26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2d:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T4d3,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.Spora.Generic Sample 3ff5b22b0b60… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 3ff5b22b0b60…. Malware family: Ransom.Spora.Generic. Threat score 100/100. 18/28 AV engines flagged this file. 5 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3ff5b22b0b60bd08303904113d5fa133a9e0703c4a96f38a37607ce1cace75a3","keywords":["Malicious","Ransom.Spora.Generic","malware analysis","sandbox report","threat intelligence","3ff5b22b0b60bd08303904113d5fa133a9e0703c4a96f38a37607ce1cace75a3"],"about":{"@type":"SoftwareApplication","name":"3ff5b22b0b60bd08303904113d5fa133a9e0703c4a96f38a37607ce1cace75a3","applicationCategory":["peexe","executable"],"identifier":"3ff5b22b0b60bd08303904113d5fa133a9e0703c4a96f38a37607ce1cace75a3","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom.Spora.Generic","antivirusDetections":{"malicious":18,"total":28},"behavioralIndicators":{"malicious":5,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T531,"" touched file "%WINDIR%\Globalization\Sorting\sortdefault.nls" "" touched file "%WINDIR%\system32\rsaenh.dll" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "" touched file "%WINDIR%\system32\en-US\PROPSYS.dll.mui" "" touched file "%WINDIR%\system32\en-US\SETUPAPI.dll.mui" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "zmsksddfff.exe" touched file "%WINDIR%\Globalization\Sorting\sortdefault.nls" "zmsksddfff.exe" touched file "%WINDIR%\system32\rsaenh.dll" "zmsksddfff.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "zmsksddfff.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "zmsksddfff.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db"28:Tbb7,"All your files have been encrypted If you want to restore them, write us to the e-mail: decrypter@protonmail.ch You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. FREE DECRYPTION AS GUARANTEE Before paying you can send to us up to 3 files for free decryption. Please note that files must NOT contain valuable information and their total size must be less than 10Mb Attention! Do not rename encrypted files Do not try to decrypt your data using third party software, it may cause permanent data loss If you not write on e-mail in 3 days - your key has been deleted and you cant decrypt your files Your ID:" (Source: 3ff5b22b0b60bd08303904113d5fa133a9e0703c4a96f38a37607ce1cace75a3.exe.bin, Indicator: "decrypt your files") "All your files have been encrypted If you want to restore them write us to the e-mail: decrypter@protonmail.ch" (Source: 3ff5b22b0b60bd08303904113d5fa133a9e0703c4a96f38a37607ce1cace75a3.exe.bin, Indicator: "files have been encrypted") "All your files have been encrypted If you want to restore them, write us to the e-mail: decrypter@protonmail.ch You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool tha" (Source: 00039440-00002304-0000018C-90028085, Indicator: "files have been encrypted") "All your files have been encrypted If you want to restore them, write us to the e-mail: decrypter@protonmail.ch You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool t" (Source: 46270-1150-00401050, Indicator: "files have been encrypted") "All your files have been encrypted If you want to restore them, write us to the e-mail: decrypter@protonmail.ch You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. FREE DECRYPTION AS GUARANTEE Before paying you can send to us up to 3 files for free decryption. Please note that files must NOT contain valuable information and their total size must be less than 10Mb Attention! Do not rename encrypted files Do not try to decrypt your data using third party software, it may cause permanent data loss If you not write on e-mail in 3 days - your key has been deleted and you cant decrypt your files Your ID: ieysrELVybpaeGIZQzZc9vG83S227rePFzoHpLcPxHL0CqxdcAMMh+tn/MXWAcMzRyL+M9Xz11+res3iQfiZVagDnFAnx7CJh8YKwVh6Jqa9s6yFfRl0IRDtu/oEHRW1uE+Fbr7owYjyGt/FLtRjdf+tQ2pTZ7PcX8qHpSoufZg=" (Source: #_HOW_TO_FIX.inf, Indicator: "decrypt your files") "All your files have been encrypted" (Source: #_HOW_TO_FIX.inf, Indicator: "files have been encrypted") "If you not write on e-mail in 3 days - your key has been deleted and you cant decrypt your files" (Source: #_HOW_TO_FIX.inf, Indicator: "decrypt your files")29:T5e0,"%APPDATA%\zmsksddfff.exe" marked "C:\3ff5b22b0b60bd08303904113d5fa133a9e0703c4a96f38a37607ce1cace75a3.exe" for deletion "%APPDATA%\zmsksddfff.exe" marked "C:\autoexec.bat" for deletion "%APPDATA%\zmsksddfff.exe" marked "C:\config.sys" for deletion "%APPDATA%\zmsksddfff.exe" marked "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\Office64WW.msi" for deletion "%APPDATA%\zmsksddfff.exe" marked "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\Office64WW.xml" for deletion "%APPDATA%\zmsksddfff.exe" marked "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\ose.exe" for deletion "%APPDATA%\zmsksddfff.exe" marked "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\osetup.dll" for deletion "%APPDATA%\zmsksddfff.exe" marked "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\OWOW64WW.cab" for deletion "%APPDATA%\zmsksddfff.exe" marked "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\PidGenX.dll" for deletion "%APPDATA%\zmsksddfff.exe" marked "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\setup.exe" for deletion "%APPDATA%\zmsksddfff.exe" marked "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\Setup.xml" for deletion "%APPDATA%\zmsksddfff.exe" marked "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\StandardWW.msi" for deletion "%APPDATA%\zmsksddfff.exe" marked "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\StandardWW.xml" for deletion2a:T4b4,"zmsksddfff.exe" opened "C:\3ff5b22b0b60bd08303904113d5fa133a9e0703c4a96f38a37607ce1cace75a3.exe" with delete access "zmsksddfff.exe" opened "C:\autoexec.bat" with delete access "zmsksddfff.exe" opened "C:\config.sys" with delete access "zmsksddfff.exe" opened "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\Office64WW.msi" with delete access "zmsksddfff.exe" opened "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\Office64WW.xml" with delete access "zmsksddfff.exe" opened "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\ose.exe" with delete access "zmsksddfff.exe" opened "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\osetup.dll" with delete access "zmsksddfff.exe" opened "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\OWOW64WW.cab" with delete access "zmsksddfff.exe" opened "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\PidGenX.dll" with delete access "zmsksddfff.exe" opened "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\setup.exe" with delete access "zmsksddfff.exe" opened "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\Setup.xml" with delete access2b:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2c:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"3ff5b22b0b60bd08303904113d5fa133a9e0703c4a96f38a37607ce1cace75a3","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791401911064,"unified_at":"2026-10-07T19:38:31.064Z","metadata":{"hashes":{"sha256":"3ff5b22b0b60bd08303904113d5fa133a9e0703c4a96f38a37607ce1cace75a3","sha1":"c2b6f7dc47236baba75114d43a90f4ecd4c7d181","md5":"c435f5f3562346059631c84dd6efec7f","sha512":"2bf537a588e35f1f96e42d9bbb8c7457b7dca8bc562fbc6c3d0b55f1b5f1f2783e722d676f927080922f35e41d2e8d78d6fbb2333e8c9b8b5cb3bcf8a8bb6a71","ssdeep":"3072:f1tRhf2OueqP4EpMA6yCy6/k+HfhzFVTC2lb95UcGyCYI6HAuAg0FujTt2gYzUmk:f1VO5g8bUyS/NFXlb99AO92gQ/B8jo2","ssdeep_chunks":["3072:f1tRhf2","3072:1tRhf2O","3072:tRhf2Ou","3072:Rhf2Oue","3072:hf2Oueq","3072:f2OueqP","3072:2OueqP4","3072:OueqP4E","3072:ueqP4Ep","3072:eqP4EpM","3072:qP4EpMA","3072:P4EpMA6","3072:4EpMA6y","3072:EpMA6yC","3072:pMA6yCy","3072:MA6yCy6","3072:A6yCy6/","3072:6yCy6/k","3072:yCy6/k+","3072:Cy6/k+H","3072:y6/k+Hf","3072:6/k+Hfh","3072:/k+Hfhz","3072:k+HfhzF","3072:+HfhzFV","3072:HfhzFVT","3072:fhzFVTC","3072:hzFVTC2","3072:zFVTC2l","3072:FVTC2lb","3072:VTC2lb9","3072:TC2lb95","3072:C2lb95U","3072:2lb95Uc","3072:lb95UcG","3072:b95UcGy","3072:95UcGyC","3072:5UcGyCY","3072:UcGyCYI","3072:cGyCYI6","3072:GyCYI6H","3072:yCYI6HA","3072:CYI6HAu","3072:YI6HAuA","3072:I6HAuAg","3072:6HAuAg0","3072:HAuAg0F","3072:AuAg0Fu","3072:uAg0Fuj","3072:Ag0FujT","3072:g0FujTt","3072:0FujTt2","3072:FujTt2g","3072:ujTt2gY","3072:jTt2gYz","3072:Tt2gYzU","3072:t2gYzUm","3072:2gYzUmk","6144:f1tRhf2","6144:1tRhf2O","6144:tRhf2Ou","6144:Rhf2Oue","6144:hf2Oueq","6144:f2OueqP","6144:2OueqP4","6144:OueqP4E","6144:ueqP4Ep","6144:eqP4EpM","6144:qP4EpMA","6144:P4EpMA6","6144:4EpMA6y","6144:EpMA6yC","6144:pMA6yCy","6144:MA6yCy6","6144:A6yCy6/","6144:6yCy6/k","6144:yCy6/k+","6144:Cy6/k+H","6144:y6/k+Hf","6144:6/k+Hfh","6144:/k+Hfhz","6144:k+HfhzF","6144:+HfhzFV","6144:HfhzFVT","6144:fhzFVTC","6144:hzFVTC2","6144:zFVTC2l","6144:FVTC2lb","6144:VTC2lb9","6144:TC2lb95","6144:C2lb95U","6144:2lb95Uc","6144:lb95UcG","6144:b95UcGy","6144:95UcGyC","6144:5UcGyCY","6144:UcGyCYI","6144:cGyCYI6","6144:GyCYI6H","6144:yCYI6HA","6144:CYI6HAu","6144:YI6HAuA","6144:I6HAuAg","6144:6HAuAg0","6144:HAuAg0F","6144:AuAg0Fu","6144:uAg0Fuj","6144:Ag0FujT","6144:g0FujTt","6144:0FujTt2","6144:FujTt2g","6144:ujTt2gY","6144:jTt2gYz","6144:Tt2gYzU","6144:t2gYzUm","6144:2gYzUmk","3072:f1VO5g8","3072:1VO5g8b","3072:VO5g8bU","3072:O5g8bUy","3072:5g8bUyS","3072:g8bUyS/","3072:8bUyS/N","3072:bUyS/NF","3072:UyS/NFX","3072:yS/NFXl","3072:S/NFXlb","3072:/NFXlb9","3072:NFXlb99","3072:FXlb99A","3072:Xlb99AO","3072:lb99AO9","3072:b99AO92","3072:99AO92g","3072:9AO92gQ","3072:AO92gQ/","3072:O92gQ/B","3072:92gQ/B8","3072:2gQ/B8j","3072:gQ/B8jo","3072:Q/B8jo2"],"imphash":"b4679efede9d562f05e03dd4dd918056"},"file_info":{"file_name":"3ff5b22b0b60bd08303904113d5fa133a9e0703c4a96f38a37607ce1cace75a3","file_type":["peexe","executable"],"file_type_id":"exe","file_size":281088,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499286894000,"last_seen":1677364528000,"last_multi_scan":1677364528000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ransomware"]},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":14,"suspicious_count":13,"malicious_count":5,"total":32},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/Win32.DCrypt.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1213253","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.Spora.66DB6B7B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.Spora.66DB6B7B (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Filecoder.BTCware.C trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/LockFile.fe","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Ransomware ( 0050d43c1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.faofnn","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Btcware-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_.003DDF58","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_.003DDF58","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan-Ransom.Bitcovar","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Filecoder.Win32.5022","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom.Spora.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 46270-1803-0040B6C2\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00039440-00002304-65255-14-0129A861\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00039440-00002304-65255-88-0129FC76\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00039440-00002304-65255-598-0129B574\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00039440-00002304-65255-1267-0129B6C2\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00040006-00002456-8164-88-00D5FC76\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00040006-00002456-8164-14-00D5A861\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00040006-00002456-8164-1267-00D5B6C2\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00040006-00002456-8164-598-00D5B574","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.DLL at 00039440-00002304-65255-68-01293AD0\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00039440-00002304-65255-24-0129B766\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00039440-00002304-65255-537-012A8601\n GetLocalTime@KERNEL32.DLL at 00040006-00002456-8164-68-00D53AD0\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00040006-00002456-8164-24-00D5B766\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00040006-00002456-8164-537-00D68601","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetUserDefaultLCID@KERNEL32.DLL at 00039440-00002304-65255-252-012A8657\n GetUserDefaultLCID@KERNEL32.DLL at 00039440-00002304-65255-290-012B1AB6\n EnumSystemLocalesW@KERNEL32.DLL at 00039440-00002304-65255-247-012A7FED\n EnumSystemLocalesW@KERNEL32.DLL at 00039440-00002304-65255-291-012B13F6\n EnumSystemLocalesW@KERNEL32.DLL at 00039440-00002304-65255-295-012B1441\n EnumSystemLocalesW@KERNEL32.DLL at 00039440-00002304-65255-292-012B14DC\n EnumSystemLocalesW@KERNEL32.DLL at 00040006-00002456-8164-292-00D714DC\n EnumSystemLocalesW@KERNEL32.DLL at 00040006-00002456-8164-247-00D67FED\n EnumSystemLocalesW@KERNEL32.DLL at 00040006-00002456-8164-295-00D71441\n GetUserDefaultLCID@KERNEL32.DLL at 00040006-00002456-8164-290-00D71AB6\n GetUserDefaultLCID@KERNEL32.DLL at 00040006-00002456-8164-252-00D68657\n EnumSystemLocalesW@KERNEL32.DLL at 00040006-00002456-8164-291-00D713F6","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 46270-1850-0041C793\n GetProcessHeap@KERNEL32.DLL at 00039440-00002304-65255-1251-012AC793\n GetProcessHeap@KERNEL32.DLL at 00040006-00002456-8164-1251-00D6C793","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\ZMSKSDDFFF.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\ZMSKSDDFFF.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\".pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCounterMutex\"\n \"CRYNXXX\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"zmsksddfff.exe\" with commandline \"C:\\3ff5b22b0b60bd08303904113d5fa133a9e0703c4a96f38a37607ce1cace75a3.exe\" (UID: 00040006-00002456)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"StdWW.cab.[decrypter@protonmail.ch].cryptowin\" has type \"data\"\n \"Setup.xml.[decrypter@protonmail.ch].cryptowin\" has type \"data\"\n \"StandardWW.msi.[decrypter@protonmail.ch].cryptowin\" has type \"data\"\n \"StandardWW.xml.[decrypter@protonmail.ch].cryptowin\" has type \"data\"\n \"OWOW64WW.cab.[decrypter@protonmail.ch].cryptowin\" has type \"data\"\n \"#_HOW_TO_FIX.inf\" has type \"ASCII text with CRLF line terminators\"\n \"autoexec.bat.[decrypter@protonmail.ch].cryptowin\" has type \"data\"\n \"Office64WW.xml.[decrypter@protonmail.ch].cryptowin\" has type \"data\"\n \"PidGenX.dll.[decrypter@protonmail.ch].cryptowin\" has type \"data\"\n \"ose.exe.[decrypter@protonmail.ch].cryptowin\" has type \"data\"\n \"setup.exe.[decrypter@protonmail.ch].cryptowin\" has type \"data\"\n \"osetup.dll.[decrypter@protonmail.ch].cryptowin\" has type \"data\"\n \"Office64WW.msi.[decrypter@protonmail.ch].cryptowin\" has type \"data\"\n \"config.sys.[decrypter@protonmail.ch].cryptowin\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$27","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"decrypter@protonmail.ch\"\n Heuristic match: \"All your files have been encrypted\nIf you want to restore them\nwrite us to the e-mail: decrypter@protonmail.ch\"\n Heuristic match: \".mobi\"\n Heuristic match: \"If you want to restore them, write us to the e-mail: decrypter@protonmail.ch\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"zmsksddfff.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"3ff5b22b0b60bd08303904113d5fa133a9e0703c4a96f38a37607ce1cace75a3.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00039440-00002304-00000105-90022799\n \"zmsksddfff.exe\" at 00040006-00002456-00000105-91096878","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 40 calls to GetProcAddress@KERNEL32.dll at 46270-1845-0040A33E\n Found 40 calls to GetProcAddress@KERNEL32.DLL at 00039440-00002304-65255-1246-0129A33E\n Found 40 calls to GetProcAddress@KERNEL32.DLL at 00040006-00002456-8164-1246-00D5A33E","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\".vbox-prev\" (Indicator: \"vbox\")\n \".vbox\" (Indicator: \"vbox\")","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"zmsksddfff.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"BTQ\"; Value: \"%APPDATA%\\zmsksddfff.exe\")\n \"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"INSBTQ\"; Value: \"%APPDATA%\\#_HOW_TO_FIX.inf\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains many references to file extensions (often found in ransomware)","description":"Found reference to a lot of file extensions: .backupdb\n .plus_muhd\n .pspimage\n .sas7bdat\n .sqlitedb\n .mapimail\n .mdbackup\n .moneywell\n .wotreplay\n .1CD\n .1cd\n .3dm\n .3ds\n .3fr\n .3g2\n .3gp\n .3pr\n .7z\n .ab4\n .accdb\n .accde\n .accdr\n .accdt\n .ach\n .acr\n .act\n .adb\n .ai\n .ait\n .AVI\n .apj\n .arw\n .asf\n .asm\n .asp\n .asx\n .avi\n .awg\n .back\n .backup\n .bak\n .bank\n .bay\n .bdb\n .bgt\n .bik\n .bkp\n .blend\n .bpw\n .cdf\n .cdr\n .cdr3\n .cdr4\n .cdr5\n .cdr6\n .cdrw\n .cdx\n .ce2\n .cer\n .cgm\n .cib\n .class\n .cls\n .cpi\n .cpp","origin":"File/Memory","relevance":10,"id":"string-52","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"$28","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$29","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$2a","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegDeleteValueW\n RegCloseKey\n RegOpenKeyExW\n CryptEncrypt\n GetDriveTypeW\n WriteFile\n CopyFileW\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n UnhandledExceptionFilter\n LoadLibraryExW\n TerminateProcess\n GetModuleHandleExW\n DeleteFileA\n GetStartupInfoW\n DeleteFileW\n FindFirstFileExA\n FindFirstFileA\n FindNextFileA\n GetProcAddress\n CreateFileW\n CreateFileA\n GetCommandLineW\n GetCommandLineA\n GetModuleHandleW\n ShellExecuteW\n ShellExecuteA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"\" created file \"%APPDATA%\\zmsksddfff.exe\\:Zone.Identifier:$DATA\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"35/62 Antivirus vendors marked sample as malicious (56% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"35/62 Antivirus vendors marked sample as malicious (56% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"35/62 Antivirus vendors marked spawned process \"\" (PID: 2304) as malicious (classified as \"Gen:Variant.Zusy\" with 56% detection rate)\n 35/62 Antivirus vendors marked spawned process \"zmsksddfff.exe\" (PID: 2456) as malicious (classified as \"Gen:Variant.Zusy\" with 56% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"\" checked file \"C:\\3ff5b22b0b60bd08303904113d5fa133a9e0703c4a96f38a37607ce1cace75a3.exe\\:Zone.Identifier:$DATA\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":9,"imported_dlls_count":39,"dropped_files_count":0,"extracted_files_count":14,"files_written_count":36,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ransomware"],"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"59190dbbaac2edde1e7ea7c8","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Zusy","submit_name":"3ff5b22b0b60bd08303904113d5fa133a9e0703c4a96f38a37607ce1cace75a3","analysis_start_time":"2017-05-15T04:09:11+00:00","indicators_count":{"informative":14,"suspicious":17,"malicious":6},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}],"processes":[{"pid":2304,"ppid":0,"name":"3ff5b22b0b60bd08303904113d5fa133a9e0703c4a96f38a37607ce1cace75a3.exe","command_line":"","sha256":"3ff5b22b0b60bd08303904113d5fa133a9e0703c4a96f38a37607ce1cace75a3","normalized_path":"C:\\3ff5b22b0b60bd08303904113d5fa133a9e0703c4a96f38a37607ce1cace75a3.exe","uid":"00039440-00002304","icon":"$2b"},{"pid":2456,"ppid":2304,"name":"zmsksddfff.exe","command_line":"C:\\3ff5b22b0b60bd08303904113d5fa133a9e0703c4a96f38a37607ce1cace75a3.exe","sha256":"3ff5b22b0b60bd08303904113d5fa133a9e0703c4a96f38a37607ce1cace75a3","normalized_path":"%APPDATA%\\zmsksddfff.exe","parent_uid":"00039440-00002304","uid":"00040006-00002456","icon":"$2c"}],"all_imported_dlls":["kernel32.dll","KernelBase.dll","sechost.dll","uxtheme.dll","wininet.dll","mpr.dll","crypt32.dll","imm32.dll","propsys.dll","comctl32.dll","ole32.dll","clbcatq.dll","Wldap32.dll","sspicli.dll","shell32.dll","msasn1.dll","cfgmgr32.dll","devobj.dll","ntdll.dll","shlwapi.dll","cryptsp.dll","rsaenh.dll","apphelp.dll","setupapi.dll","user32.dll","usp10.dll","msvcrt.dll","advapi32.dll","rpcrt4.dll","iertutil.dll","lpk.dll","rpcss.dll","oleaut32.dll","ntmarta.dll","profapi.dll","urlmon.dll","gdi32.dll","msctf.dll","cryptbase.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"#_HOW_TO_FIX.inf","sha256":"b6a302787e8aac9b17883bfd24786f5840ad7069c17fdf5398fb2420795652df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"name":"OWOW64WW.cab.[decrypter@protonmail.ch].cryptowin","sha256":"391e0e3759cea06ce744109a308557b56f3e3afe12dda3c23d55ed56c67eab63","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"name":"Office64WW.msi.[decrypter@protonmail.ch].cryptowin","sha256":"f0ddd20d173ddbbec78d4ef1d4a28e7ae3695603d46eaab4ae136e5b0c9ab173","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"name":"Office64WW.xml.[decrypter@protonmail.ch].cryptowin","sha256":"8b1308af889df37a78ba06ca27e5e10fece66de1e889e5ce7d59ad82565e6cda","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"name":"PidGenX.dll.[decrypter@protonmail.ch].cryptowin","sha256":"a73b38bd7d1278e72984b69b61a4d7c39903488bb1169b0a7896a52bc7835293","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"name":"Setup.xml.[decrypter@protonmail.ch].cryptowin","sha256":"d27161e5b943c2e88a21d0a437ebdabddb736380c6ce6b0ffa305767549df9f9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"name":"StandardWW.msi.[decrypter@protonmail.ch].cryptowin","sha256":"4da764eb6be03c186f85514c275a3d9bbdd01941b847e5de1a8d16b4760785a5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"name":"StandardWW.xml.[decrypter@protonmail.ch].cryptowin","sha256":"d86c1238fb65621ac24d51bef6d784f8d054e2cf01862c9f967e453f4c57e7dd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"name":"StdWW.cab.[decrypter@protonmail.ch].cryptowin","sha256":"7d9e8e6f23339fc1826367613159409e720d6aab41d7ac9cb4461e22dabb9b05","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"name":"ose.exe.[decrypter@protonmail.ch].cryptowin","sha256":"e222180a43303d36cf6ef130962c70e016f45b9a2fd0cb71eed5820decd6975a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"name":"osetup.dll.[decrypter@protonmail.ch].cryptowin","sha256":"a8aa80411e0cd9dd22841e93061acc6818f5fb34a54f8f6f33b0b9521265975c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"name":"setup.exe.[decrypter@protonmail.ch].cryptowin","sha256":"5378486f6c675203609fe375333adbc011d5e8209fc8846d8d1c629ea30102a7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"name":"autoexec.bat.[decrypter@protonmail.ch].cryptowin","sha256":"cc2ed3c7f7c607afba3eb235f4b1433d09b43744900fbdf724f915edbfce67fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"name":"config.sys.[decrypter@protonmail.ch].cryptowin","sha256":"ea26c9134d2253339933373d62fb2781648d00fe55e147999045e2226c29da29","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]}],"files_written":[{"path":"C:\\3ff5b22b0b60bd08303904113d5fa133a9e0703c4a96f38a37607ce1cace75a3.exe\\:Zone.Identifier:$DATA","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"path":"%APPDATA%\\zmsksddfff.exe\\:Zone.Identifier:$DATA","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"path":"%WINDIR%\\system32\\en-US\\PROPSYS.dll.mui","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"path":"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"path":"%APPDATA%\\#_HOW_TO_FIX.inf","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"path":"%APPDATA%\\zmsksddfff.exe","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"path":"C:\\autoexec.bat.[decrypter@protonmail.ch].cryptowin","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"path":"C:\\#_HOW_TO_FIX.inf","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"path":"C:\\config.sys.[decrypter@protonmail.ch].cryptowin","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\Office64WW.msi.[decrypter@protonmail.ch].cryptowin","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\Office64WW.xml.[decrypter@protonmail.ch].cryptowin","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\Office64WW.xml","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\ose.exe.[decrypter@protonmail.ch].cryptowin","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\ose.exe","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\osetup.dll.[decrypter@protonmail.ch].cryptowin","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\osetup.dll","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\OWOW64WW.cab.[decrypter@protonmail.ch].cryptowin","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\OWOW64WW.cab","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\PidGenX.dll.[decrypter@protonmail.ch].cryptowin","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\PidGenX.dll","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\setup.exe.[decrypter@protonmail.ch].cryptowin","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\setup.exe","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\Setup.xml.[decrypter@protonmail.ch].cryptowin","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\StandardWW.msi.[decrypter@protonmail.ch].cryptowin","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\StandardWW.xml.[decrypter@protonmail.ch].cryptowin","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\StandardWW.xml","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\#_HOW_TO_FIX.inf","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\StdWW.cab","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\StdWW.cab.[decrypter@protonmail.ch].cryptowin","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]},{"name":"CRYNXXX","sources":[{"report_type":"sandbox","report_id":"59190dbbaac2edde1e7ea7c8"}]}]}},"report_ids":{"sandbox_job_ids":["59190dbbaac2edde1e7ea7c8"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Ransom.Spora.Generic Sample 3ff5b22b0b60… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 3ff5b22b0b60…. Malware family: Ransom.Spora.Generic. Threat score 100/100. 18/28 AV engines flagged this file. 5 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/3ff5b22b0b60bd08303904113d5fa133a9e0703c4a96f38a37607ce1cace75a3"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom.Spora.Generic Sample 3ff5b22b0b60… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 3ff5b22b0b60…. Malware family: Ransom.Spora.Generic. Threat score 100/100. 18/28 AV engines flagged this file. 5 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/3ff5b22b0b60bd08303904113d5fa133a9e0703c4a96f38a37607ce1cace75a3"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom.Spora.Generic Sample 3ff5b22b0b60… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 3ff5b22b0b60…. Malware family: Ransom.Spora.Generic. Threat score 100/100. 18/28 AV engines flagged this file. 5 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2d","11",{}]]