23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T48b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom_.2AAC8063 Sample 421e9f43cfe8… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 421e9f43cfe8…. Malware family: Ransom_.2AAC8063. Threat score 100/100. 21/28 AV engines flagged this file. 6 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/421e9f43cfe87ac8a10d6c6b841ba2584ba54d77bfe24225ed313aa9ea674aa9","keywords":["Malicious","Ransom_.2AAC8063","malware analysis","sandbox report","threat intelligence","421e9f43cfe87ac8a10d6c6b841ba2584ba54d77bfe24225ed313aa9ea674aa9"],"about":{"@type":"SoftwareApplication","name":"jun7.exe","applicationCategory":["peexe","executable"],"identifier":"421e9f43cfe87ac8a10d6c6b841ba2584ba54d77bfe24225ed313aa9ea674aa9","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom_.2AAC8063","antivirusDetections":{"malicious":21,"total":28},"behavioralIndicators":{"malicious":6,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T888,"explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "HELPLINK"; Value: "00000000010000005A00000068007400740070003A002F002F007700770077002E00610064006F00620065002E0063006F006D002F0067006F002F0066006C0061007300680070006C0061007900650072005F0073007500700070006F00720074002F000000") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "URLINFOABOUT"; Value: "00000000010000002A00000068007400740070003A002F002F007700770077002E00610064006F00620065002E0063006F006D000000") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3"; Key: "URLINFOABOUT"; Value: "00000000010000004800000068007400740070003A002F002F007700770077002E006100750074006F00690074007300630072006900700074002E0063006F006D002F006100750074006F006900740033000000") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE5BAKEX") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA0") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA1")25:T7c1,"explorer.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")26:T723,"explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA"; Key: "BLOB") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135"; Key: "BLOB") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")27:T706,"" queried SystemProcessInformation at 00039505-00003756-00000105-91585010 "" queried SystemProcessInformation at 00039505-00003756-00000105-91606934 "" queried SystemProcessInformation at 00039505-00003756-00000105-91627727 "" queried SystemProcessInformation at 00039505-00003756-00000105-91648143 "" queried SystemProcessInformation at 00039505-00003756-00000105-91670042 "" queried SystemProcessInformation at 00039505-00003756-00000105-91695651 "" queried SystemProcessInformation at 00039505-00003756-00000105-91716862 "" queried SystemProcessInformation at 00039505-00003756-00000105-91735368 "" queried SystemProcessInformation at 00039505-00003756-00000105-91751872 "" queried SystemProcessInformation at 00039505-00003756-00000105-91768869 "" queried SystemProcessInformation at 00039505-00003756-00000105-91786160 "" queried SystemProcessInformation at 00039505-00003756-00000105-91806317 "" queried SystemProcessInformation at 00039505-00003756-00000105-91829956 "" queried SystemProcessInformation at 00039505-00003756-00000105-91853520 "" queried SystemProcessInformation at 00039505-00003756-00000105-91874331 "" queried SystemProcessInformation at 00039505-00003756-00000105-91900696 "" queried SystemProcessInformation at 00039505-00003756-00000105-91919712 "" queried SystemProcessInformation at 00039505-00003756-00000105-91942648 "" queried SystemProcessInformation at 00039505-00003756-00000105-91969281 "" queried SystemProcessInformation at 00039505-00003756-00000105-9199545328:T5ff,"POST /autoit3 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Content-Length: 189 Host: www.autoitscript.com" with no payload "POST /support/main.html HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Content-Length: 73 Host: www.adobe.de" with no payload "POST /autoit3 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Content-Length: 87 Host: www.autoitscript.com" with no payload "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Content-Length: 63 Host: preschoolandnursery.co.uk" with no payload29:T9d2,Found malicious artifacts related to "212.227.91.231" (ASN: 8560, Owner: 1&1 Internet AG): ... URL: http://autoitscript.com/ (AV positives: 1/65 scanned on 06/05/2017 06:14:42) URL: http://www.autoitscript.com/autoit3/ (AV positives: 1/64 scanned on 06/04/2017 05:52:29) URL: http://www.autoitscript.com/autoit3/ Pattern (AV positives: 1/64 scanned on 06/02/2017 08:24:11) URL: http://www.autoitscript.com/autoit3/docs/ (AV positives: 1/64 scanned on 05/29/2017 16:36:55) URL: http://www.autoitscript.com/site/wp-content/themes/TheCorporation/images/logo.png (AV positives: 1/64 scanned on 05/25/2017 18:39:56) File SHA256: e146499adda03ece0d8db63c7e114a30c49ee492f9a48e97de0f284bce4d6e41 (AV positives: 1/61 scanned on 06/06/2017 09:30:27) File SHA256: 5a56d44a682ebdbaa1d0617b473ad8eb04411f5ce5212f876205568321e3e8f3 (AV positives: 1/62 scanned on 06/01/2017 14:31:11) File SHA256: bca0271c23a0e6e7c21fa66a0463de32cba408e0fc6062b89dd9f430216bd3a4 (AV positives: 2/62 scanned on 05/29/2017 18:38:57) File SHA256: 44a2ba6b723cbc5eec389ea07ac43d696aeff01f0f1a62788aed1d1ce992a886 (AV positives: 2/59 scanned on 05/29/2017 16:58:25) File SHA256: bb87b78591cbbb3264e6e7a78e41a847087691103da8b73337e1e2aebcf2af03 (AV positives: 9/61 scanned on 05/25/2017 18:39:56) Found malicious artifacts related to "193.104.215.58" (ASN: 44786, Owner: Adobe Systems Software Ireland Limited): ... URL: http://www.adobe.com.br/ (AV positives: 1/64 scanned on 05/15/2017 18:42:52) URL: http://ns.adobe.com/xap/1.0/sType/ResourceRef (AV positives: 1/66 scanned on 12/01/2015 06:38:01) URL: http://ns.adobe.com/xmp/note/ (AV positives: 1/66 scanned on 12/01/2015 01:07:55) URL: http://ns.adobe.com/xap/1.0/sType/ResourceEvent (AV positives: 1/66 scanned on 12/01/2015 01:06:07) URL: http://ns.adobe.com/xap/1.0/mm/ (AV positives: 1/66 scanned on 12/01/2015 01:04:21) File SHA256: 37c6dbb53b6a7914eb8d86243c0693b8ed834b1a4ff074605f494b99319c78c9 (AV positives: 1/56 scanned on 04/26/2017 03:23:57) File SHA256: 54a60cdbd8b1e57be3b48cf69b9ffe2b0327d4b5c5092af898edaa6c5383d16e (AV positives: 1/62 scanned on 04/26/2017 03:48:09) File SHA256: 255f64b37da27ced3260cffda6b8db16b85e9eb686ee69bb01491c20c5831ddc (AV positives: 2/62 scanned on 04/26/2017 03:43:53) File SHA256: 2f2f39d9ccadbfe34d2814266c60b9e6fd79ba16a79a6758fbc34e94392110b9 (AV positives: 1/62 scanned on 04/26/2017 03:43:50) File SHA256: 6a3ebd548a9ff92ccca720b88cc9d28fbaebc1ace9ecdcecae24f728b754da34 (AV positives: 1/61 scanned on 04/26/2017 03:43:08)2a:T9d2,Found malicious artifacts related to "212.227.91.231" (ASN: 8560, Owner: 1&1 Internet AG): ... URL: http://autoitscript.com/ (AV positives: 1/65 scanned on 06/05/2017 06:14:42) URL: http://www.autoitscript.com/autoit3/ (AV positives: 1/64 scanned on 06/04/2017 05:52:29) URL: http://www.autoitscript.com/autoit3/ Pattern (AV positives: 1/64 scanned on 06/02/2017 08:24:11) URL: http://www.autoitscript.com/autoit3/docs/ (AV positives: 1/64 scanned on 05/29/2017 16:36:55) URL: http://www.autoitscript.com/site/wp-content/themes/TheCorporation/images/logo.png (AV positives: 1/64 scanned on 05/25/2017 18:39:56) File SHA256: e146499adda03ece0d8db63c7e114a30c49ee492f9a48e97de0f284bce4d6e41 (AV positives: 1/61 scanned on 06/06/2017 09:30:27) File SHA256: 5a56d44a682ebdbaa1d0617b473ad8eb04411f5ce5212f876205568321e3e8f3 (AV positives: 1/62 scanned on 06/01/2017 14:31:11) File SHA256: bca0271c23a0e6e7c21fa66a0463de32cba408e0fc6062b89dd9f430216bd3a4 (AV positives: 2/62 scanned on 05/29/2017 18:38:57) File SHA256: 44a2ba6b723cbc5eec389ea07ac43d696aeff01f0f1a62788aed1d1ce992a886 (AV positives: 2/59 scanned on 05/29/2017 16:58:25) File SHA256: bb87b78591cbbb3264e6e7a78e41a847087691103da8b73337e1e2aebcf2af03 (AV positives: 9/61 scanned on 05/25/2017 18:39:56) Found malicious artifacts related to "193.104.215.58" (ASN: 44786, Owner: Adobe Systems Software Ireland Limited): ... URL: http://www.adobe.com.br/ (AV positives: 1/64 scanned on 05/15/2017 18:42:52) URL: http://ns.adobe.com/xap/1.0/sType/ResourceRef (AV positives: 1/66 scanned on 12/01/2015 06:38:01) URL: http://ns.adobe.com/xmp/note/ (AV positives: 1/66 scanned on 12/01/2015 01:07:55) URL: http://ns.adobe.com/xap/1.0/sType/ResourceEvent (AV positives: 1/66 scanned on 12/01/2015 01:06:07) URL: http://ns.adobe.com/xap/1.0/mm/ (AV positives: 1/66 scanned on 12/01/2015 01:04:21) File SHA256: 37c6dbb53b6a7914eb8d86243c0693b8ed834b1a4ff074605f494b99319c78c9 (AV positives: 1/56 scanned on 04/26/2017 03:23:57) File SHA256: 54a60cdbd8b1e57be3b48cf69b9ffe2b0327d4b5c5092af898edaa6c5383d16e (AV positives: 1/62 scanned on 04/26/2017 03:48:09) File SHA256: 255f64b37da27ced3260cffda6b8db16b85e9eb686ee69bb01491c20c5831ddc (AV positives: 2/62 scanned on 04/26/2017 03:43:53) File SHA256: 2f2f39d9ccadbfe34d2814266c60b9e6fd79ba16a79a6758fbc34e94392110b9 (AV positives: 1/62 scanned on 04/26/2017 03:43:50) File SHA256: 6a3ebd548a9ff92ccca720b88cc9d28fbaebc1ace9ecdcecae24f728b754da34 (AV positives: 1/61 scanned on 04/26/2017 03:43:08)2b:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAABmZmZgAAAAAAZmZmYAAAAGeIiIZgAAAAAGiIiGYAB3d3iIiHd3d3d3dod3hnd3iPiIiIh4iIiIiIaIiIa7t4+IiIiIeIiIiIu2iIiGu7ePiIiIiHiIiIiIhoiIh7u3j4iIiIiId3d3d2eIiIiLt4+IiIiIiIiIiIiIiIj4i7ePiIiP/4iIiIiIiIiI+Iu3j4+P//+IiIiIiIiIiPiLh4+Pj////////4iIiIj4i4eP/4///4iIiIiIiIj/iIiHj//4iI+IiIh3d3d3d4iIh4/////4+IiIiIiIiIiIiIeP////iI+IiIiIiIiIiIiHj/////iI+IiIiIiIiIiIh4//////iIiIiIiIiIiIiIeP//////+IiIiIiIiIiIiHj///////+IiIiIiIiIiIh4/////////4j///////iIeP//////////+IiIiHd3eHiP/////////4iIiIiIiIh4iIiIiIiIiIiIjub///iIeIiIiIiIiIiIiI7u///4iHiIiIiIiImZ//iIh3d3d3dwiIiIiIiJmf///4iIiIiHAIiKov/4iIiIiId3d3d3dwCIiqr///+Ih3AAAAAAAAAACIiIiIiIiHcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwH/gP4A/4BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAYAAAAGAAD//wAB//////////////////w==1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"421e9f43cfe87ac8a10d6c6b841ba2584ba54d77bfe24225ed313aa9ea674aa9","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790305786644,"unified_at":"2026-09-25T03:09:46.644Z","metadata":{"hashes":{"sha256":"421e9f43cfe87ac8a10d6c6b841ba2584ba54d77bfe24225ed313aa9ea674aa9","sha1":"461ead774cc06cace920c7210789c76acb1b9434","md5":"fa04f0673ed1e0b5f28383f72a713b32","sha512":"55763397296da220c90faa6ad43238f39fcb188ded4a6cbd8c6d01f68146991d30982a89391cf8ff6d3f339300ad11ecb0bc4e6138c020b8a4e83da9101a8ca3","ssdeep":"1536:5JV6ucC5a75a75a75a75a75a75a75a75a45a5aI:t4aI","ssdeep_chunks":["1536:5JV6ucC","1536:JV6ucC5","1536:V6ucC5a","1536:6ucC5a7","1536:ucC5a75","1536:cC5a75a","1536:C5a75a7","1536:5a75a75","1536:a75a75a","1536:75a75a7","1536:75a75a4","1536:5a75a45","1536:a75a45a","1536:75a45a5","1536:5a45a5a","1536:a45a5aI","3072:5JV6ucC","3072:JV6ucC5","3072:V6ucC5a","3072:6ucC5a7","3072:ucC5a75","3072:cC5a75a","3072:C5a75a7","3072:5a75a75","3072:a75a75a","3072:75a75a7","3072:75a75a4","3072:5a75a45","3072:a75a45a","3072:75a45a5","3072:5a45a5a","3072:a45a5aI"],"imphash":"7512789375a730b9c70b40218cabd77f"},"file_info":{"file_name":"jun7.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":118784,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499286694000,"last_seen":1679804018000,"last_multi_scan":1679804018000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["sharik","smokeloader","cerber","ransomware","dofoil"]},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":15,"suspicious_count":14,"malicious_count":6,"total":35},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Zerber","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Backdoor]/Win32.Androm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1215672","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.CHUN","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.Troldesh.C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/S-44f3faf9!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.CHUN (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.FTCV trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Ransomware ( 005190011 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Ransomware-FMJ!FA04F0673ED1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Kryptik.epwwfy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Elenoocka-E","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_.2AAC8063","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_.2AAC8063","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.CryptZPACK.XHAQU","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Downloader","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Backdoor.Androm.Win32.43695","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom_.2AAC8063","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"\" queries volume information of \"C:\\\" at 00039505-00003756-0000010C-94046250","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"\" queries volume information of \"C:\\\" at 00039505-00003756-0000010C-94046250","origin":"API Call","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$24","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$25","origin":"Registry Access","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$26","origin":"Registry Access","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"www.autoitscript.com\"\n \"www.adobe.de\"\n \"preschoolandnursery.co.uk\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"212.227.91.231:80\"\n \"212.227.91.231:443\"\n \"193.104.215.58:80\"\n \"185.159.128.150:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"tokalika.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\30F97552FC822032A9FDFC403BC4C8BFC474C7EA\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /autoit3/ HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nHost: www.autoitscript.com\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"explorer.exe\" (UID: 00041684-00003992)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"level":"informative","category":"General","name":"Tries to GET non-existent files from a webserver","description":"\"POST / HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nContent-Length: 63\nHost: preschoolandnursery.co.uk\"","origin":"Network Traffic","relevance":5,"id":"network-3","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui\"\n \"\" touched file \"%WINDIR%\\system32\\rsaenh.dll\"\n \"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"www.autoitscript.com\"\n Pattern match: \"www.adobe.de\"\n Heuristic match: \"preschoolandnursery.co.uk\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00039505-00003756-00000105-94049501","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"$27","origin":"API Call","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"explorer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"explorer.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"explorer.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"$28","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"explorer.exe\" called \"OpenService\" to access the \"WinHttpAutoProxySvc\" service\n \"explorer.exe\" called \"OpenService\" to access the \"ServicesActive\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"explorer.exe\" called \"OpenService\" to access the \"gpsvc\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"level":"suspicious","category":"General","name":"Sent a control code to a service","description":"\"explorer.exe\" called \"ControlService\" and sent control code \"0X24\" to the service \"gpsvc\"\n \"explorer.exe\" called \"ControlService\" and sent control code \"0XFC\" to the service \"gpsvc\"","origin":"API Call","relevance":10,"id":"api-75","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Contains ability to write to a remote process","description":"WriteProcessMemory@KERNELBASE.DLL at 00039505-00003756-10712-1-00403F4C","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-34","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Persists itself using auto-execute at a hidden registry location","description":"\"explorer.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\RUN\")\n \"explorer.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\RUN\"; Key: \"APPDATALOW\"; Value: \"%APPDATA%\\Microsoft\\dawjhffc\\tehethvr.exe\")","origin":"Registry Access","relevance":8,"id":"registry-44","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"WriteProcessMemory\n GetModuleHandleA\n CopyFileExA\n GetProcAddress","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"4053157758581677186a1677653c17770000000000bfb7750000000056ccb775000000007ccab7750000000037683b756a2c1777d62d17770000000020693b750000000029a6b77500000000a48d3b7500000000f70eb77500000000\" to virtual address \"0x75AE1000\" (part of module \"NSI.DLL\")\n \"\" wrote bytes \"00b00000ac010000\" to virtual address \"0x0040BCEC\" (part of module \"JUN7.EXE\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"14/61 Antivirus vendors marked sample as malicious (22% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"14/61 Antivirus vendors marked sample as malicious (22% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"14/61 Antivirus vendors marked spawned process \"\" (PID: 3756) as malicious (classified as \"Ransom_HPCERBER.SMONT4\" with 22% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into explorer","description":"Injected into \"explorer.exe\" (UID: 00041684-00003992)","origin":"Monitored Target","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$29","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"level":"malicious","category":"Network Related","name":"Multiple malicious artifacts seen in the context of different hosts","description":"$2a","origin":"Network Traffic","relevance":10,"id":"network-27","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Persists itself using auto-execute at a hidden registry location"},{"detail":"Injects into explorer"}],"sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":1,"imported_dlls_count":70,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":14,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":4,"dns_resolutions_count":3,"contacted_urls_count":4,"http_requests_count":4},"behavior_tags":["sharik","smokeloader","cerber","ransomware","dofoil"],"sample_flags":["Network Traffic","User Comment"],"sandbox_reports":[{"id":"5938e328aac2ed7e0e861718","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Ransom_HPCERBER.SMONT4","contacted_countries":["DEU","IRL","RUS"],"submit_name":"jun7.exe","analysis_start_time":"2017-06-08T07:40:21+00:00","indicators_count":{"informative":15,"suspicious":14,"malicious":7},"tags":["Network Traffic","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"212.227.91.231","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"address":"212.227.91.231","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"address":"193.104.215.58","port":80,"protocol":"TCP","country":"Ireland","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"address":"185.159.128.150","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]}],"dns_resolutions":[{"domain":"www.adobe.de","address":"193.104.215.58","country":"Ireland","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"domain":"preschoolandnursery.co.uk","address":"185.159.128.150","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"domain":"www.autoitscript.com","address":"212.227.91.231","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]}],"http_requests":[{"host":"www.autoitscript.com","host_ip":"212.227.91.231:80","url":"/autoit3","method":"POST","response_code":"301","response_phrase":"Moved Permanently","header":"POST /autoit3 HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nContent-Length: 189\nHost: www.autoitscript.com","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"host":"www.autoitscript.com","host_ip":"212.227.91.231:80","url":"/autoit3/","method":"GET","response_code":"301","response_phrase":"Moved Permanently","header":"GET /autoit3/ HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nHost: www.autoitscript.com","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"host":"www.adobe.de","host_ip":"193.104.215.58:80","url":"/support/main.html","method":"POST","response_code":"301","response_phrase":"Moved Permanently","header":"POST /support/main.html HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nContent-Length: 73\nHost: www.adobe.de","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"host":"preschoolandnursery.co.uk","host_ip":"185.159.128.150:80","url":"/","method":"POST","response_code":"404","response_phrase":"Not Found","header":"POST / HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nContent-Length: 63\nHost: preschoolandnursery.co.uk","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}],"processes":[{"pid":3756,"ppid":0,"name":"jun7.exe","command_line":"","sha256":"421e9f43cfe87ac8a10d6c6b841ba2584ba54d77bfe24225ed313aa9ea674aa9","normalized_path":"C:\\jun7.exe","uid":"00039505-00003756","icon":"$2b"},{"pid":3992,"ppid":3756,"name":"explorer.exe","command_line":"","sha256":"0a8ce026714e03e72c619307bd598add5f9b639cfd91437cb8d9c847bf9f6894","normalized_path":"%WINDIR%\\explorer.exe","parent_uid":"00039505-00003756","uid":"00041684-00003992","icon":"$2c"}],"all_imported_dlls":["modemui.dll","gdi32.dll","cryptbase.dll","duser.dll","uxtheme.dll","wshqos.dll","comctl32.dll","dhcpcsvc.dll","dui70.dll","ncrypt.dll","cryptsp.dll","powrprof.dll","KernelBase.dll","dnsapi.dll","sspicli.dll","shell32.dll","uniplat.dll","wtsapi32.dll","IPHLPAPI.DLL","wship6.dll","gpapi.dll","apphelp.dll","GdiPlus.dll","secur32.dll","dhcpcsvc6.dll","schannel.dll","ntdll.dll","user32.dll","lpk.dll","ole32.dll","winhttp.dll","webio.dll","dwmapi.dll","rpcss.dll","setupapi.dll","msctf.dll","mswsock.dll","WSHTCPIP.DLL","devobj.dll","urlmon.dll","nsi.dll","propsys.dll","kernel32.dll","advapi32.dll","winnsi.dll","msvcrt.dll","sechost.dll","cfgmgr32.dll","shlwapi.dll","iertutil.dll","rsaenh.dll","credssp.dll","FWPUCLNT.DLL","usp10.dll","oleaut32.dll","slc.dll","rasadhlp.dll","bcrypt.dll","userenv.dll","profapi.dll","imm32.dll","wininet.dll","crypt32.dll","ExplorerFrame.dll","rpcrt4.dll","clusapi.dll","cryptdll.dll","msasn1.dll","ws2_32.dll","bcryptprimitives.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%WINDIR%\\en-US\\explorer.exe.mui","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"path":"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"path":"C:\\jun7.exe\\:Zone.Identifier:$DATA","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"path":"%APPDATA%\\Microsoft\\dawjhffc\\tehethvr.exe\\:Zone.Identifier:$DATA","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"path":"%APPDATA%\\Microsoft\\dawjhffc","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"path":"%APPDATA%\\Microsoft\\dawjhffc\\tehethvr.exe","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"path":"%WINDIR%\\system32\\en-US\\CRYPT32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]},{"path":"%APPDATA%\\Microsoft\\dawjhffc\\dawjhffc","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\30F97552FC822032A9FDFC403BC4C8BFC474C7EA","sources":[{"report_type":"sandbox","report_id":"5938e328aac2ed7e0e861718"}]}]}},"report_ids":{"sandbox_job_ids":["5938e328aac2ed7e0e861718"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious Ransom_.2AAC8063 Sample 421e9f43cfe8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 421e9f43cfe8…. Malware family: Ransom_.2AAC8063. Threat score 100/100. 21/28 AV engines flagged this file. 6 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/421e9f43cfe87ac8a10d6c6b841ba2584ba54d77bfe24225ed313aa9ea674aa9"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom_.2AAC8063 Sample 421e9f43cfe8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 421e9f43cfe8…. Malware family: Ransom_.2AAC8063. Threat score 100/100. 21/28 AV engines flagged this file. 6 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/421e9f43cfe87ac8a10d6c6b841ba2584ba54d77bfe24225ed313aa9ea674aa9"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom_.2AAC8063 Sample 421e9f43cfe8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 421e9f43cfe8…. Malware family: Ransom_.2AAC8063. Threat score 100/100. 21/28 AV engines flagged this file. 6 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2d","11",{}]]