26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T4a6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Ransom Sample 4d74e2fc678d… — Score 63/100 — Hybrid Analysis","description":"Malicious verdict for sample 4d74e2fc678d…. Malware family: Trojan.Ransom. Threat score 63/100. 19/28 AV engines flagged this file. 2 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4d74e2fc678d4c15494cc72e8f14c685d8d1a61457d784f41de5c600fdc4d780","keywords":["Malicious","Trojan.Ransom","malware analysis","sandbox report","threat intelligence","4d74e2fc678d4c15494cc72e8f14c685d8d1a61457d784f41de5c600fdc4d780"],"about":{"@type":"SoftwareApplication","name":"elektronicka-komunikacia-instalacia.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"4d74e2fc678d4c15494cc72e8f14c685d8d1a61457d784f41de5c600fdc4d780","additionalType":"Malicious sample"},"threatScore":63,"malwareFamily":"Trojan.Ransom","antivirusDetections":{"malicious":19,"total":28},"behavioralIndicators":{"malicious":2,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T63f,"" touched file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\clr.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\clr.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\clr.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\config\machine.config" "" touched file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ngen.log" "" touched file "%WINDIR%\Globalization\Sorting\sortdefault.nls" "" touched file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\51e2934144ba15628ba5a31be2dae7dc\mscorlib.ni.dll.aux" "" touched file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SortDefault.nlp" "" touched file "%WINDIR%\system32\rsaenh.dll" "" touched file "%WINDIR%\assembly\pubpol47.dat" "" touched file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\e40da7a49f8c3f0108e7c835b342f382\System.ni.dll.aux" "" touched file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\b9f7adbc90a2bcbe8eb9e6e8d2bb975b\System.Core.ni.dll.aux" "UserFilesLocker.exe" touched file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\clr.dll"28:T899,"C:\elektronicka-komunikacia-instalacia.exe" marked "C:\Users\PSPUBWS\Documents\desktop.ini" for deletion "C:\elektronicka-komunikacia-instalacia.exe" marked "C:\Users\PSPUBWS\Pictures\desktop.ini" for deletion "C:\elektronicka-komunikacia-instalacia.exe" marked "%PUBLIC%\Pictures\desktop.ini" for deletion "C:\elektronicka-komunikacia-instalacia.exe" marked "%PUBLIC%\Pictures\Sample Pictures\Chrysanthemum.jpg" for deletion "C:\elektronicka-komunikacia-instalacia.exe" marked "%PUBLIC%\Pictures\Sample Pictures\Jellyfish.jpg" for deletion "C:\elektronicka-komunikacia-instalacia.exe" marked "%PUBLIC%\Pictures\Sample Pictures\Desert.jpg" for deletion "C:\elektronicka-komunikacia-instalacia.exe" marked "%PUBLIC%\Pictures\Sample Pictures\Tulips.jpg" for deletion "C:\elektronicka-komunikacia-instalacia.exe" marked "%PUBLIC%\Pictures\Sample Pictures\Koala.jpg" for deletion "C:\elektronicka-komunikacia-instalacia.exe" marked "%PUBLIC%\Pictures\Sample Pictures\desktop.ini" for deletion "C:\elektronicka-komunikacia-instalacia.exe" marked "%PUBLIC%\Pictures\Sample Pictures\Lighthouse.jpg" for deletion "C:\elektronicka-komunikacia-instalacia.exe" marked "%PUBLIC%\Pictures\Sample Pictures\Hydrangeas.jpg" for deletion "C:\elektronicka-komunikacia-instalacia.exe" marked "%PUBLIC%\Pictures\Sample Pictures\Penguins.jpg" for deletion "C:\elektronicka-komunikacia-instalacia.exe" marked "C:\Users\PSPUBWS\Desktop\desktop.ini" for deletion "C:\elektronicka-komunikacia-instalacia.exe" marked "C:\Users\PSPUBWS\Music\desktop.ini" for deletion "C:\elektronicka-komunikacia-instalacia.exe" marked "%PUBLIC%\Music\desktop.ini" for deletion "C:\elektronicka-komunikacia-instalacia.exe" marked "%PUBLIC%\Music\Sample Music\desktop.ini" for deletion "C:\elektronicka-komunikacia-instalacia.exe" marked "%PUBLIC%\Music\Sample Music\Maid with the Flaxen Hair.mp3" for deletion "C:\elektronicka-komunikacia-instalacia.exe" marked "%PUBLIC%\Music\Sample Music\Kalimba.mp3" for deletion "C:\elektronicka-komunikacia-instalacia.exe" marked "%PUBLIC%\Music\Sample Music\Sleep Away.mp3" for deletion "C:\elektronicka-komunikacia-instalacia.exe" marked "%PUBLIC%\Documents\desktop.ini" for deletion29:T6db,"" opened "C:\Users\3LSNYWU\Documents\desktop.ini" with delete access "" opened "C:\Users\3LSNYWU\Pictures\desktop.ini" with delete access "" opened "%PUBLIC%\Pictures\desktop.ini" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Chrysanthemum.jpg" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Jellyfish.jpg" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Tulips.jpg" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Koala.jpg" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\desktop.ini" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Lighthouse.jpg" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Hydrangeas.jpg" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Penguins.jpg" with delete access "" opened "C:\Users\3LSNYWU\Desktop\desktop.ini" with delete access "" opened "C:\Users\3LSNYWU\Music\desktop.ini" with delete access "" opened "%PUBLIC%\Music\desktop.ini" with delete access "" opened "%PUBLIC%\Music\Sample Music\desktop.ini" with delete access "" opened "%PUBLIC%\Music\Sample Music\Maid with the Flaxen Hair.mp3" with delete access "" opened "%PUBLIC%\Music\Sample Music\Kalimba.mp3" with delete access "" opened "%PUBLIC%\Music\Sample Music\Sleep Away.mp3" with delete access "" opened "%PUBLIC%\Documents\desktop.ini" with delete access "" opened "C:\Users\3LSNYWU\Downloads\desktop.ini" with delete access2a:T46c,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAALkSURBVFhHrZe7jtNAFIbPg6TbijoPQpUmD+CCZ6BIkRaJJoWpIySQQpOCZos021l0i4S00gqEWLThttySFRKDv/H+zmRiGztJpKOZHc/O95+Zc87YZi1+4/HYHcNaoHanAL66eu0Wi8VBxjr56lj7n+Dr9dodYqyTJEk3AYLj/SHGzgHfS4D7883D9z1/Hd3BAqyfb98edlQB/X7mLMlc2NL3ZmnRhv187KgCgFviXJI630pMCY7giDqqAEDAyYa7dGps9xYwGNx3GIG3+vnRe+HPP9yBPJ/TNKs1BO4lQGC1ZMFwOKw0hMW1Qena6/W6CxD07+2y3AHgVSnI+OXlqy0BgmdZ5joLCOEUDv4WHEHYr+/v3edPF74c8+zs7OVOgQLeWUAMx2NB6IdwRTUCqgIRz2WtYwABQIAKroun6Qju2cMi/xusVRoioAqus+eZW71zq5sL9+X6vAzI09MXtXdE3yUOs5H5tRtLMQKYIBFx0Gk3BDd77kWkaVp7PQOWxQICMZtrWUFH2nEc5D9Bd/P1rYcpJoCbTfzYYDDobMQNAhB/cnKy/W6gWAjhRL3qgOBmIz/WphrGcwSnJVijN5NRPvAjtw+5vcktr/1WpFwIN3tQ7oC2s22L55pbI2AbbjbfgeMVoghC5f3s2WMX2mQycRhATHEVCq0RsPG8gD/1Z8624znw+XxeBmEM5lwx1QL6YVC3EFBs+wb+ZAc+m812BMjTqrajgBj+aMtz4NPptBTQ9VWtcQc4V6Xh7e9rh5ERjLPtgktAV/h/4wAQNSCEUwsYD+FsM2OU2eVyWVkNq8YZa8wCFo3hKkR4jSmiqRn0CUqEtO03pKCZBFQVohDudyRPO+DyKu6HopgTluOK9CvqEQvHcFVCea4XEYAsKs/r+jyXmJrqtymGLK76Dxjjn3UlC86bEMYzFSK14fejaoTOvdZzSdClE3+Ebu4C/2F5iDV/lNa9fN5dPO2/aDvO/Afan+dChKKb5QAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"4d74e2fc678d4c15494cc72e8f14c685d8d1a61457d784f41de5c600fdc4d780","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":63,"unified_at_epoch_ms":1790838684380,"unified_at":"2026-10-01T07:11:24.380Z","metadata":{"hashes":{"sha256":"4d74e2fc678d4c15494cc72e8f14c685d8d1a61457d784f41de5c600fdc4d780","sha1":"2594026305559a7d4bea675ed278e629fac3e045","md5":"5732b67134625c2decb22684ef303743","sha512":"50d5c4b5dbc8cd1479f7d754979215daf056270538613252d6c0847d445dbf73ec895170015deb026a703728561246f2661d99819d485c8bb245b47a5cd8f057","ssdeep":"1536:XhsR0Hul8+/bsznb85LV8wp7Md3iZCrYJqLjtXwDmAAa:RsaHEF/bsznQvRIl5XMmha","ssdeep_chunks":["1536:XhsR0Hu","1536:hsR0Hul","1536:sR0Hul8","1536:R0Hul8+","1536:0Hul8+/","1536:Hul8+/b","1536:ul8+/bs","1536:l8+/bsz","1536:8+/bszn","1536:+/bsznb","1536:/bsznb8","1536:bsznb85","1536:sznb85L","1536:znb85LV","1536:nb85LV8","1536:b85LV8w","1536:85LV8wp","1536:5LV8wp7","1536:LV8wp7M","1536:V8wp7Md","1536:8wp7Md3","1536:wp7Md3i","1536:p7Md3iZ","1536:7Md3iZC","1536:Md3iZCr","1536:d3iZCrY","1536:3iZCrYJ","1536:iZCrYJq","1536:ZCrYJqL","1536:CrYJqLj","1536:rYJqLjt","1536:YJqLjtX","1536:JqLjtXw","1536:qLjtXwD","1536:LjtXwDm","1536:jtXwDmA","1536:tXwDmAA","1536:XwDmAAa","3072:XhsR0Hu","3072:hsR0Hul","3072:sR0Hul8","3072:R0Hul8+","3072:0Hul8+/","3072:Hul8+/b","3072:ul8+/bs","3072:l8+/bsz","3072:8+/bszn","3072:+/bsznb","3072:/bsznb8","3072:bsznb85","3072:sznb85L","3072:znb85LV","3072:nb85LV8","3072:b85LV8w","3072:85LV8wp","3072:5LV8wp7","3072:LV8wp7M","3072:V8wp7Md","3072:8wp7Md3","3072:wp7Md3i","3072:p7Md3iZ","3072:7Md3iZC","3072:Md3iZCr","3072:d3iZCrY","3072:3iZCrYJ","3072:iZCrYJq","3072:ZCrYJqL","3072:CrYJqLj","3072:rYJqLjt","3072:YJqLjtX","3072:JqLjtXw","3072:qLjtXwD","3072:LjtXwDm","3072:jtXwDmA","3072:tXwDmAA","3072:XwDmAAa","1536:RsaHEF/","1536:saHEF/b","1536:aHEF/bs","1536:HEF/bsz","1536:EF/bszn","1536:F/bsznQ","1536:/bsznQv","1536:bsznQvR","1536:sznQvRI","1536:znQvRIl","1536:nQvRIl5","1536:QvRIl5X","1536:vRIl5XM","1536:RIl5XMm","1536:Il5XMmh","1536:l5XMmha"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"elektronicka-komunikacia-instalacia.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":73178,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499287830000,"last_seen":1676812075000,"last_multi_scan":1676812075000}},"detections":{"summary":{"verdict":"malicious","score":63,"tags":["UserFilesLocker","CzechoSlovak","Ransomware"]},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":10,"suspicious_count":14,"malicious_count":2,"total":26},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Ransom.sedax","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.BLR","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Trojan.SW.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.BLR (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"MSIL/Filecoder.OwnHead.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/Filecoder.ag","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 700000121 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Gen.cvr","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.eqlwkf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/OwnHead-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_CZCRYPT.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_CZCRYPT.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.PJO","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanRansom.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.Win32.582","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Ransom","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"\" queries volume information of \"C:\\elektronicka-komunikacia-instalacia.exe\" at 00018635-00002324-0000010C-45310276\n \"UserFilesLocker.exe\" queries volume information of \"%USERPROFILE%\\Documents\\UserFilesLocker.exe\" at 00021481-00002808-0000010C-51491218","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\IUDLAUTOMUTEX\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\__DDrawExclMode__\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\__DDrawCheckExclMode__\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\51e2934144ba15628ba5a31be2dae7dc\\mscorlib.ni.dll\" at 6A060000\n \"UserFilesLocker.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\51e2934144ba15628ba5a31be2dae7dc\\mscorlib.ni.dll\" at 6A170000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"UserFilesLocker.exe\" (UID: 00021481-00002808)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"UserFilesLocker.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"desktop.ini.ENCR\" has type \"data\"\n \"Desert.jpg.ENCR\" has type \"data\"\n \"Chrysanthemum.jpg.ENCR\" has type \"data\"\n \"UserFilesLocker.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"\n \"Maid with the Flaxen Hair.mp3.ENCR\" has type \"data\"\n \"Tulips.jpg.ENCR\" has type \"data\"\n \"Koala.jpg.ENCR\" has type \"data\"\n \"Jellyfish.jpg.ENCR\" has type \"data\"\n \"Hydrangeas.jpg.ENCR\" has type \"data\"\n \"Sleep Away.mp3.ENCR\" has type \"data\"\n \"Kalimba.mp3.ENCR\" has type \"data\"\n \"Penguins.jpg.ENCR\" has type \"data\"\n \"Lighthouse.jpg.ENCR\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$27","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"www.easycoin.cz\"\n Pattern match: \"www.simplecoin.cz\"\n Pattern match: \"www.localbitcoins.com\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"UserFilesLocker.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"elektronicka-komunikacia-instalacia.exe.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"UserFilesLocker.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00018635-00002324-00000105-45541106","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"\" is allocating memory with PAGE_GUARD access rights\n \"UserFilesLocker.exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text with unusual entropies 7.47186222662","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"UserFilesLocker.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"UserFilesLocker.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"C:\\Users\\PSPUBWS\\Documents\\desktop.ini\"\n \"\" read file \"C:\\Users\\PSPUBWS\\Pictures\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\Pictures\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\Pictures\\Sample Pictures\\desktop.ini\"\n \"\" read file \"C:\\Users\\PSPUBWS\\Desktop\\desktop.ini\"\n \"\" read file \"C:\\Users\\PSPUBWS\\Music\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\Music\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\Music\\Sample Music\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\Documents\\desktop.ini\"\n \"\" read file \"C:\\Users\\PSPUBWS\\Downloads\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"UserFilesLocker.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"UserFilesLocker.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"IUDL\"; Value: \"%USERPROFILE%\\Documents\\UserFilesLocker.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$28","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$29","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"a13283bd\" to virtual address \"0x6B022AFC\" (part of module \"CLR.DLL\")\n \"\" wrote bytes \"db4d266f00000000\" to virtual address \"0x00BD2000\" (part of module \"ELEKTRONICKA-KOMUNIKACIA-INSTALACIA.EXE\")\n \"\" wrote bytes \"40537f7758588077186a8077653c81770000000000bfde750000000056ccde75000000007ccade75000000003768bb756a2c8177d62d8177000000002069bb750000000029a6de7500000000a48dbb7500000000f70ede7500000000\" to virtual address \"0x77961000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"UserFilesLocker.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":5,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"9/58 Antivirus vendors marked sample as malicious (15% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":7,"imported_dlls_count":79,"dropped_files_count":0,"extracted_files_count":13,"files_written_count":107,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["UserFilesLocker","CzechoSlovak","Ransomware"],"sample_flags":["Multi-Process","Extracted Files","User Comment"],"sandbox_reports":[{"id":"58b5a3bbaac2ed015bf3f553","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":63,"malware_family":"Trojan.SW.gen","submit_name":"elektronicka-komunikacia-instalacia.exe","analysis_start_time":"2017-02-28T17:22:36+00:00","indicators_count":{"informative":10,"suspicious":15,"malicious":2},"tags":["Multi-Process","Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}],"processes":[{"pid":2324,"ppid":0,"name":"elektronicka-komunikacia-instalacia.exe","command_line":"","normalized_path":"C:\\elektronicka-komunikacia-instalacia.exe","uid":"00018635-00002324","icon":"$2a"},{"pid":2808,"ppid":2324,"name":"UserFilesLocker.exe","command_line":"","normalized_path":"%USERPROFILE%\\Documents\\UserFilesLocker.exe","parent_uid":"00018635-00002324","uid":"00021481-00002808"}],"all_imported_dlls":["shell32.dll","IPHLPAPI.DLL","dhcpcsvc.dll","wpfgfx_v0400.dll","version.dll","rsaenh.dll","cryptbase.dll","cryptsp.dll","System.Xaml.ni.dll","dwmapi.dll","winsta.dll","shlwapi.dll","apphelp.dll","ole32.dll","clrjit.dll","nsi.dll","comctl32.dll","cfgmgr32.dll","clr.dll","profapi.dll","ws2_32.dll","urlmon.dll","PresentationCore.ni.dll","ntdll.dll","msvcrt.dll","imm32.dll","mscorlib.ni.dll","winnsi.dll","dnsapi.dll","propsys.dll","PresentationNative_v0400.dll","mscorrc.dll","d3d9.dll","UIAutomationCore.dll","oleacc.dll","KernelBase.dll","lpk.dll","msvcr110_clr0400.dll","setupapi.dll","sechost.dll","gdi32.dll","user32.dll","uxtheme.dll","clbcatq.dll","ntmarta.dll","DWrite.dll","crypt32.dll","mscoreei.dll","System.Core.ni.dll","bcrypt.dll","Wldap32.dll","wtsapi32.dll","RpcRtRemote.dll","kernel32.dll","usp10.dll","System.ni.dll","wininet.dll","msasn1.dll","oleaccrc.dll","msctfui.dll","mscoree.dll","advapi32.dll","d3d8thk.dll","rpcrt4.dll","dhcpcsvc6.dll","WindowsCodecs.dll","UIAutomationTypes.ni.dll","msctf.dll","WindowsBase.ni.dll","PresentationFramework.ni.dll","powrprof.dll","nlssorting.dll","iertutil.dll","psapi.dll","tzres.dll","oleaut32.dll","devobj.dll","PresentationFramework.Aero.ni.dll","sspicli.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"UserFilesLocker.exe","sha256":"a1fd4d49828c3cb670b670b9cfe58a367f1ec9b71546a6f22c0f00c038cee91e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"name":"Kalimba.mp3.ENCR","sha256":"3068addd9a121442e6504337e40a8b9eab3a09e226174f36736005c15385e766","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"name":"Maid with the Flaxen Hair.mp3.ENCR","sha256":"c9e57570b119ad52b455dfa84156740d261ed3c7f5cbaaf232094746d6aebd94","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"name":"Sleep Away.mp3.ENCR","sha256":"dffcd03f9c0d6038791a6199677e6648402938631283fada3a4109cfae473e6c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"name":"Chrysanthemum.jpg.ENCR","sha256":"fd178df6e8b8b3e2c8c8a7780f235d09b2fb220e3cc52ed1d9fbf7aae71f5641","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"name":"Desert.jpg.ENCR","sha256":"dd98fb15995d0908c7b8b133187a24af04c164b83769f9063d03d5931614b564","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"name":"Hydrangeas.jpg.ENCR","sha256":"f2eb7d03c587bf18bc9a8f061bb625a245b5b405fecc8e83efe3b974d37a29aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"name":"Jellyfish.jpg.ENCR","sha256":"8e7762a51ca2bad6289290e715bda3016f2c1eb118e0ed0c675932000ac5faff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"name":"Koala.jpg.ENCR","sha256":"88c6e35fa3eb78c91ecf40ff19978fa85c2467a5648a1148edbfa551e2ed7720","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"name":"Lighthouse.jpg.ENCR","sha256":"91f4f12d72208266464667d55c5023e5d020eeb126d381193f3512b67eb43d73","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"name":"Penguins.jpg.ENCR","sha256":"577d329f2b83ab6637ca47780ff17ad2f9c3f0196763771f35792ffb8765b942","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"name":"Tulips.jpg.ENCR","sha256":"8f3c2cc9715709273759fa9e63829e35d19abaff732c6e6026962c7ab7194d00","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"name":"desktop.ini.ENCR","sha256":"b151beaa0b83ec26fc06c14fc7ed290504bed0943e5570b4a1f9f0741e19784d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]}],"files_written":[{"path":"C:\\elektronicka-komunikacia-instalacia.exe.config","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"C:\\elektronicka-komunikacia-instalacia.exe","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%USERPROFILE%\\Desktop\\UserFilesLocker.exe","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%USERPROFILE%\\Documents\\__encrypt.pinfo","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%USERPROFILE%\\Documents\\desktop.ini.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%USERPROFILE%\\Pictures\\desktop.ini.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%PUBLIC%\\Pictures\\desktop.ini.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Chrysanthemum.jpg.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Jellyfish.jpg.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Desert.jpg.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Tulips.jpg.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Koala.jpg.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\desktop.ini.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Hydrangeas.jpg.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Lighthouse.jpg.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Penguins.jpg.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%USERPROFILE%\\Music\\desktop.ini.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%PUBLIC%\\Music\\desktop.ini.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\desktop.ini.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\Kalimba.mp3.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\Sleep Away.mp3.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%PUBLIC%\\Documents\\desktop.ini.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%USERPROFILE%\\Downloads\\desktop.ini.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\AUTORUN.INF","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\AUTORUN.INF.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\VBoxWindowsAdditions-x86.exe","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\VBoxWindowsAdditions-x86.exe.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\VBoxWindowsAdditions.exe","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\VBoxWindowsAdditions.exe.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\VBoxLinuxAdditions.run","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\VBoxLinuxAdditions.run.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\VBoxSolarisAdditions.pkg","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\VBoxSolarisAdditions.pkg.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\autorun.sh","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\autorun.sh.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\VBoxWindowsAdditions-amd64.exe","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\VBoxWindowsAdditions-amd64.exe.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\runasroot.sh","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\runasroot.sh.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\cert\\VBoxCertUtil.exe","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\cert\\VBoxCertUtil.exe.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\cert\\oracle-vbox.cer","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\cert\\oracle-vbox.cer.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\OS2\\libc061.dll","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\OS2\\libc061.dll.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\OS2\\libc062.dll","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\OS2\\libc062.dll.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\OS2\\VBoxReplaceDll.exe","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\OS2\\VBoxReplaceDll.exe.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\OS2\\libc063.dll","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\OS2\\libc063.dll.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\OS2\\gengradd.dll","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\OS2\\gengradd.dll.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\OS2\\libc06.dll","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\OS2\\libc06.dll.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\OS2\\libc064.dll","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\OS2\\libc064.dll.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\OS2\\libc065.dll","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\OS2\\libc065.dll.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\OS2\\readme.txt","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\OS2\\readme.txt.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\64Bit\\Readme.txt","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\64Bit\\Readme.txt.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\32Bit\\Readme.txt","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"D:\\32Bit\\Readme.txt.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%USERPROFILE%\\Documents\\UserFilesLocker.exe.config","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.log","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\51e2934144ba15628ba5a31be2dae7dc\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\Presentatio5ae0f00f#\\97e6b67983d07a066b68b3ae8be2f53d\\PresentationFramework.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\WindowsBase\\cd235caf797fb017f140016be88f33b7\\WindowsBase.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\e40da7a49f8c3f0108e7c835b342f382\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\PresentationCore\\b52bc540630c3aa5de542c382af35c20\\PresentationCore.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Xaml\\cc4d9093563dadee370788bbc3ecf4fb\\System.Xaml.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\SortDefault.nlp","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%USERPROFILE%\\Documents\\UserFilesLocker.exe","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\Presentatio1c9175f8#\\e7d92730b571b31e62c2cf257f04a974\\PresentationFramework.Aero.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\b9f7adbc90a2bcbe8eb9e6e8d2bb975b\\System.Core.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%USERPROFILE%\\Desktop\\__encrypt.pinfo","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUI.TTF","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\UIAutomationTypes\\fedb1433422296012c8ce48902458bf1\\UIAutomationTypes.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%WINDIR%\\system32\\OLEACCRC.DLL","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%WINDIR%\\system32\\en-US\\msctfui.dll.mui","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"path":"%WINDIR%\\system32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\DIRECT3D\\MOSTRECENTAPPLICATION\\","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\IUDLAUTOMUTEX","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\__DDrawExclMode__","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\__DDrawCheckExclMode__","sources":[{"report_type":"sandbox","report_id":"58b5a3bbaac2ed015bf3f553"}]}]}},"report_ids":{"sandbox_job_ids":["58b5a3bbaac2ed015bf3f553"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Ransom Sample 4d74e2fc678d… — Score 63/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 4d74e2fc678d…. Malware family: Trojan.Ransom. Threat score 63/100. 19/28 AV engines flagged this file. 2 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/4d74e2fc678d4c15494cc72e8f14c685d8d1a61457d784f41de5c600fdc4d780"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Ransom Sample 4d74e2fc678d… — Score 63/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 4d74e2fc678d…. Malware family: Trojan.Ransom. Threat score 63/100. 19/28 AV engines flagged this file. 2 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/4d74e2fc678d4c15494cc72e8f14c685d8d1a61457d784f41de5c600fdc4d780"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Ransom Sample 4d74e2fc678d… — Score 63/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 4d74e2fc678d…. Malware family: Trojan.Ransom. Threat score 63/100. 19/28 AV engines flagged this file. 2 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]