","

All your data are encrypted!","","

","","","

","

All your data are encrypted!","","

","","","

"},{"type":"linebreak"},{"type":"linebreak"},{"type":"linebreak"},{"type":"text","value":"

"},{"type":"linebreak"},{"type":"text","value":"

All your data are encrypted!"},{"type":"linebreak"},{"type":"linebreak"},{"type":"text","value":"

"},{"type":"linebreak"},{"type":"linebreak"},{"type":"linebreak"},{"type":"text","value":"

"},{"type":"linebreak"},{"type":"text","value":"

All your data are encrypted!"},{"type":"linebreak"},{"type":"linebreak"},{"type":"text","value":"

"},{"type":"linebreak"},{"type":"linebreak"},{"type":"linebreak"},{"type":"text","value":"