26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 31:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T4cd,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.AIT.Ouroboros.Generic Sample 4808461bd5e1… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 4808461bd5e1…. Malware family: Ransom.AIT.Ouroboros.Generic. Threat score 100/100. 16/28 AV engines flagged this file. 12 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c","keywords":["Malicious","Ransom.AIT.Ouroboros.Generic","malware analysis","sandbox report","threat intelligence","4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c"],"about":{"@type":"SoftwareApplication","name":"bounty-18647661579204993","applicationCategory":["peexe","executable"],"identifier":"4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom.AIT.Ouroboros.Generic","antivirusDetections":{"malicious":16,"total":28},"behavioralIndicators":{"malicious":12,"suspicious":26},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T656,Antivirus vendors marked dropped file "netyeHD3z7v.exe" as clean (type is "data") Antivirus vendors marked dropped file "603jOLdO.exe" as clean (type is "data") Antivirus vendors marked dropped file "CZspj.doc" as clean (type is "data") Antivirus vendors marked dropped file "5F7TBCLUxJG.doc" as clean (type is "data") Antivirus vendors marked dropped file "iynDCtAWKrZqk.exe" as clean (type is "data") Antivirus vendors marked dropped file "uVLcWdEsjtuv46e.exe" as clean (type is "data") Antivirus vendors marked dropped file "Z2WBj58d55LDmYTY.exe" as clean (type is "data") Antivirus vendors marked dropped file "j8Sa.doc" as clean (type is "data") Antivirus vendors marked dropped file "3LnBJn.doc" as clean (type is "data") Antivirus vendors marked dropped file "qtaV9p.exe" as clean (type is "data") Antivirus vendors marked dropped file "oJIkHjK96.exe" as clean (type is "data") Antivirus vendors marked dropped file "xHkhUwrp.doc" as clean (type is "data") Antivirus vendors marked dropped file "tpnUorm2s9.doc" as clean (type is "data") Antivirus vendors marked dropped file "bMTL7.doc" as clean (type is "data") Antivirus vendors marked dropped file "4RHcGmkB.exe" as clean (type is "data") Antivirus vendors marked dropped file "2VEV49vrsTLgZa.doc" as clean (type is "data") Antivirus vendors marked dropped file "pJ5LdT.doc" as clean (type is "data") Antivirus vendors marked dropped file "gtcmotdmF.doc" as clean (type is "data") Antivirus vendors marked dropped file "m3I6.doc" as clean (type is "data") Antivirus vendors marked dropped file "piLMujsJtKhePpUk.doc" as clean (type is "data")28:T5f0,Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c schtasks /create /sc onlogon /tn 16 ..." (UID: 00062348-00002508) Spawned process "schtasks.exe" with commandline "schtasks /create /sc onlogon /tn 1607427705 /rl highest /tr %PR ..." (UID: 00062355-00003624) Spawned process "cmd.exe" with commandline "/C title 4916176|vssadmin.exe Delete Shadows /All /Quiet" (UID: 00065811-00004088) Spawned process "cmd.exe" with commandline "/C title 8700031|bcdedit /set {default} recoveryenabled No" (UID: 00065812-00003632) Spawned process "cmd.exe" with commandline "/C title 3058567|bcdedit /set {default} bootstatuspolicy ignorea ..." (UID: 00065813-00002348) Spawned process "cmd.exe" with commandline "/S /D /c" title 4916176"" (UID: 00065820-00002416) Spawned process "vssadmin.exe" with commandline "Delete Shadows /All /Quiet" (UID: 00065823-00003156) Spawned process "cmd.exe" with commandline "/S /D /c" title 8700031"" (UID: 00065823-00003312) Spawned process "cmd.exe" with commandline "/S /D /c" title 3058567"" (UID: 00065828-00003412) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} recoveryenabled No" (UID: 00065830-00003568) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00065832-00001384) Spawned process ".exe" with commandline "C:\480846~1.EXE" (UID: 00066384-00000812) Spawned process ".exe" with commandline "C:\480846~1.EXE" (UID: 00070505-00003896)29:T5f0,Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c schtasks /create /sc onlogon /tn 16 ..." (UID: 00062348-00002508) Spawned process "schtasks.exe" with commandline "schtasks /create /sc onlogon /tn 1607427705 /rl highest /tr %PR ..." (UID: 00062355-00003624) Spawned process "cmd.exe" with commandline "/C title 4916176|vssadmin.exe Delete Shadows /All /Quiet" (UID: 00065811-00004088) Spawned process "cmd.exe" with commandline "/C title 8700031|bcdedit /set {default} recoveryenabled No" (UID: 00065812-00003632) Spawned process "cmd.exe" with commandline "/C title 3058567|bcdedit /set {default} bootstatuspolicy ignorea ..." (UID: 00065813-00002348) Spawned process "cmd.exe" with commandline "/S /D /c" title 4916176"" (UID: 00065820-00002416) Spawned process "vssadmin.exe" with commandline "Delete Shadows /All /Quiet" (UID: 00065823-00003156) Spawned process "cmd.exe" with commandline "/S /D /c" title 8700031"" (UID: 00065823-00003312) Spawned process "cmd.exe" with commandline "/S /D /c" title 3058567"" (UID: 00065828-00003412) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} recoveryenabled No" (UID: 00065830-00003568) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00065832-00001384) Spawned process ".exe" with commandline "C:\480846~1.EXE" (UID: 00066384-00000812) Spawned process ".exe" with commandline "C:\480846~1.EXE" (UID: 00070505-00003896)2a:T8d5,"C:\4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c.exe" marked "C:\Users\%OSUSER%\Documents\Outlook Files\Outlook.pst" for deletion "C:\4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c.exe" marked "C:\Users\%OSUSER%\Downloads\07c4.exe" for deletion "C:\4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c.exe" marked "C:\Users\%OSUSER%\Downloads\0MTtHojL.rar" for deletion "C:\4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c.exe" marked "C:\Users\%OSUSER%\Downloads\0vAOzfx2r.mp3" for deletion "C:\4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c.exe" marked "C:\Users\%OSUSER%\Downloads\0yBVrBAk16A.img" for deletion "C:\4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c.exe" marked "C:\Users\%OSUSER%\Downloads\1N9XZhECgqNiztI.pdf" for deletion "C:\4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c.exe" marked "C:\Users\%OSUSER%\Downloads\2f07Jm4brrx.exe" for deletion "C:\4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c.exe" marked "C:\Users\%OSUSER%\Downloads\2MffCJz16PvEB.avi" for deletion "C:\4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c.exe" marked "C:\Users\%OSUSER%\Downloads\2VEV49vrsTLgZa.doc" for deletion "C:\4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c.exe" marked "C:\Users\%OSUSER%\Contacts\%OSUSER%.contact" for deletion "C:\4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c.exe" marked "C:\Users\%OSUSER%\Documents\Database1.accdb" for deletion "C:\4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c.exe" marked "C:\Users\%OSUSER%\Documents\Outlook Files\~Outlook.pst.tmp" for deletion "C:\4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c.exe" marked "C:\Users\%OSUSER%\Downloads\0NhkWddzyDHn7jj.img" for deletion "C:\4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c.exe" marked "C:\Users\%OSUSER%\Downloads\0Sp0C2.avi" for deletion "C:\4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c.exe" marked "C:\Users\%OSUSER%\Downloads\2w1w1py1F.txt" for deletion "C:\4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c.exe" marked "C:\PROGRA~2\COMMON~1\1607427705" for deletion2b:T5d6,".exe" opened "C:\Users\0JxrBjl\Documents\Outlook Files\Outlook.pst" with delete access ".exe" opened "C:\Users\0JxrBjl\Downloads\07c4.exe" with delete access ".exe" opened "C:\Users\0JxrBjl\Downloads\0MTtHojL.rar" with delete access ".exe" opened "C:\Users\0JxrBjl\Downloads\0vAOzfx2r.mp3" with delete access ".exe" opened "C:\Users\0JxrBjl\Downloads\0yBVrBAk16A.img" with delete access ".exe" opened "C:\Users\0JxrBjl\Downloads\1N9XZhECgqNiztI.pdf" with delete access ".exe" opened "C:\Users\0JxrBjl\Downloads\2f07Jm4brrx.exe" with delete access ".exe" opened "C:\Users\0JxrBjl\Downloads\2MffCJz16PvEB.avi" with delete access ".exe" opened "C:\Users\0JxrBjl\Downloads\2VEV49vrsTLgZa.doc" with delete access ".exe" opened "C:\Users\0JxrBjl\Contacts\%OSUSER%.contact" with delete access ".exe" opened "C:\Users\0JxrBjl\Documents\Database1.accdb" with delete access ".exe" opened "C:\Users\0JxrBjl\Documents\Outlook Files\~Outlook.pst.tmp" with delete access ".exe" opened "C:\Users\0JxrBjl\Downloads\0NhkWddzyDHn7jj.img" with delete access ".exe" opened "C:\Users\0JxrBjl\Downloads\0Sp0C2.avi" with delete access ".exe" opened "C:\Users\0JxrBjl\Downloads\2w1w1py1F.txt" with delete access ".exe" opened "C:\PROGRA~2\COMMON~1\1607427705" with delete access2c:T54c,RegCreateKeyExW RegCloseKey CreateProcessWithLogonW RegDeleteKeyW SetSecurityDescriptorDacl OpenProcessToken RegOpenKeyExW GetUserNameW RegEnumKeyExW CreateProcessAsUserW RegDeleteValueW IcmpSendEcho GetDriveTypeW GetFileAttributesW UnhandledExceptionFilter FindResourceExW DeviceIoControl CopyFileW WriteProcessMemory OutputDebugStringW GetModuleFileNameW IsDebuggerPresent LoadLibraryExW CreateThread ExitThread TerminateProcess GetModuleHandleExW CreateToolhelp32Snapshot LoadLibraryW GetVersionExW LoadLibraryA GetFileSize OpenProcess GetStartupInfoW ReadProcessMemory CreateDirectoryW DeleteFileW GetProcAddress GetTempFileNameW GetComputerNameW WriteFile FindNextFileW FindFirstFileW CreateFileW VirtualAllocEx FindResourceW Process32NextW LockResource GetCommandLineW CopyFileExW Process32FirstW GetModuleHandleW GetTempPathW CreateProcessW Sleep VirtualAlloc ShellExecuteW ShellExecuteExW GetCursorPos SetKeyboardState FindWindowExW FindWindowW GetWindowThreadProcessId FtpGetFileSize InternetOpenW InternetQueryDataAvailable InternetQueryOptionW InternetConnectW HttpQueryInfoW InternetCrackUrlW InternetCloseHandle HttpSendRequestW InternetOpenUrlW InternetReadFile FtpOpenFileW accept WSAStartup connect closesocket send listen recv socket bind recvfrom sendto2d:T9d3,".exe" wrote bytes "68130000" to virtual address "0x773B1680" (part of module "WS2_32.DLL") ".exe" wrote bytes "b840132d74ffe0" to virtual address "0x75533AD8" (part of module "SSPICLI.DLL") ".exe" wrote bytes "d83a0200" to virtual address "0x75534E38" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b4360200" to virtual address "0x75534D68" (part of module "SSPICLI.DLL") ".exe" wrote bytes "d83a5375" to virtual address "0x75540274" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b4365375" to virtual address "0x755401E4" (part of module "SSPICLI.DLL") ".exe" wrote bytes "d83a5375" to virtual address "0x75540258" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b4365375" to virtual address "0x75540278" (part of module "SSPICLI.DLL") ".exe" wrote bytes "7d07cd7781edcb77ae86ca77c6e0c977effdcc772d16cb776014cd77478dca77a8e2c9776089ca7700000000ad373b778b2d3b77b6413b7700000000" to virtual address "0x74071000" (part of module "WSHTCPIP.DLL") ".exe" wrote bytes "60122d74" to virtual address "0x7782E324" (part of module "WININET.DLL") ".exe" wrote bytes "d83a5375" to virtual address "0x755401E0" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b4365375" to virtual address "0x7554025C" (part of module "SSPICLI.DLL") ".exe" wrote bytes "d83a5375" to virtual address "0x755401FC" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b4360200" to virtual address "0x75534EA4" (part of module "SSPICLI.DLL") ".exe" wrote bytes "71118d007a3b8c00ab8b02007f950200fc8c0200729602006cc805001ecd89007d268900" to virtual address "0x774207E4" (part of module "USER32.DLL") ".exe" wrote bytes "60122d74" to virtual address "0x73E24028" (part of module "WEBIO.DLL") ".exe" wrote bytes "b4365375" to virtual address "0x75540200" (part of module "SSPICLI.DLL") ".exe" wrote bytes "c0dfc9771cf9c877ccf8c8770d64ca7700000000c011dd7500000000fc3edd7500000000e013dd75000000009457127625e0c977c6e0c97700000000bc6a117600000000cf31dd750000000093191276000000002c32dd7500000000" to virtual address "0x76401000" (part of module "NSI.DLL") ".exe" wrote bytes "b8c0152d74ffe0" to virtual address "0x755336B4" (part of module "SSPICLI.DLL") ".exe" wrote bytes "d83a0200" to virtual address "0x75534D78" (part of module "SSPICLI.DLL")2e:T5e9,"cmd.exe" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 128) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 128) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 128) "cmd.exe" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 128) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\vssadmin.exe" (Handle: 92) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\vssadmin.exe" (Handle: 92) "cmd.exe" wrote 8 bytes to a remote process "C:\Windows\System32\vssadmin.exe" (Handle: 92) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\bcdedit.exe" (Handle: 92) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\bcdedit.exe" (Handle: 92) "cmd.exe" wrote 8 bytes to a remote process "C:\Windows\System32\bcdedit.exe" (Handle: 92) ".exe" wrote 32 bytes to a remote process "C:\4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c.exe" (Handle: 388) ".exe" wrote 52 bytes to a remote process "C:\4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c.exe" (Handle: 388) ".exe" wrote 4 bytes to a remote process "C:\4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c.exe" (Handle: 388) ".exe" wrote 8 bytes to a remote process "C:\4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c.exe" (Handle: 388)2f:T695,Spawned process ".exe" (UID: 00062199-00003284) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c schtasks /create /sc onlogon /tn 1607427705 /rl highest /tr %PROGRAMFILES(X86)%\COMMON~1\480846~1.EXE" (UID: 00062348-00002508) Spawned process "schtasks.exe" with commandline "schtasks /create /sc onlogon /tn 1607427705 /rl highest /tr %PROGRAMFILES(X86)%\COMMON~1\480846~1.EXE" (UID: 00062355-00003624) Spawned process "cmd.exe" with commandline "/C title 4916176|vssadmin.exe Delete Shadows /All /Quiet" (UID: 00065811-00004088) Spawned process "cmd.exe" with commandline "/C title 8700031|bcdedit /set {default} recoveryenabled No" (UID: 00065812-00003632) Spawned process "cmd.exe" with commandline "/C title 3058567|bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00065813-00002348) Spawned process "cmd.exe" with commandline "/S /D /c" title 4916176"" (UID: 00065820-00002416) Spawned process "vssadmin.exe" with commandline "Delete Shadows /All /Quiet" (UID: 00065823-00003156) Spawned process "cmd.exe" with commandline "/S /D /c" title 8700031"" (UID: 00065823-00003312) Spawned process "cmd.exe" with commandline "/S /D /c" title 3058567"" (UID: 00065828-00003412) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} recoveryenabled No" (UID: 00065830-00003568) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00065832-00001384) Spawned process ".exe" with commandline "C:\480846~1.EXE" (UID: 00066384-00000812) Spawned process ".exe" with commandline "C:\480846~1.EXE" (UID: 00070505-00003896)30:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwB///////////////////cAf//////////////////3AH//////////////////9wB/+IiIiIiIj/iIiI////cAf/h3d3d3d4/////////3AH/4d3d3d3eP+IiIj///9wB/+Hd3d3d3j/////////cAf/h3d3d3d4/////////3AH/4d3d3d3eP+IiIj///9wB/+Hd3d3d3j/////////cAf/h3d3d3d4/4iIiP93/3AH/4d3d3d3eP//////d/9wB/+Hd3d3d3j/iIiI/3f/cAf/iHd3d3d4//////93/3AH/4d3d3d3eP+IiIj/d/9wB/+Hd3d3d3j//////2f/cAf/h3d3d3d4/4iIiP9m/3AH/4d3d3d3eP//////Zv9wB/+IiIiIiIj/iIiI/2b/cAf//////////////////3AH//////////////////9wB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791122873491,"unified_at":"2026-10-04T14:07:53.491Z","metadata":{"hashes":{"sha256":"4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c","sha1":"50859139c93f0842427262abb380317fa2376ee1","md5":"c218f77d902ff0d38182ab9d852011f3","sha512":"beaf9b88ad8d8ba06ca14d602d6f88a213db54f705ef3d186cff09d0862cb51983d5b3a5a1fab78c546862e9c57725d16695be3559da31552fcd7f84d17d326f","ssdeep":"24576:CAHnh+eWsN3skA4RV1Hom2KXMmHaJhG5:Fh+ZkldoPK8YaJO","ssdeep_chunks":["24576:CAHnh+e","24576:AHnh+eW","24576:Hnh+eWs","24576:nh+eWsN","24576:h+eWsN3","24576:+eWsN3s","24576:eWsN3sk","24576:WsN3skA","24576:sN3skA4","24576:N3skA4R","24576:3skA4RV","24576:skA4RV1","24576:kA4RV1H","24576:A4RV1Ho","24576:4RV1Hom","24576:RV1Hom2","24576:V1Hom2K","24576:1Hom2KX","24576:Hom2KXM","24576:om2KXMm","24576:m2KXMmH","24576:2KXMmHa","24576:KXMmHaJ","24576:XMmHaJh","24576:MmHaJhG","24576:mHaJhG5","49152:CAHnh+e","49152:AHnh+eW","49152:Hnh+eWs","49152:nh+eWsN","49152:h+eWsN3","49152:+eWsN3s","49152:eWsN3sk","49152:WsN3skA","49152:sN3skA4","49152:N3skA4R","49152:3skA4RV","49152:skA4RV1","49152:kA4RV1H","49152:A4RV1Ho","49152:4RV1Hom","49152:RV1Hom2","49152:V1Hom2K","49152:1Hom2KX","49152:Hom2KXM","49152:om2KXMm","49152:m2KXMmH","49152:2KXMmHa","49152:KXMmHaJ","49152:XMmHaJh","49152:MmHaJhG","49152:mHaJhG5","24576:Fh+Zkld","24576:h+Zkldo","24576:+ZkldoP","24576:ZkldoPK","24576:kldoPK8","24576:ldoPK8Y","24576:doPK8Ya","24576:oPK8YaJ","24576:PK8YaJO"],"imphash":"649f6ed9a4d576c154bbc0357156a4a4"},"file_info":{"file_name":"bounty-18647661579204993","file_type":["peexe","executable"],"file_type_id":"exe","file_size":903168,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1581736856000,"last_seen":1677915745000,"last_multi_scan":1677915745000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["CryptoWire","agenttesla","autinject","autoit","trojan","evasive","ransomware"]},"stats":{"av":{"malicious_count":16,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":15},"sandbox_signatures":{"informative_count":25,"suspicious_count":26,"malicious_count":12,"total":63},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Hacktool.Win32.Gamehack.3!e","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Occamy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1245824","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.33514969","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/AutoIt.NU.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.33514969 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Filecoder.NHN trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004f65341 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Script.Agent.f","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Ransom-AutoIt.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.haohup","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/CrWire-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Autoit.Wirus","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom.AIT.Ouroboros.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Local Job Scheduling","attack_id":"T1168","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1168","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"},{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1134","identifiers":[{"type":"suspicious","value":"Contains ability to impersonate another user on the local machine"}],"sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","identifiers":[{"type":"malicious","value":"Deletes volume snapshots (often used by ransomware)"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1045","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1045","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1056","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve keyboard strokes"}],"sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1083","identifiers":[{"type":"malicious","value":"Tries to access unusual system drive letters"},{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1082","identifiers":[{"type":"suspicious","value":"Contains ability to read monitor info"}],"sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","identifiers":[{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1115","identifiers":[{"type":"suspicious","value":"Contains ability to open the clipboard"}],"sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 60188-2346-0042A364","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.dll at 60188-2129-0046589F\n GetLocalTime@KERNEL32.dll at 60188-2779-0046DE85","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.dll at 60188-2180-00404AFE","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceExW@KERNEL32.dll at 60188-2742-0046B59E\n GetDiskFreeSpaceExW@KERNEL32.dll at 60188-2743-0046B666\n GetDiskFreeSpaceW@KERNEL32.dll at 60188-2744-0046B72E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetLocalTime@KERNEL32.dll directly followed by \"cmp word ptr [esi], 0000h\" and \"je 00465A17h\" at 60188-2129-0046589F","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 60188-2421-004581F7\n GetProcessHeap@KERNEL32.dll at 60188-2422-004586B3\n GetProcessHeap@KERNEL32.dll at 60188-2423-004587B3\n GetProcessHeap@KERNEL32.dll at 60188-2424-004587E7\n GetProcessHeap@KERNEL32.dll at 60188-2425-0045874A\n GetProcessHeap@KERNEL32.dll at 60188-2426-004583F4\n GetProcessHeap@KERNEL32.dll at 60188-2427-004585F1\n GetProcessHeap@KERNEL32.dll at 60188-2428-00458652\n GetProcessHeap@KERNEL32.dll at 60188-2431-00458B9E\n GetProcessHeap@KERNEL32.dll at 60188-2435-00458E03\n GetProcessHeap@KERNEL32.dll at 60188-2436-00458D5B\n GetProcessHeap@KERNEL32.dll at 60188-2440-00458E74","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\".exe\" queries volume information of \"C:\\\" at 00062199-00003284-00000046-4575421602\n \".exe\" queries volume information of \"C:\\\" at 00066384-00000812-00000046-121246361114\n \".exe\" queries volume information of \"C:\\\" at 00070505-00003896-00000046-253417279190","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\".exe\" queries volume information of \"C:\\\" at 00062199-00003284-00000046-4575421602\n \".exe\" queries volume information of \"C:\\\" at 00066384-00000812-00000046-121246361114\n \".exe\" queries volume information of \"C:\\\" at 00070505-00003896-00000046-253417279190","origin":"API Call","mitre_attack_id":"T1120","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"blockchain.info\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"104.16.54.3:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys","description":"UnregisterHotKey@USER32.dll at 60188-2203-0040FBBD\n RegisterHotKey@USER32.dll at 60188-2270-00412817","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-15","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\JackSparrow\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"JackSparrow\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$27","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"schtasks.exe\" touched \"TaskScheduler class\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\")\n \"vssadmin.exe\" touched \"VSSCoordinator Class\" (Path: \"HKCU\\CLSID\\{E579AB5F-1CC4-44B4-BED9-DE0991FF0623}\")\n \"vssadmin.exe\" touched \"PSFactoryBuffer\" (Path: \"HKCU\\CLSID\\{F2C2787D-95AB-40D4-942D-298F5F757874}\")","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"cmd.exe\" (UID: 00065820-00002416) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"cmd.exe\" (UID: 00065820-00002416) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"\n Process \".exe\" (UID: 00066384-00000812) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \".exe\" (UID: 00066384-00000812) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"%WINDIR%\\system32\\cmd.exe /c schtasks /create /sc onlogon /tn 1607427705 /rl highest /tr %PROGRAMFILES(X86)%\\COMMON~1\\480846~1.EXE\" on 2020-2-15.04:22:36.579\n \"/C title 4916176|vssadmin.exe Delete Shadows /All /Quiet\" on 2020-2-15.04:24:50.626\n \"/C title 8700031|bcdedit /set {default} recoveryenabled No\" on 2020-2-15.04:24:50.642\n \"/C title 3058567|bcdedit /set {default} bootstatuspolicy ignoreallfailures\" on 2020-2-15.04:24:50.673\n \"/S /D /c\" title 4916176\"\" on 2020-2-15.04:24:50.767\n \"/S /D /c\" title 8700031\"\" on 2020-2-15.04:24:50.907\n \"/S /D /c\" title 3058567\"\" on 2020-2-15.04:24:50.923","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\".exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$28","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$29","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"\n \"schtasks.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"5F7TBCLUxJG.encrypted.doc\" has type \"data\"\n \"qtaV9p.encrypted.exe\" has type \"data\"\n \"jwqS0glEK.encrypted.doc\" has type \"data\"\n \"netyeHD3z7v.exe\" has type \"data\"\n \"cQTUR.encrypted.exe\" has type \"data\"\n \"603jOLdO.exe\" has type \"data\"\n \"CZspj.doc\" has type \"data\"\n \"GgHlzQR.encrypted.doc\" has type \"data\"\n \"2VEV49vrsTLgZa.encrypted.doc\" has type \"data\"\n \"gSFISiLdEqY.encrypted.doc\" has type \"data\"\n \"bMTL7.encrypted.doc\" has type \"data\"\n \"5F7TBCLUxJG.doc\" has type \"data\"\n \"3LnBJn.encrypted.doc\" has type \"data\"\n \"iynDCtAWKrZqk.exe\" has type \"data\"\n \"2f07Jm4brrx.encrypted.exe\" has type \"data\"\n \"HoJQ.encrypted.doc\" has type \"data\"\n \"m3I6.encrypted.doc\" has type \"data\"\n \"WMmZ.encrypted.doc\" has type \"data\"\n \"uVLcWdEsjtuv46e.exe\" has type \"data\"\n \"8L418Npib.encrypted.exe\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \".exe\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \".exe\" touched file \"%WINDIR%\\SysWOW64\\cmd.exe\"\n \".exe\" touched file \"%WINDIR%\\SysWOW64\\rsaenh.dll\"\n \"cmd.exe\" touched file \"%WINDIR%\\SysWOW64\\en-US\\cmd.exe.mui\"\n \"cmd.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"cmd.exe\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"cmd.exe\" touched file \"%WINDIR%\\SysWOW64\\schtasks.exe\"\n \"schtasks.exe\" touched file \"%WINDIR%\\SysWOW64\\en-US\\schtasks.exe.mui\"\n \"schtasks.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"schtasks.exe\" touched file \"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui\"\n \"cmd.exe\" touched file \"%WINDIR%\\System32\\en-US\\cmd.exe.mui\"\n \"cmd.exe\" touched file \"%WINDIR%\\AppPatch\\AppPatch64\\sysmain.sdb\"\n \"vssadmin.exe\" touched file \"%WINDIR%\\System32\\en-US\\vssadmin.exe.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"blockchain.info\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"\n \"schtasks.exe\" opened \"\\Device\\KsecDD\"\n \"vssadmin.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c.bin\" was detected as \"VC8 -> Microsoft Corporation\"\n \"4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1045","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Possibly tries to hide a process launching it with different user credentials","description":"CreateProcessAsUserW@ADVAPI32.dll at 60188-2434-00458858\n CreateProcessWithLogonW@ADVAPI32.dll at 60188-2439-00458AF9","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-42","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\".exe\" at 00062199-00003284-00000033-8596517713\n \"vssadmin.exe\" at 00065823-00003156-00000033-115097390368\n \".exe\" at 00066384-00000812-00000033-210152704480","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Contains ability to block user input","description":"BlockInput@USER32.dll at 60188-2974-004741FD","origin":"Hybrid Analysis Technology","relevance":7,"id":"stream-26","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"AES256\" (Indicator: \"aes256\"; File: \"screen_3.png\")","origin":"File/Memory","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to read monitor info","description":"GetMonitorInfoW@USER32.dll at 60188-3215-00484B16","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-62","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a dropped file containing the Windows username (possible fingerprint attempt)","description":"Found dropped filename \"HAPUBWS.encrypted.contact\" containing the Windows username \"HAPUBWS\"\n Found dropped filename \"HAPUBWS.contact\" containing the Windows username \"HAPUBWS\"","origin":"Binary File","relevance":5,"id":"binary-19","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\".exe\" (Thread ID: 3748) slept \"520\" times (threshold: 500)","origin":"API Call","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"schtasks.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.dll at 60188-2665-00464189","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"255.255.255.255\"\n \"5.255.255.255\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 104.16.54.3 on port 443 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"suspicious","category":"Pattern Matching","name":"Contains ability to download files from the internet","description":"InternetReadFile@WININET.dll at 60188-2897-004725E2","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected text artifact in screenshot that indicate file could be ransomware","description":"\"payment\" (Source: screen_3.png, Indicator: \"payment\")","origin":"File/Memory","relevance":10,"id":"string-12","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.dll at 60188-3099-0047F121","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1215","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.dll at 60188-2976-0047425A\n OpenClipboard@USER32.dll at 60188-2979-00474458","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1115","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve keyboard strokes","description":"GetAsyncKeyState@USER32.dll at 60188-2603-00460219\n GetKeyboardState@USER32.dll at 60188-2605-0046052C\n GetKeyboardState@USER32.dll at 60188-2606-00461121\n GetKeyboardState@USER32.dll at 60188-2617-00461276\n GetKeyboardState@USER32.dll at 60188-2621-00460FE6\n GetKeyboardState@USER32.dll at 60188-2623-0046145D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1056","relevance":8,"id":"stream-12","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$2a","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$2b","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to elevate privileges","description":"SetSecurityDescriptorDacl@ADVAPI32.dll at 60188-2421-004581F7\n SetSecurityDescriptorDacl@ADVAPI32.dll at 60188-2426-004583F4","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-44","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to impersonate another user on the local machine","description":"LogonUserW@ADVAPI32.dll at 60188-2437-00458C93","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1134","relevance":10,"id":"stream-46","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to lookup privileges","description":"GetSecurityDescriptorDacl@ADVAPI32.dll at 60188-2421-004581F7\n GetSecurityDescriptorDacl@ADVAPI32.dll at 60188-2426-004583F4","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-43","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$2c","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2d","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"bcdedit.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\".exe\" created file \"%PROGRAMFILES(X86)%\\COMMON~1\\4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c.exe:Zone.Identifier\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Tries to suppress failures during boot (often used to hide system changes)","description":"Tries to suppress failures during boot \"cmd.exe\" with commandline \"/C title 3058567|bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00065813-00002348)\n Tries to suppress failures during boot \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00065832-00001384)","origin":"Monitored Target","relevance":8,"id":"target-6","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"30/71 Antivirus vendors marked sample as malicious (42% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"30/71 Antivirus vendors marked sample as malicious (42% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"30/71 Antivirus vendors marked dropped file \"4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c.exe\" as malicious (classified as \"Generic.Ransom.AIT.Ouroboros\" with 42% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"30/71 Antivirus vendors marked spawned process \".exe\" (PID: 812) as malicious (classified as \"Generic.Ransom.AIT.Ouroboros\" with 42% detection rate)\n 30/71 Antivirus vendors marked spawned process \".exe\" (PID: 3896) as malicious (classified as \"Generic.Ransom.AIT.Ouroboros\" with 42% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\".exe\" allocated memory in \"%WINDIR%\\SysWOW64\\wkscli.dll\"\n \".exe\" allocated memory in \"\\Device\\NamedPipe\\wkssvc\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$2e","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00065823-00003156)","origin":"Monitored Target","mitre_attack_id":"T1107","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.dll at 60188-2681-0046545F","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$2f","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Tries to access unusual system drive letters","description":"\".exe\" touched \"k:\"\n \".exe\" touched \"l:\"\n \".exe\" touched \"m:\"\n \".exe\" touched \"n:\"\n \".exe\" touched \"o:\"\n \".exe\" touched \"p:\"\n \".exe\" touched \"q:\"\n \".exe\" touched \"r:\"\n \".exe\" touched \"s:\"\n \".exe\" touched \"t:\"\n \".exe\" touched \"u:\"\n \".exe\" touched \"v:\"\n \".exe\" touched \"w:\"\n \".exe\" touched \"x:\"\n \".exe\" touched \"y:\"","origin":"API Call","mitre_attack_id":"T1083","relevance":9,"id":"api-31","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Deletes volume snapshots (often used by ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"Spyware","details_count":5,"details":[{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to retrieve keyboard strokes"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Deletes volume snapshots (often used by ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns a lot of processes"},{"detail":"Disables startup repair"},{"detail":"Tries to suppress failures during boot (often used to hide system changes)"}],"sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Found a dropped file containing the Windows username (possible fingerprint attempt)"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Tries to access unusual system drive letters"}],"sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]}]},"activity":{"stats":{"process_count":14,"spawned_processes_count":14,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":100,"dropped_files_count":0,"extracted_files_count":106,"files_written_count":44,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["CryptoWire","agenttesla","autinject","autoit","trojan","evasive","ransomware"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"sandbox_reports":[{"id":"5e476398d1f49405057d7a73","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Generic.Ransom.AIT.Ouroboros","contacted_countries":["USA"],"submit_name":"4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c.exe","analysis_start_time":"2020-02-15T03:21:05+00:00","indicators_count":{"informative":25,"suspicious":35,"malicious":17},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.16.54.3","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]}],"dns_resolutions":[{"domain":"blockchain.info","address":"104.16.54.3","ttl":36,"country":"United States","registrar_name":"CloudFlare, Inc.","registrar_organization":"Blockchain","registrar_name_servers":"BETH.NS.CLOUDFLARE.COM","registrar_creation_date":"2011-10-15T15:48:38+00:00","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}],"processes":[{"pid":3284,"ppid":0,"name":"4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c.exe","command_line":"","sha256":"4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c","normalized_path":"C:\\4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c.exe","uid":"00062199-00003284","icon":"$30"},{"pid":2508,"ppid":3284,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c schtasks /create /sc onlogon /tn 1607427705 /rl highest /tr %PROGRAMFILES(X86)%\\COMMON~1\\480846~1.EXE","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00062199-00003284","uid":"00062348-00002508"},{"pid":3624,"ppid":2508,"name":"schtasks.exe","command_line":"schtasks /create /sc onlogon /tn 1607427705 /rl highest /tr %PROGRAMFILES(X86)%\\COMMON~1\\480846~1.EXE","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\SysWOW64\\schtasks.exe","parent_uid":"00062348-00002508","uid":"00062355-00003624"},{"pid":4088,"ppid":3284,"name":"cmd.exe","command_line":"/C title 4916176|vssadmin.exe Delete Shadows /All /Quiet","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00062199-00003284","uid":"00065811-00004088"},{"pid":2416,"ppid":4088,"name":"cmd.exe","command_line":"/S /D /c\" title 4916176\"","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00065811-00004088","uid":"00065820-00002416"},{"pid":3156,"ppid":4088,"name":"vssadmin.exe","command_line":"Delete Shadows /All /Quiet","sha256":"4de7fa20e3224382d8c4a81017e5bdd4673afbef9c0f017e203d7b78977fbf8c","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","parent_uid":"00065811-00004088","uid":"00065823-00003156"},{"pid":3632,"ppid":3284,"name":"cmd.exe","command_line":"/C title 8700031|bcdedit /set {default} recoveryenabled No","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00062199-00003284","uid":"00065812-00003632"},{"pid":3312,"ppid":3632,"name":"cmd.exe","command_line":"/S /D /c\" title 8700031\"","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00065812-00003632","uid":"00065823-00003312"},{"pid":3568,"ppid":3632,"name":"bcdedit.exe","command_line":"bcdedit /set {default} recoveryenabled No","sha256":"29dbfde0ab20f31de72b8a9b50f9843ae7cafb62933f4f306e7168d4acf33947","normalized_path":"%WINDIR%\\System32\\bcdedit.exe","parent_uid":"00065812-00003632","uid":"00065830-00003568"},{"pid":2348,"ppid":3284,"name":"cmd.exe","command_line":"/C title 3058567|bcdedit /set {default} bootstatuspolicy ignoreallfailures","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00062199-00003284","uid":"00065813-00002348"},{"pid":3412,"ppid":2348,"name":"cmd.exe","command_line":"/S /D /c\" title 3058567\"","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00065813-00002348","uid":"00065828-00003412"},{"pid":1384,"ppid":2348,"name":"bcdedit.exe","command_line":"bcdedit /set {default} bootstatuspolicy ignoreallfailures","sha256":"29dbfde0ab20f31de72b8a9b50f9843ae7cafb62933f4f306e7168d4acf33947","normalized_path":"%WINDIR%\\System32\\bcdedit.exe","parent_uid":"00065813-00002348","uid":"00065832-00001384"},{"pid":812,"ppid":3284,"name":"4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c.exe","command_line":"C:\\480846~1.EXE","sha256":"4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c","normalized_path":"C:\\4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c.exe","parent_uid":"00062199-00003284","uid":"00066384-00000812"},{"pid":3896,"ppid":812,"name":"4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c.exe","command_line":"C:\\480846~1.EXE","sha256":"4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c","normalized_path":"C:\\4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c.exe","parent_uid":"00066384-00000812","uid":"00070505-00003896"}],"all_imported_dlls":["imm32.dll","rsaenh.dll","secur32.dll","wow64cpu.dll","netutils.dll","wship6.dll","clbcatq.dll","dnsapi.dll","dhcpcsvc.dll","comctl32.dll","api-ms-win-downlevel-user32-l1-1-0.dll","srvcli.dll","propsys.dll","credssp.dll","shell32.dll","ncrypt.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","msasn1.dll","ktmw32.dll","xmllite.dll","mpr.dll","setupapi.dll","wsock32.dll","sechost.dll","wow64.dll","usp10.dll","winhttp.dll","rpcss.dll","lpk.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","devobj.dll","mswsock.dll","FWPUCLNT.DLL","api-ms-win-downlevel-shlwapi-l2-1-0.dll","nlaapi.dll","winnsi.dll","ws2_32.dll","shlwapi.dll","netprofm.dll","schannel.dll","winbrand.dll","imageres.dll","psapi.dll","sspicli.dll","cryptbase.dll","normaliz.dll","SensApi.dll","ntdll.dll","rasadhlp.dll","npmproxy.dll","ntmarta.dll","vssapi.dll","kernel32.dll","KernelBase.dll","msvcrt.dll","nsi.dll","iertutil.dll","cryptsp.dll","cryptnet.dll","uxtheme.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","msctf.dll","RpcRtRemote.dll","crypt32.dll","comdlg32.dll","webio.dll","taskschd.dll","vsstrace.dll","ole32.dll","msvcr100.dll","winmm.dll","gdi32.dll","rpcrt4.dll","user32.dll","userenv.dll","profapi.dll","advapi32.dll","Wldap32.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","urlmon.dll","dhcpcsvc6.dll","WSHTCPIP.DLL","bcrypt.dll","bcryptprimitives.dll","version.dll","oleaut32.dll","apphelp.dll","cfgmgr32.dll","wintrust.dll","gpapi.dll","vss_ps.dll","atl.dll","wow64win.dll","IPHLPAPI.DLL","wininet.dll","dwmapi.dll","netapi32.dll","wkscli.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c.exe","sha256":"4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"2VEV49vrsTLgZa.doc","sha256":"43f8017db20e6df3b1a782c8061f80800de0e6a16e160e1a4ca5d52cde437f4a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"2f07Jm4brrx.exe","sha256":"f5f0a2a4bf476364b36b46c1262a4b9849a3c89d3911a0c3a915d0805f457bb7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"netyeHD3z7v.exe","sha256":"b063f3a3522d30c4e098573631d9a9451f59da8b69025095459a6081f476434d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"603jOLdO.exe","sha256":"b2ef80d689fd53871496a87b5aa9db31a8d9b7089bd1bbae25b99c2f722f0e01","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"CZspj.doc","sha256":"6ebeddb61c5af9538cea3a3a2143903842dc4eb5765884c049547541f494f75e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"5F7TBCLUxJG.doc","sha256":"e96f9ce1e06007d67c9b60c0166010dfd6b32aff2d40247c6f2503bfd1238ad5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"iynDCtAWKrZqk.exe","sha256":"4acb19defa2783635b11e6dcfb63f0720a97b548164f19649988efdfb8708a4e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"uVLcWdEsjtuv46e.exe","sha256":"a7c273a19ed06ea1bb7c47905bb1578219c5f167ff5476e397a9c2e5f37d14a0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"Z2WBj58d55LDmYTY.exe","sha256":"620807af358854aee9904b847aef9180863230a6c3ee807a80d014960883251d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"j8Sa.doc","sha256":"8b8fc8a00ffdaefe3454b64b7ca07d3f6e15b9e3fb35a3cf55450fa5277a0b03","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"3LnBJn.doc","sha256":"fbb6468ab0e41b27bbe842cc856f54da1c087703a54193e2452fafbb4954c450","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"qtaV9p.exe","sha256":"02ca5408f08c965bb4d4905f840978ab299670853d63426b035cfb9532e55ff6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"oJIkHjK96.exe","sha256":"f883650c320109b0d9b5df9df42e4727a96dc90597434bc658dbe06a9f3c1bb9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"xHkhUwrp.doc","sha256":"54e83ef595f50a428e6da4f3cbe5f4f9825f9dfd0a47dcbc2c3ec8ba39315769","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"tpnUorm2s9.doc","sha256":"8a656811f9a2578ae40553f1f9e522885b318ee71e6654710847c002b242b2d0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"bMTL7.doc","sha256":"d146654c1982922543965833ee0f067a0216dc13aafb6665b13a50a8cf9eb7fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"4RHcGmkB.exe","sha256":"cb753a01001966dcb2f86e3d145974c6134ca567c2cf8ece2b353ebf38344741","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"pJ5LdT.doc","sha256":"0299f757a85a1aad6cbe1ad2b0eda925d8df667cd04e646af8917f65cbf24537","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"gtcmotdmF.doc","sha256":"4a8969c5824ba5725a7ed861310254c0718a1f08b99b4c0cef76a3b6682c4e0c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"m3I6.doc","sha256":"e9129cfdb5f448520926e8df60d8f21e256ee7a746309e342fb2a2eb7de37be2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"piLMujsJtKhePpUk.doc","sha256":"1177b10df2eb00925ed12655ceac530997fbfadf6cd60d375e941e3f322440aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"8L418Npib.exe","sha256":"13c9a56a9d24b3a9359afce845524b2dacf4e3c5f1b8b2c04e7acea9d4568e9c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"JtmJWBb0bwcS.exe","sha256":"9284b6ac1d02cdacbb104ca19903b005e28971e131a1085f83bd2537c76771e9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"1607427705","sha256":"ad95131bc0b799c0b1af477fb14fcf26a6a9f76079e48bf090acb7e8367bfd0e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"0Sp0C2.encrypted.avi","sha256":"e4cc6c226ab0561caea19e3cdfcfcaed4f64e83f20088975a682db4bd64b48aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"gSFISiLdEqY.encrypted.doc","sha256":"e4cc6c226ab0561caea19e3cdfcfcaed4f64e83f20088975a682db4bd64b48aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"WMmZ.encrypted.doc","sha256":"e4cc6c226ab0561caea19e3cdfcfcaed4f64e83f20088975a682db4bd64b48aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"JZ2pMXx3Vcrzbyv.encrypted.doc","sha256":"e4cc6c226ab0561caea19e3cdfcfcaed4f64e83f20088975a682db4bd64b48aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"ETlJ.encrypted.doc","sha256":"e4cc6c226ab0561caea19e3cdfcfcaed4f64e83f20088975a682db4bd64b48aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"b351j5J.encrypted.doc","sha256":"e4cc6c226ab0561caea19e3cdfcfcaed4f64e83f20088975a682db4bd64b48aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"zCGRRRadxxE3D.encrypted.exe","sha256":"e4cc6c226ab0561caea19e3cdfcfcaed4f64e83f20088975a682db4bd64b48aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"SLw6l.encrypted.exe","sha256":"e4cc6c226ab0561caea19e3cdfcfcaed4f64e83f20088975a682db4bd64b48aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"yOeWz.encrypted.exe","sha256":"e4cc6c226ab0561caea19e3cdfcfcaed4f64e83f20088975a682db4bd64b48aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"u8rbs.encrypted.doc","sha256":"e4cc6c226ab0561caea19e3cdfcfcaed4f64e83f20088975a682db4bd64b48aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"16074277051607427705","sha256":"e8e54b908fdaa0d2325e833be07849408a3a59771e2c7426103b5c30e9797134","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"5077247061","sha256":"7ca336736beaa82ece262e3122bfa784384ab02eb3920a69299d9a3165b50503","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"log.txt","sha256":"680cfcc5fc587045374cc61d2a596c2f40849b9fa7573f3417cef7e415c2fd20","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"HAPUBWS.contact","sha256":"617f31bac209a183022ebc3652cc68b81c0a3d52b9c9f1ee000e6cd17cafbb54","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"HAPUBWS.encrypted.contact","sha256":"862f6ceee01420ebc2dbfc084968951714e9c19a6a044ac19163ea0f6e896c7b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"Database1.encrypted.accdb","sha256":"67ce01247a605d0332d2bbfe4a22357703b6db19a3912e899b0d0df4e85f9722","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"Outlook.encrypted.pst","sha256":"76b07a8a87ced5b79688bb5dabe3d450638941a66d24279d66f7e5bd20840583","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"Outlook.pst","sha256":"6af064458f368ed1f175936b1cdde6203d28fe8036b69049c7aba0f6a93fb0c0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"~Outlook.pst.encrypted.tmp","sha256":"7ad91cf47872506e45a891cbda922e269219d7b236dacc94a9e5f71ef46432ae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"~Outlook.pst.tmp","sha256":"de2f256064a0af797747c2b97505dc0b9f3df0de4f489eac731c23ae9ca9cc31","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"07c4.encrypted.exe","sha256":"65d6973aa5750646bd41036fe56afbb28a3210e0eb76946b670f68d3cee4c9c5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"07c4.exe","sha256":"b3065bacb33911d43be9e42f39261ff1a9fbe150f0ff00f209395c914e380cfb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"0MTtHojL.encrypted.rar","sha256":"2c7a3d842c366004abad960517c35e9464445c7d0dc9b321a8ae17d76e52dd2e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"0MTtHojL.rar","sha256":"9551263f1b01a2b714e79ddc46567e119e2d707c5429612122cfe5890fd7a0ae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"0NhkWddzyDHn7jj.encrypted.img","sha256":"af7154437880a54403fa2f35e4730ad72db6a6c64e67673b2a93ac9ca1e76cac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"0NhkWddzyDHn7jj.img","sha256":"2c718acfe88778030bc5a104ab9a113a88ac1fdefe4314977e1689288d878c46","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"0vAOzfx2r.encrypted.mp3","sha256":"a884b7253f58dadb603d6197b265569ced95fe9492cd1b6186b1596f1803e70e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"0vAOzfx2r.mp3","sha256":"48651e99d156c218fd8f7d45deb9d622f2d5c8f930232c2a9cb920164706ad6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"2VEV49vrsTLgZa.encrypted.doc","sha256":"4f7905c154966c8150d8ece139a6ac16ea3e5ac0506cf6953b20722de252df57","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"2f07Jm4brrx.encrypted.exe","sha256":"91e48842ad6511940fcc2d214ea4d7ac8a55ee768ba880c8ec9ea363444693cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"5F7TBCLUxJG.encrypted.doc","sha256":"276af941e10fd243b18fbfcf24ecebbbb369e62705656cdd50d5692c24800654","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"qtaV9p.encrypted.exe","sha256":"4e5bc4713d77369c23ec1f349021bc4aa4741d1dbba380a9a1f232394d5ec7b9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"jwqS0glEK.encrypted.doc","sha256":"e4cc6c226ab0561caea19e3cdfcfcaed4f64e83f20088975a682db4bd64b48aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"cQTUR.encrypted.exe","sha256":"516c4bd0dbefe736a93ea69ebd98990627b74ffe087924dcd65ece9dfe17a995","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"GgHlzQR.encrypted.doc","sha256":"76294c5ea7f3ec248dceec0f4ed01c31ec15c13534d49d84ac7d0ace5e704ef3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"bMTL7.encrypted.doc","sha256":"998d6afe9888fe150a9d79a3a25b67d19eef0e80184a4b8c78feccb2c99d6945","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"3LnBJn.encrypted.doc","sha256":"6143cb4124976e355ce2556a4136d93fc9da6acadeffece5a8d5cd450568b6ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"HoJQ.encrypted.doc","sha256":"9a2b52e94579b10e101a194accae6d78debbb207cf96310457025bbe08925d50","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"m3I6.encrypted.doc","sha256":"37cb5b0cd39fa3a9a570f6a54ed3ebeb4cbd7033b8a45ab0545a66032937421b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"8L418Npib.encrypted.exe","sha256":"948b365cedd8597d77853eaec28b7e632544dbd8bfdce4d3ec8908a25985d936","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"TXnZ8wd3RZI.encrypted.exe","sha256":"7265426bcc9517675a8ba6a77f8d01906088555cd173724926f2a5b9b41cfda4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"DKwpgw.encrypted.doc","sha256":"6d104e7d38b8af4a49ad787f81841b865acce229eae6aa7d4d3bb218ac239165","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"uVLcWdEsjtuv46e.encrypted.exe","sha256":"2e7a812f317d3f4a45166c3cebf335918267c485493bbfda48b0e3611bac387f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"F42upSs.encrypted.exe","sha256":"1f73cd0923e83a9d01060140f51369f577b05f8ec346399762418dd94a4cc864","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"oJIkHjK96.encrypted.exe","sha256":"54a1ee06ec79684df282d69c25708c50e2e2cd63670f81587308de08ecef6110","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"4RHcGmkB.encrypted.exe","sha256":"600efcbd4a19ed47018e17e56f670d66b5df67b62e283e47fe7cfe68b3d5a07c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"7mOyQqezSRsEQhHm.encrypted.exe","sha256":"2631c11516427140d2275f7c0cc907efd47dfb641865749ca6924c22fdfec7e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"xHkhUwrp.encrypted.doc","sha256":"fef415e974c4e9140f16ed801802b47a614561fbd77046f49ccf8d99bd7d8bc0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"iynDCtAWKrZqk.encrypted.exe","sha256":"ffe9ffe22867f44c942f8313c91e1379a38ad4e1904f04007f9180b01bfcd529","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"603jOLdO.encrypted.exe","sha256":"5701859a863786d1c3644556da9867cb73a3d2efaca6c5344cf4d16b3c9e418d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"GmpsrAn.encrypted.exe","sha256":"4bea397307ac3ebf92adb2053a47cd108c091367dc770c751f30dd8cb4b0b5c4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"gtcmotdmF.encrypted.doc","sha256":"dc1a1fcbc04c84cb1ac5ed5993ff8413aec6598b62a22fbe8486e93aa2ce3923","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"pJ5LdT.encrypted.doc","sha256":"ed584f19fdbf8de1e0fd8638f32dc9bb5285f9120a3d0687d5b2e12caa4a5f14","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"Czkv.encrypted.exe","sha256":"bc9ae2527d650e216002aea34068ed52c01861613d8960ae6e75cd510772bb50","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"CZspj.encrypted.doc","sha256":"c0a92c724217579ed3859e201b185a45bfbf51033c5f2f4dd67005ac96262319","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"netyeHD3z7v.encrypted.exe","sha256":"abea00d40f83360268bc4e2f4ec0c5ae7d044b4b1a6467ac2e302f6079269ba9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"piLMujsJtKhePpUk.encrypted.doc","sha256":"62568a40334bf23386829e031c16d38eb10148ec4d9fc0e2b39a106001a9121c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"naK1.exe","sha256":"6d50c292d75eec01aca42afa9c75e0f9fa3e596faeb422f27a80f02e8fdff3e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"JtmJWBb0bwcS.encrypted.exe","sha256":"c4712c376a9ffe6ecd28384269deac1831950a3f25dc694bd5ae95633c4a1c28","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"Ae5I9Tp.doc","sha256":"3a692cb9aa8f671df2cc520a18fd07a3817ab39861ffd047804d913d91e5cf7f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"GgHlzQR.doc","sha256":"2808ada0833fc3b4a0ee7c7df7ddf8dfd182eccca458e80fa34d4b96c9bb2c40","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"F42upSs.exe","sha256":"1c096f259c652e157a8633719844341da5c0a583d1362afa404cc83762066ac5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"tpnUorm2s9.encrypted.doc","sha256":"522555881087b9307306c09fd09719796bf46434ee0d55c2538059200e54406b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"sFbzgHs1K3qLZF41.doc","sha256":"978b3b18c792ac004c4e0c0ae18a9341437eb6e003891b548a4f718402dde0a4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"MXf3Y8G12MNbrM.doc","sha256":"cba450fc2286ea6bfb136d9133e4bc8d08f9be57c415f79ca15f8ade8364abe4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"OpKgf.doc","sha256":"9e172b215bcea03cdd3d5e36459e3c1a73a3f7c8eb2fc7254433d1a8de19e015","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"7mOyQqezSRsEQhHm.exe","sha256":"5b4c538f4c6064d8ae49c822438939bb24444984b8b1c46d6ebade3bb6d3c575","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"cQTUR.exe","sha256":"cdf0c7003c58cd97f6ae31410cedc680ef28391f438d073cad25d7fb96115d5f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"naK1.encrypted.exe","sha256":"80e85129eb9d449e85b5786ffe27c1a662ead4f2cc9a8720cf23e59cc39e72bc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"eVGu5yCg91A9.encrypted.exe","sha256":"7257d61b3256b2adbf9ce6d8109d565484729c766b945a55a1ec7ec6d118b917","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"j8Sa.encrypted.doc","sha256":"a3d059f832b03083509657fcdb0d077bd95e88f73ad1c5d63851d92fb0dbf7fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"HoJQ.doc","sha256":"28462ace71bf98c6276dfcfb4a939ce4637ef7b2ecaa96e0dd3f71de4ddfe71a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"sFbzgHs1K3qLZF41.encrypted.doc","sha256":"423a0672293f74e8c2f8537a5ba02aa761951953dc2df92974a887582cab39d9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"Ae5I9Tp.encrypted.doc","sha256":"ef1beec5a678fdf62f907d1b165cbcd93c12007c5205298a113c5ea00dbb33e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"GmpsrAn.exe","sha256":"6478ee003067f46189afc7265aff738bf4d5b096c7858ea25363d41abe87f366","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"TXnZ8wd3RZI.exe","sha256":"c2ec9d736f8426145b557dc9b6c2c7a84a2fc0e9eb3418ccf3306b6750f17347","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"MXf3Y8G12MNbrM.encrypted.doc","sha256":"1810f9e87c1875fbf12ff32876efbe543d59be6d698b4da1edc9e6202c96df71","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"OpKgf.encrypted.doc","sha256":"99ba72c6697d8760265c86c4ff0148f80764d296401c06ec8d23a8868bae1ede","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"DKwpgw.doc","sha256":"b546d777671c8ae52fbbd019fbe620a71d9a7431bfe24c12ca6877aa9b7ddbff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"eVGu5yCg91A9.exe","sha256":"f596cde4f7ce608c147d5b8182d160b4de12202c586933b1bf62e1577023f4d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"Z2WBj58d55LDmYTY.encrypted.exe","sha256":"1b9da9c38a97dfaa80d1ca7d6008729f975ab8632e13f243621d24668ca57c75","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]}],"files_written":[{"path":"C:\\4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"%PROGRAMFILES(X86)%\\COMMON~1\\4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"%WINDIR%\\SysWOW64\\schtasks.exe","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\schtasks.exe.mui","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"%USERPROFILE%\\Downloads\\0NhkWddzyDHn7jj.encrypted.img","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"%USERPROFILE%\\Downloads\\0vAOzfx2r.encrypted.mp3","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"%USERPROFILE%\\Downloads\\0yBVrBAk16A.encrypted.img","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"%USERPROFILE%\\Downloads\\2f07Jm4brrx.encrypted.exe","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"%USERPROFILE%\\Downloads\\2w1w1py1F.encrypted.txt","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"%PROGRAMFILES(X86)%\\COMMON~1\\4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c.exe","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"%WINDIR%\\SysWOW64\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"%USERPROFILE%\\Contacts\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"%USERPROFILE%\\Contacts\\%OSUSER%.encrypted.contact","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"%USERPROFILE%\\Documents\\Database1.encrypted.accdb","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"%USERPROFILE%\\Documents\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"%USERPROFILE%\\Documents\\Outlook Files\\Outlook.encrypted.pst","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"%USERPROFILE%\\Documents\\Outlook Files\\~Outlook.pst.encrypted.tmp","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"%USERPROFILE%\\Downloads\\07c4.encrypted.exe","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"%USERPROFILE%\\Downloads\\0MTtHojL.encrypted.rar","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"%USERPROFILE%\\Downloads\\0Sp0C2.encrypted.avi","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"%USERPROFILE%\\Downloads\\1N9XZhECgqNiztI.encrypted.pdf","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"%USERPROFILE%\\Downloads\\2MffCJz16PvEB.encrypted.avi","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"%USERPROFILE%\\Downloads\\2VEV49vrsTLgZa.encrypted.doc","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"%WINDIR%\\AppPatch\\AppPatch64\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"%WINDIR%\\System32\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"%WINDIR%\\SysWOW64\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\imageres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"%PROGRAMFILES(X86)%\\COMMON~1\\16074277051607427705","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"%PROGRAMFILES(X86)%\\COMMON~1\\5077247061","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"C:\\480846~1.EXE","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"C:\\4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c.exe","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"path":"%PROGRAMFILES(X86)%\\COMMON~1\\log.txt","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\BCD00000000\\OBJECTS\\{D9A35955-D863-11E7-9DEC-946EA4DB88B1}\\ELEMENTS\\16000009\\","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"key":"HKLM\\BCD00000000\\OBJECTS\\{D9A35955-D863-11E7-9DEC-946EA4DB88B1}\\ELEMENTS\\250000E0\\","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\JackSparrow","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]},{"name":"JackSparrow","sources":[{"report_type":"sandbox","report_id":"5e476398d1f49405057d7a73"}]}]}},"report_ids":{"sandbox_job_ids":["5e476398d1f49405057d7a73"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Ransom.AIT.Ouroboros.Generic Sample 4808461bd5e1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 4808461bd5e1…. Malware family: Ransom.AIT.Ouroboros.Generic. Threat score 100/100. 16/28 AV engines flagged this file. 12 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom.AIT.Ouroboros.Generic Sample 4808461bd5e1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 4808461bd5e1…. Malware family: Ransom.AIT.Ouroboros.Generic. Threat score 100/100. 16/28 AV engines flagged this file. 12 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/4808461bd5e1247d73f6ae1cd7a2883dd301c3a1abf029d7b99850403cf51e1c"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom.AIT.Ouroboros.Generic Sample 4808461bd5e1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 4808461bd5e1…. Malware family: Ransom.AIT.Ouroboros.Generic. Threat score 100/100. 16/28 AV engines flagged this file. 12 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L31","11",{}]]