24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2f:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4be,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.AutoIT.Ransom Sample 4deff7d84345… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 4deff7d84345…. Malware family: Trojan.AutoIT.Ransom. Threat score 100/100. 14/27 AV engines flagged this file. 12 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4deff7d8434583ea8e5c3ef9b4c64674dfb165b1720ddf63b5abdd8ed6a7399c","keywords":["Malicious","Trojan.AutoIT.Ransom","malware analysis","sandbox report","threat intelligence","4deff7d8434583ea8e5c3ef9b4c64674dfb165b1720ddf63b5abdd8ed6a7399c"],"about":{"@type":"SoftwareApplication","name":"4deff7d8434583ea8e5c3ef9b4c64674","applicationCategory":["peexe","64bits","executable"],"identifier":"4deff7d8434583ea8e5c3ef9b4c64674dfb165b1720ddf63b5abdd8ed6a7399c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.AutoIT.Ransom","antivirusDetections":{"malicious":14,"total":27},"behavioralIndicators":{"malicious":12,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tf9a,Found API call GetLocalTime@KERNEL32.dll (Target: "sous.exe.bin"; Stream UID: "41363-1037-000000014007587C") which is directly followed by "cmp dword ptr [rbx], edi" and "je 0000000140075A28h". See related instructions: "...+0 mov rax, rsp+1 mov eax, esp+3 mov qword ptr [rax+08h], rbx+4 mov dword ptr [rax+08h], ebx+7 mov qword ptr [rax+10h], rsi+8 mov dword ptr [rax+10h], esi+11 mov qword ptr [rax+18h], rdi+12 mov dword ptr [rax+18h], edi+15 mov qword ptr [rax+20h], r12+16 mov dword ptr [rax+20h], esp+19 push rbp+20 push r14+21 push rsi+22 push r15+23 push rdi+24 mov rbp, rsp+25 mov ebp, esp+27 sub rsp, 30h+28 sub esp, 30h+31 mov rbx, rcx+32 mov ebx, ecx+34 mov rcx, rdx+35 mov ecx, edx+37 movsxd rsi, r9+38 movsxd esi, ecx+40 mov r14L, r8L+41 mov dh, al+43 mov rdi, rdx+44 mov edi, edx+46 call qword ptr [00000001400AA4A0h] ;GetLocalTime+52 xor r15d, r15d+53 xor edi, edi+55 cmp word ptr [rbx], r15w+57 cmp dword ptr [rbx], edi+59 je 0000000140075A28h" ... at 41363-1037-000000014007587C Found API call GetLocalTime@KERNEL32.DLL (Target: "sous.exe"; Stream UID: "00014493-00003532-51186-1155-3F3E587C") which is directly followed by "cmp dword ptr [rbx], edi" and "je 3F3E5A28h". See related instructions: "...+0 mov rax, rsp+1 mov eax, esp+3 mov qword ptr [rax+08h], rbx+4 mov dword ptr [rax+08h], ebx+7 mov qword ptr [rax+10h], rsi+8 mov dword ptr [rax+10h], esi+11 mov qword ptr [rax+18h], rdi+12 mov dword ptr [rax+18h], edi+15 mov qword ptr [rax+20h], r12+16 mov dword ptr [rax+20h], esp+19 push rbp+20 push r14+21 push rsi+22 push r15+23 push rdi+24 mov rbp, rsp+25 mov ebp, esp+27 sub rsp, 30h+28 sub esp, 30h+31 mov rbx, rcx+32 mov ebx, ecx+34 mov rcx, rdx+35 mov ecx, edx+37 movsxd rsi, r9+38 movsxd esi, ecx+40 mov r14L, r8L+41 mov dh, al+43 mov rdi, rdx+44 mov edi, edx+46 call qword ptr [000000003F41A4A0h] ;GetLocalTime+52 xor r15d, r15d+53 xor edi, edi+55 cmp word ptr [rbx], r15w+57 cmp dword ptr [rbx], edi+59 je 3F3E5A28h" ... at 00014493-00003532-51186-1155-3F3E587C Found API call GetLocalTime@KERNEL32.DLL (Target: "sous.exe"; Stream UID: "00016034-00001272-48143-1155-3F3E587C") which is directly followed by "cmp dword ptr [rbx], edi" and "je 3F3E5A28h". See related instructions: "...+0 mov rax, rsp+1 mov eax, esp+3 mov qword ptr [rax+08h], rbx+4 mov dword ptr [rax+08h], ebx+7 mov qword ptr [rax+10h], rsi+8 mov dword ptr [rax+10h], esi+11 mov qword ptr [rax+18h], rdi+12 mov dword ptr [rax+18h], edi+15 mov qword ptr [rax+20h], r12+16 mov dword ptr [rax+20h], esp+19 push rbp+20 push r14+21 push rsi+22 push r15+23 push rdi+24 mov rbp, rsp+25 mov ebp, esp+27 sub rsp, 30h+28 sub esp, 30h+31 mov rbx, rcx+32 mov ebx, ecx+34 mov rcx, rdx+35 mov ecx, edx+37 movsxd rsi, r9+38 movsxd esi, ecx+40 mov r14L, r8L+41 mov dh, al+43 mov rdi, rdx+44 mov edi, edx+46 call qword ptr [000000003F41A4A0h] ;GetLocalTime+52 xor r15d, r15d+53 xor edi, edi+55 cmp word ptr [rbx], r15w+57 cmp dword ptr [rbx], edi+59 je 3F3E5A28h" ... at 00016034-00001272-48143-1155-3F3E587C Found API call GetLocalTime@KERNEL32.DLL (Target: "sous.exe"; Stream UID: "00027227-00003904-42911-1155-3F3E587C") which is directly followed by "cmp dword ptr [rbx], edi" and "je 3F3E5A28h". See related instructions: "...+0 mov rax, rsp+1 mov eax, esp+3 mov qword ptr [rax+08h], rbx+4 mov dword ptr [rax+08h], ebx+7 mov qword ptr [rax+10h], rsi+8 mov dword ptr [rax+10h], esi+11 mov qword ptr [rax+18h], rdi+12 mov dword ptr [rax+18h], edi+15 mov qword ptr [rax+20h], r12+16 mov dword ptr [rax+20h], esp+19 push rbp+20 push r14+21 push rsi+22 push r15+23 push rdi+24 mov rbp, rsp+25 mov ebp, esp+27 sub rsp, 30h+28 sub esp, 30h+31 mov rbx, rcx+32 mov ebx, ecx+34 mov rcx, rdx+35 mov ecx, edx+37 movsxd rsi, r9+38 movsxd esi, ecx+40 mov r14L, r8L+41 mov dh, al+43 mov rdi, rdx+44 mov edi, edx+46 call qword ptr [000000003F41A4A0h] ;GetLocalTime+52 xor r15d, r15d+53 xor edi, edi+55 cmp word ptr [rbx], r15w+57 cmp dword ptr [rbx], edi+59 je 3F3E5A28h" ... at 00027227-00003904-42911-1155-3F3E587C26:T506,GetProcessHeap@KERNEL32.dll at 41363-2602-00000001400656EC GetProcessHeap@KERNEL32.dll at 41363-2598-0000000140065591 GetProcessHeap@KERNEL32.dll at 41363-2605-0000000140065714 GetProcessHeap@KERNEL32.dll at 41363-2599-0000000140065639 GetProcessHeap@KERNEL32.dll at 41363-2613-0000000140066178 GetProcessHeap@KERNEL32.dll at 41363-2606-0000000140066258 GetProcessHeap@KERNEL32.dll at 41363-2633-0000000140065EC8 GetProcessHeap@KERNEL32.dll at 41363-1455-000000014003FDD4 GetProcessHeap@KERNEL32.dll at 41363-2608-00000001400656C4 GetProcessHeap@KERNEL32.dll at 41363-1788-00000001400304D8 GetProcessHeap@KERNEL32.dll at 41363-2609-000000014006588C GetProcessHeap@KERNEL32.DLL at 00014493-00003532-51186-538-3F3AFDD4 GetProcessHeap@KERNEL32.DLL at 00014493-00003532-51186-650-3F3A04D8 GetProcessHeap@KERNEL32.DLL at 00014493-00003532-51186-2509-3F3D5714 GetProcessHeap@KERNEL32.DLL at 00014493-00003532-51186-2537-3F3D5EC8 GetProcessHeap@KERNEL32.DLL at 00014493-00003532-51186-2512-3F3D56C4 GetProcessHeap@KERNEL32.DLL at 00014493-00003532-51186-2502-3F3D5591 GetProcessHeap@KERNEL32.DLL at 00014493-00003532-51186-2506-3F3D56EC GetProcessHeap@KERNEL32.DLL at 00014493-00003532-51186-2513-3F3D588C GetProcessHeap@KERNEL32.DLL at 00014493-00003532-51186-2517-3F3D617827:T5dc,Spawned process "cmd.exe" with commandline "/c schtasks /create /sc onlogon /tn 1544090992 /rl highest /tr %PROGRAMFILES%\COMMON~1\sous.exe" (UID: 00014680-00002168) Spawned process "schtasks.exe" with commandline "schtasks /create /sc onlogon /tn 1544090992 /rl highest /tr %PROGRAMFILES%\COMMON~1\sous.exe" (UID: 00014687-00002408) Spawned process "cmd.exe" with commandline "/C title 6636748|vssadmin.exe Delete Shadows /All /Quiet" (UID: 00014748-00003824) Spawned process "cmd.exe" with commandline "/C title 1723291|bcdedit /set {default} recoveryenabled No" (UID: 00014750-00002328) Spawned process "cmd.exe" with commandline "/C title 8076079|bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00014751-00002296) Spawned process "cmd.exe" with commandline "/S /D /c" title 6636748"" (UID: 00014758-00002256) Spawned process "vssadmin.exe" with commandline "Delete Shadows /All /Quiet" (UID: 00014759-00002460) Spawned process "cmd.exe" with commandline "/S /D /c" title 1723291"" (UID: 00014761-00002176) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} recoveryenabled No" (UID: 00014763-00002208) Spawned process "cmd.exe" with commandline "/S /D /c" title 8076079"" (UID: 00014768-00002140) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00014769-00002196) Spawned process "" (UID: 00016034-00001272) Spawned process "" (UID: 00027227-00003904)28:T51b,GetAsyncKeyState@USER32.dll at 41363-2791-000000014006F48E GetAsyncKeyState@USER32.dll at 41363-926-00000001400041A8 GetAsyncKeyState@USER32.dll at 41363-2788-000000014006F142 GetKeyboardState@USER32.dll at 41363-2792-00000001400701D4 GetKeyboardState@USER32.dll at 41363-2803-0000000140070590 GetKeyboardState@USER32.dll at 41363-2810-000000014006F0A8 GetKeyboardState@USER32.dll at 41363-2805-0000000140070064 GetKeyboardState@USER32.dll at 41363-2806-000000014006F394 GetKeyboardState@USER32.dll at 41363-2801-0000000140070368 GetAsyncKeyState@USER32.DLL at 00014493-00003532-51186-1047-3F3741A8 GetAsyncKeyState@USER32.DLL at 00016034-00001272-48143-1047-3F3741A8 GetKeyboardState@USER32.DLL at 00016034-00001272-38254-2714-3F3DF0A8 GetKeyboardState@USER32.DLL at 00016034-00001272-38254-2709-3F3E0064 GetKeyboardState@USER32.DLL at 00016034-00001272-38254-2696-3F3E01D4 GetKeyboardState@USER32.DLL at 00016034-00001272-38254-2705-3F3E0368 GetKeyboardState@USER32.DLL at 00016034-00001272-38254-2707-3F3E0590 GetKeyboardState@USER32.DLL at 00016034-00001272-38254-2710-3F3DF394 GetAsyncKeyState@USER32.DLL at 00016034-00001272-38254-2695-3F3DF48E GetAsyncKeyState@USER32.DLL at 00016034-00001272-38254-2692-3F3DF142 GetAsyncKeyState@USER32.DLL at 00027227-00003904-42911-1047-3F3741A829:T53e,RegCreateKeyExW RegCloseKey CreateProcessWithLogonW RegDeleteKeyW SetSecurityDescriptorDacl OpenProcessToken RegOpenKeyExW GetUserNameW RegEnumKeyExW CreateProcessAsUserW RegDeleteValueW IcmpSendEcho GetDriveTypeW GetFileAttributesW UnhandledExceptionFilter FindResourceExW DeviceIoControl CopyFileW WriteProcessMemory OutputDebugStringW GetModuleFileNameW IsDebuggerPresent LoadLibraryExW CreateThread ExitThread TerminateProcess GetModuleHandleExW CreateToolhelp32Snapshot LoadLibraryW GetVersionExW LoadLibraryA GetFileSize OpenProcess GetStartupInfoW ReadProcessMemory CreateDirectoryW DeleteFileW GetProcAddress GetTempFileNameW GetComputerNameW WriteFile FindNextFileW FindFirstFileW CreateFileW VirtualAllocEx FindResourceW Process32NextW LockResource GetCommandLineW CopyFileExW Process32FirstW GetModuleHandleW GetTempPathW CreateProcessW Sleep VirtualAlloc ShellExecuteW ShellExecuteExW SetKeyboardState FindWindowExW FindWindowW GetWindowThreadProcessId FtpGetFileSize InternetOpenW InternetQueryDataAvailable InternetQueryOptionW InternetConnectW HttpQueryInfoW InternetCrackUrlW InternetCloseHandle HttpSendRequestW InternetOpenUrlW InternetReadFile FtpOpenFileW accept WSAStartup connect closesocket send listen recv socket bind recvfrom sendto2a:T438,"cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 84) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 84) "cmd.exe" wrote 8 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 84) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\vssadmin.exe" (Handle: 88) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\vssadmin.exe" (Handle: 88) "cmd.exe" wrote 8 bytes to a remote process "C:\Windows\System32\vssadmin.exe" (Handle: 88) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\bcdedit.exe" (Handle: 88) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\bcdedit.exe" (Handle: 88) "cmd.exe" wrote 8 bytes to a remote process "C:\Windows\System32\bcdedit.exe" (Handle: 88) "" wrote 32 bytes to a remote process "C:\sous.exe" (Handle: 380) "" wrote 52 bytes to a remote process "C:\sous.exe" (Handle: 380) "" wrote 8 bytes to a remote process "C:\sous.exe" (Handle: 380)2b:T6dd,Found malicious artifacts related to "104.16.54.3": ... URL: http://blockchain.info/r?url=http://www.rolexwatch.cc/ (AV positives: 1/67 scanned on 03/31/2018 13:28:15) URL: https://blockchain.info/wallet/ (AV positives: 1/67 scanned on 03/06/2018 17:14:51) URL: https://blockchain.info/ (AV positives: 1/66 scanned on 01/13/2018 12:15:15) URL: https://blockchain.info/address/147SBxHfuN2KJaLMNGo852gJCm5gCdNvq6 (AV positives: 1/64 scanned on 10/04/2017 12:34:41) URL: http://blockchain.info/Confirm/Wallet_ (AV positives: 1/65 scanned on 09/06/2017 13:06:46) File SHA256: 6e4c477262866e3b90e87a3eaf2c2baafdab87e5175e09c10a4631f431060b5f (AV positives: 1/71 scanned on 04/11/2018 04:44:56) File SHA256: fc19dcb430402e676c75c49549da4c893620a174596a37dedf4e733576ea7527 (AV positives: 39/68 scanned on 03/09/2018 18:46:17) File SHA256: 6097b3e81fadbc8e545c64ecdcc0f6d4af82668a13eda739c29e83bf7ff32866 (AV positives: 37/68 scanned on 12/26/2017 13:32:05) File SHA256: 23d67f3b9c86dcd641c7a4ca374b1957b4e82d07cee2b94ce4e5f7426c7294ca (AV positives: 42/68 scanned on 12/11/2017 04:24:57) File SHA256: 8d7140918e5eda0d3bd0f6c77b53ffa9895f28c882116e27496b2a408057df79 (AV positives: 22/67 scanned on 12/05/2017 06:21:46) File SHA256: 324966363fdcb8ace8ed361df7b22640f881a4b4fb5de0860e35f1d1179c9921 (Date: 11/15/2017 08:48:24) File SHA256: fa17f09af1696bdda7a2d6843d51f5f32702bbd4b987867fd882e5c5fa4e7f43 (Date: 11/07/2017 06:48:23) File SHA256: 6111633ad24ca5f67db06f14a5d5351ce5ed65d204f08cd4805f449585d7d149 (Date: 08/23/2017 23:14:49) File SHA256: a8954c4d65c4edfe16d3e0122f4781e09d842a5d3b7aba7dead294f190dac86b (Date: 05/28/2017 05:25:01) File SHA256: d82ef83bd327c5a16e6cde0c5a02445e0f6c4a8dafa1ac792f8604af7a506226 (Date: 04/21/2017 14:27:45)2c:T520,NtdllDialogWndProc_W@NTDLL.DLL at 00014493-00003532-51186-1075-3F3730FC NtdllDialogWndProc_W@NTDLL.DLL at 00014493-00003532-51186-1038-3F371F66 NtdllDefWindowProc_W@NTDLL.DLL at 00014493-00003532-51186-1455-3F38A4F3 NtdllDialogWndProc_W@NTDLL.DLL at 00016034-00001272-48143-1038-3F371F66 NtdllDialogWndProc_W@NTDLL.DLL at 00016034-00001272-48143-1075-3F3730FC NtdllDefWindowProc_W@NTDLL.DLL at 00016034-00001272-48143-1455-3F38A4F3 NtdllDialogWndProc_W@NTDLL.DLL at 00016034-00001272-38254-3623-3F41687F NtdllDialogWndProc_W@NTDLL.DLL at 00016034-00001272-38254-3639-3F4175F0 NtdllDialogWndProc_W@NTDLL.DLL at 00016034-00001272-38254-3637-3F4174EB NtdllDialogWndProc_W@NTDLL.DLL at 00016034-00001272-38254-3617-3F415DCA NtdllDialogWndProc_W@NTDLL.DLL at 00016034-00001272-38254-3608-3F4159A5 NtdllDialogWndProc_W@NTDLL.DLL at 00016034-00001272-38254-3624-3F41689C NtdllDialogWndProc_W@NTDLL.DLL at 00016034-00001272-38254-3619-3F4161C1 NtdllDialogWndProc_W@NTDLL.DLL at 00016034-00001272-38254-3640-3F417978 NtdllDialogWndProc_W@NTDLL.DLL at 00016034-00001272-38254-3627-3F416AC0 NtdllDialogWndProc_W@NTDLL.DLL at 00027227-00003904-42911-1075-3F3730FC NtdllDialogWndProc_W@NTDLL.DLL at 00027227-00003904-42911-1038-3F371F66 NtdllDefWindowProc_W@NTDLL.DLL at 00027227-00003904-42911-1455-3F38A4F32d:T617,Spawned process "" (UID: 00014493-00003532) Spawned process "cmd.exe" with commandline "/c schtasks /create /sc onlogon /tn 1544090992 /rl highest /tr %PROGRAMFILES%\COMMON~1\sous.exe" (UID: 00014680-00002168) Spawned process "schtasks.exe" with commandline "schtasks /create /sc onlogon /tn 1544090992 /rl highest /tr %PROGRAMFILES%\COMMON~1\sous.exe" (UID: 00014687-00002408) Spawned process "cmd.exe" with commandline "/C title 6636748|vssadmin.exe Delete Shadows /All /Quiet" (UID: 00014748-00003824) Spawned process "cmd.exe" with commandline "/C title 1723291|bcdedit /set {default} recoveryenabled No" (UID: 00014750-00002328) Spawned process "cmd.exe" with commandline "/C title 8076079|bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00014751-00002296) Spawned process "cmd.exe" with commandline "/S /D /c" title 6636748"" (UID: 00014758-00002256) Spawned process "vssadmin.exe" with commandline "Delete Shadows /All /Quiet" (UID: 00014759-00002460) Spawned process "cmd.exe" with commandline "/S /D /c" title 1723291"" (UID: 00014761-00002176) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} recoveryenabled No" (UID: 00014763-00002208) Spawned process "cmd.exe" with commandline "/S /D /c" title 8076079"" (UID: 00014768-00002140) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00014769-00002196) Spawned process "" (UID: 00016034-00001272) Spawned process "" (UID: 00027227-00003904)2e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwB///////////////////cAf//////////////////3AH//////////////////9wB/+IiIiIiIj/iIiI////cAf/h3d3d3d4/////////3AH/4d3d3d3eP+IiIj///9wB/+Hd3d3d3j/////////cAf/h3d3d3d4/////////3AH/4d3d3d3eP+IiIj///9wB/+Hd3d3d3j/////////cAf/h3d3d3d4/4iIiP93/3AH/4d3d3d3eP//////d/9wB/+Hd3d3d3j/iIiI/3f/cAf/iHd3d3d4//////93/3AH/4d3d3d3eP+IiIj/d/9wB/+Hd3d3d3j//////2f/cAf/h3d3d3d4/4iIiP9m/3AH/4d3d3d3eP//////Zv9wB/+IiIiIiIj/iIiI/2b/cAf//////////////////3AH//////////////////9wB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"4deff7d8434583ea8e5c3ef9b4c64674dfb165b1720ddf63b5abdd8ed6a7399c","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791656182908,"unified_at":"2026-10-10T18:16:22.908Z","metadata":{"hashes":{"sha256":"4deff7d8434583ea8e5c3ef9b4c64674dfb165b1720ddf63b5abdd8ed6a7399c","sha1":"3b97bac22a04282ebbaef60beb168a41e4449239","md5":"f6d01e72a58a8bdf14f9a103250f779e","sha512":"56b5c50081502bf04964dc07da654b161efcc7fef9ae056f6263606a677a9e9ba0c917d8838a57a409f5191555af5b0014dfc0da6e0c9d36e91212e9e30dd203","ssdeep":"24576:HRaZROMOm8FN7TjsPnzt2heeRhQbJEOeamqd:xkxOm+7TjsPnztyDMma1","ssdeep_chunks":["24576:HRaZROM","24576:RaZROMO","24576:aZROMOm","24576:ZROMOm8","24576:ROMOm8F","24576:OMOm8FN","24576:MOm8FN7","24576:Om8FN7T","24576:m8FN7Tj","24576:8FN7Tjs","24576:FN7TjsP","24576:N7TjsPn","24576:7TjsPnz","24576:TjsPnzt","24576:jsPnzt2","24576:sPnzt2h","24576:Pnzt2he","24576:nzt2hee","24576:zt2heeR","24576:t2heeRh","24576:2heeRhQ","24576:heeRhQb","24576:eeRhQbJ","24576:eRhQbJE","24576:RhQbJEO","24576:hQbJEOe","24576:QbJEOea","24576:bJEOeam","24576:JEOeamq","24576:EOeamqd","49152:HRaZROM","49152:RaZROMO","49152:aZROMOm","49152:ZROMOm8","49152:ROMOm8F","49152:OMOm8FN","49152:MOm8FN7","49152:Om8FN7T","49152:m8FN7Tj","49152:8FN7Tjs","49152:FN7TjsP","49152:N7TjsPn","49152:7TjsPnz","49152:TjsPnzt","49152:jsPnzt2","49152:sPnzt2h","49152:Pnzt2he","49152:nzt2hee","49152:zt2heeR","49152:t2heeRh","49152:2heeRhQ","49152:heeRhQb","49152:eeRhQbJ","49152:eRhQbJE","49152:RhQbJEO","49152:hQbJEOe","49152:QbJEOea","49152:bJEOeam","49152:JEOeamq","49152:EOeamqd","24576:xkxOm+7","24576:kxOm+7T","24576:xOm+7Tj","24576:Om+7Tjs","24576:m+7TjsP","24576:+7TjsPn","24576:jsPnzty","24576:sPnztyD","24576:PnztyDM","24576:nztyDMm","24576:ztyDMma","24576:tyDMma1"],"imphash":"a6b79195015e1e45d816e61ee943224b"},"file_info":{"file_name":"4deff7d8434583ea8e5c3ef9b4c64674","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":1020928,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1523565075000,"last_seen":1621956112000,"last_multi_scan":1621956112000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ransomware"]},"stats":{"av":{"malicious_count":14,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":23,"suspicious_count":23,"malicious_count":12,"total":58},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"Ahnlab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Occamy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1100014","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"BitDefender","success":true,"verdict":"malicious","threat_name":"Trojan.AutoIT.Ransom.F","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_60% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.AutoIT.Ransom.F (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"Ikarus","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004f65341 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Crypmod.zew","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.Crypmod.faddkc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/CrWire-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Ransom.Cryptolocker","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"TrendMicro","success":true,"verdict":"malicious","threat_name":"Mal_Cryptoit-1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"TrendMicro House Call","success":true,"verdict":"malicious","threat_name":"Mal_Cryptoit-1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanRansom.Crypmod","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xviruspersonalguard":{"name":"Xvirus Personal Guard","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.AutoIT.Ransom","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 41363-412-0000000140031F94\n SetUnhandledExceptionFilter@KERNEL32.dll at 41363-4577-0000000140031F64\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00014493-00003532-51186-15-3F3A1F94\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00016034-00001272-48143-15-3F3A1F94\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00027227-00003904-48061-15-3F3A1F94","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.dll at 41363-1037-000000014007587C\n GetSystemTimeAsFileTime@KERNEL32.dll at 41363-1477-000000014002ABD4\n GetLocalTime@KERNEL32.dll at 41363-3102-000000014007FC08\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00014493-00003532-51186-555-3F39ABD4\n GetLocalTime@KERNEL32.DLL at 00014493-00003532-51186-1155-3F3E587C\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00016034-00001272-48143-555-3F39ABD4\n GetLocalTime@KERNEL32.DLL at 00016034-00001272-48143-1155-3F3E587C\n GetLocalTime@KERNEL32.DLL at 00016034-00001272-38254-3006-3F3EFC08\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00016034-00001272-38254-4360-3F3AAF1A\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00027227-00003904-42911-555-3F39ABD4\n GetLocalTime@KERNEL32.DLL at 00027227-00003904-42911-1155-3F3E587C","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.dll at 41363-1947-0000000140039D93\n GetTimeZoneInformation@KERNEL32.DLL at 00014493-00003532-51186-1854-3F3A9D93\n GetTimeZoneInformation@KERNEL32.DLL at 00016034-00001272-48143-1854-3F3A9D93\n GetTimeZoneInformation@KERNEL32.DLL at 00027227-00003904-42911-1854-3F3A9D93","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.dll at 41363-1378-0000000140019ED8\n GetVersionExW@KERNEL32.DLL at 00014493-00003532-51186-1450-3F389ED8\n GetVersionExW@KERNEL32.DLL at 00016034-00001272-48143-1450-3F389ED8\n GetVersionExW@KERNEL32.DLL at 00027227-00003904-42911-1450-3F389ED8","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceExW@KERNEL32.dll at 41363-3053-000000014007CC18\n GetDiskFreeSpaceW@KERNEL32.dll at 41363-3054-000000014007CD34\n GetDiskFreeSpaceExW@KERNEL32.dll at 41363-3052-000000014007CB00\n GetDiskFreeSpaceW@KERNEL32.DLL at 00016034-00001272-38254-2958-3F3ECD34\n GetDiskFreeSpaceExW@KERNEL32.DLL at 00016034-00001272-38254-2957-3F3ECC18\n GetDiskFreeSpaceExW@KERNEL32.DLL at 00016034-00001272-38254-2956-3F3ECB00","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"$25","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"$26","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"\" queries volume information of \"C:\\\" at 00014493-00003532-00000046-63569872\n \"\" queries volume information of \"C:\\\" at 00016034-00001272-00000046-70835105\n \"\" queries volume information of \"C:\\\" at 00027227-00003904-00000046-120603262","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"\" queries volume information of \"C:\\\" at 00014493-00003532-00000046-63569872\n \"\" queries volume information of \"C:\\\" at 00016034-00001272-00000046-70835105\n \"\" queries volume information of \"C:\\\" at 00027227-00003904-00000046-120603262","origin":"API Call","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"blockchain.info\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"104.16.54.3:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys","description":"RegisterHotKey@USER32.dll at 41363-1140-0000000140009997\n UnregisterHotKey@USER32.dll at 41363-4523-000000014000B8F8\n RegisterHotKey@USER32.DLL at 00014493-00003532-51186-1222-3F379997\n RegisterHotKey@USER32.DLL at 00016034-00001272-48143-1222-3F379997\n RegisterHotKey@USER32.DLL at 00027227-00003904-42911-1222-3F379997","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-15","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\CryptoWire\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"CryptoWire\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"OneDrive.lnk\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"cmd.exe\" (UID: 00014680-00002168) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"cmd.exe\" (UID: 00014680-00002168) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c schtasks /create /sc onlogon /tn 1544090992 /rl highest /tr %PROGRAMFILES%\\COMMON~1\\sous.exe\" on 2018-4-13.02:13:28.159\n \"/C title 6636748|vssadmin.exe Delete Shadows /All /Quiet\" on 2018-4-13.02:13:29.191\n \"/C title 1723291|bcdedit /set {default} recoveryenabled No\" on 2018-4-13.02:13:29.238\n \"/C title 8076079|bcdedit /set {default} bootstatuspolicy ignoreallfailures\" on 2018-4-13.02:13:29.269\n \"/S /D /c\" title 6636748\"\" on 2018-4-13.02:13:29.425\n \"/S /D /c\" title 1723291\"\" on 2018-4-13.02:13:29.472\n \"/S /D /c\" title 8076079\"\" on 2018-4-13.02:13:29.519","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$27","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"schtasks.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"OneDrive.encrypted.lnk\" has type \"data\"\n \"OneDrive.lnk\" has type \"data\"\n \"log.txt\" has type \"ASCII text with CRLF line terminators\"\n \"2990904451\" has type \"ASCII text with no line terminators\"\n \"HAPUBWS.encrypted.contact\" has type \"data\"\n \"1544090992\" has type \"DOS executable ()\"\n \"15440909921544090992\" has type \"data\"\n \"Outlook.pst\" has type \"data\"\n \"EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619\" has type \"data\"\n \"BO6HZA14.txt\" has type \"ASCII text\"\n \"Outlook.encrypted.pst\" has type \"data\"\n \"tobtc[1].txt\" has type \"ASCII text with no line terminators\"\n \"Microsoft Outlook.searchconnector-ms\" has type \"data\"\n \"HAPUBWS.contact\" has type \"data\"\n \"Microsoft Outlook.encrypted.searchconnector-ms\" has type \"data\"\n \"Database1.encrypted.accdb\" has type \"DOS executable (COM)\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"\" touched file \"%WINDIR%\\System32\\rsaenh.dll\"\n \"cmd.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"schtasks.exe\" touched file \"%WINDIR%\\System32\\en-US\\schtasks.exe.mui\"\n \"schtasks.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"vssadmin.exe\" touched file \"%WINDIR%\\System32\\en-US\\vssadmin.exe.mui\"\n \"vssadmin.exe\" touched file \"%WINDIR%\\System32\\rsaenh.dll\"\n \"vssadmin.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\msctf.dll.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"blockchain.info\"\n Pattern match: \"www.digicert.com1402\"\n Heuristic match: \"cert-002.blockchain.info\"\n Pattern match: \"www.blockchain.info\"\n Heuristic match: \"rpc.blockchain.info\"\n Heuristic match: \"ws.blockchain.info\"\n Pattern match: \"http://crl3.digicert.com/sha2-ev-server-g1.crl04\"\n Pattern match: \"http://crl4.digicert.com/sha2-ev-server-g1.crl0K\"\n Pattern match: \"https://www.digicert.com/CPS0\"\n Pattern match: \"http://ocsp.digicert.com0R\"\n Pattern match: \"cacerts.digicert.com/DigiCertSHA2ExtendedValidationServerCA.crt0\"\n Pattern match: \"www.digicert.com1+0\"\n Pattern match: \"http://ocsp.digicert.com0K\"\n Pattern match: \"http://crl4.digicert.com/DigiCertHighAssuranceEVRo\"\n Heuristic match: \"wlojul__ecmail.pro\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"\"badoo.com.url\" (Indicator: \"badoo.com\")","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"schtasks.exe\" opened \"\\Device\\KsecDD\"\n \"vssadmin.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Possibly tries to hide a process launching it with different user credentials","description":"CreateProcessAsUserW@ADVAPI32.dll at 41363-2603-0000000140065978\n CreateProcessWithLogonW@ADVAPI32.dll at 41363-2627-0000000140065D84","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-42","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00014493-00003532-00000033-63973952\n \"vssadmin.exe\" at 00014759-00002460-00000033-65138674\n \"\" at 00016034-00001272-00000033-103480785","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Contains ability to block user input","description":"BlockInput@USER32.dll at 41363-3247-0000000140087719\n BlockInput@USER32.DLL at 00016034-00001272-38254-3151-3F3F7719","origin":"Hybrid Analysis Technology","relevance":7,"id":"stream-26","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 33 calls to GetProcAddress@KERNEL32.dll at 41363-1781-00000001400273F8\n Found 33 calls to GetProcAddress@KERNEL32.DLL at 00014493-00003532-51186-643-3F3973F8\n Found 33 calls to GetProcAddress@KERNEL32.DLL at 00016034-00001272-48143-643-3F3973F8\n Found 33 calls to GetProcAddress@KERNEL32.DLL at 00027227-00003904-42911-643-3F3973F8","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a dropped file containing the Windows username (possible fingerprint attempt)","description":"Found dropped filename \"HAPUBWS.encrypted.contact\" containing the Windows username \"HAPUBWS\"\n Found dropped filename \"HAPUBWS.contact\" containing the Windows username \"HAPUBWS\"","origin":"Binary File","relevance":5,"id":"binary-19","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"schtasks.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"LockResource@KERNEL32.dll at 41363-1489-000000014001B390\n FindResourceW@KERNEL32.dll at 41363-2880-0000000140073CC8\n LockResource@KERNEL32.DLL at 00014493-00003532-51186-571-3F38B390\n LockResource@KERNEL32.DLL at 00016034-00001272-48143-571-3F38B390\n FindResourceW@KERNEL32.DLL at 00016034-00001272-38254-2784-3F3E3CC8\n LockResource@KERNEL32.DLL at 00027227-00003904-42911-571-3F38B390","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"1544090992\" has type \"DOS executable ()\"\n \"Database1.encrypted.accdb\" has type \"DOS executable (COM)\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"255.255.255.255\"\n \"5.255.255.255\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"suspicious","category":"Pattern Matching","name":"Contains ability to download files from the internet","description":"InternetReadFile@WININET.dll at 41363-3204-00000001400855A8\n InternetReadFile@WININET.dll at 41363-3206-0000000140085690","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00014759-00002460)","origin":"Monitored Target","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected text artifact in screenshot that indicate file could be ransomware","description":"\"payment\" (Source: screen_7.png, Indicator: \"payment\")","origin":"File/Memory","relevance":10,"id":"string-12","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.dll at 41363-729-0000000140073854\n CreateToolhelp32Snapshot@KERNEL32.dll at 41363-3453-0000000140095310\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00014493-00003532-51186-377-3F3E3854\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00016034-00001272-48143-377-3F3E3854\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00016034-00001272-38254-3356-3F405310\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00027227-00003904-42911-377-3F3E3854","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.dll at 41363-3255-0000000140087A83\n OpenClipboard@USER32.DLL at 00016034-00001272-38254-3159-3F3F7A83","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve keyboard strokes","description":"$28","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-12","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\sous.exe\" marked \"C:\\Users\\%OSUSER%\\Contacts\\%OSUSER%.contact\" for deletion\n \"C:\\sous.exe\" marked \"C:\\Users\\%OSUSER%\\Documents\\Database1.accdb\" for deletion\n \"C:\\sous.exe\" marked \"C:\\Users\\%OSUSER%\\Documents\\Outlook Files\\Outlook.pst\" for deletion\n \"C:\\sous.exe\" marked \"%PROGRAMFILES%\\COMMON~1\\1544090992\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"C:\\Users\\%OSUSER%\\Contacts\\%OSUSER%.contact\" with delete access\n \"\" opened \"C:\\Users\\%OSUSER%\\Documents\\Database1.accdb\" with delete access\n \"\" opened \"C:\\Users\\%OSUSER%\\Documents\\Outlook Files\\Outlook.pst\" with delete access\n \"\" opened \"%PROGRAMFILES%\\COMMON~1\\1544090992\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to elevate privileges","description":"SetSecurityDescriptorDacl@ADVAPI32.dll at 41363-2607-00000001400650BC\n SetSecurityDescriptorDacl@ADVAPI32.dll at 41363-2612-0000000140065318","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-44","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to impersonate another user on the local machine","description":"LogonUserW@ADVAPI32.dll at 41363-2603-0000000140065978","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-46","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to lookup privileges","description":"GetSecurityDescriptorDacl@ADVAPI32.dll at 41363-2607-00000001400650BC\n GetSecurityDescriptorDacl@ADVAPI32.dll at 41363-2612-0000000140065318","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-43","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$29","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"bcdedit.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"\" created file \"%PROGRAMFILES%\\COMMON~1\\sous.exe:Zone.Identifier\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Tries to suppress failures during boot (often used to hide system changes)","description":"Tries to suppress failures during boot \"cmd.exe\" with commandline \"/C title 8076079|bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00014751-00002296)\n Tries to suppress failures during boot \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00014769-00002196)","origin":"Monitored Target","relevance":8,"id":"target-6","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"sous.exe.bin\" (Offset: 193187)","origin":"Binary File","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"35/68 Antivirus vendors marked sample as malicious (51% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"35/68 Antivirus vendors marked sample as malicious (51% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"malicious","category":"General","name":"Contains ability to start/interact with device drivers","description":"DeviceIoControl@KERNEL32.dll at 41363-2877-0000000140073AB2\n DeviceIoControl@KERNEL32.dll at 41363-2876-00000001400739E5\n DeviceIoControl@KERNEL32.dll at 41363-2879-0000000140073BE8\n DeviceIoControl@KERNEL32.dll at 41363-4518-000000014007B4CC\n DeviceIoControl@KERNEL32.DLL at 00016034-00001272-38254-2781-3F3E3AB2\n DeviceIoControl@KERNEL32.DLL at 00016034-00001272-38254-2783-3F3E3BE8\n DeviceIoControl@KERNEL32.DLL at 00016034-00001272-38254-2780-3F3E39E5","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-21","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"35/68 Antivirus vendors marked spawned process \"\" (PID: 1272) as malicious (classified as \"Trojan.Generic\" with 51% detection rate)\n 35/68 Antivirus vendors marked spawned process \"\" (PID: 3904) as malicious (classified as \"Trojan.Generic\" with 51% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"malicious","category":"Installation/Persistance","name":"Disables startup repair","description":"Disables startup repair \"cmd.exe\" with commandline \"/C title 1723291|bcdedit /set {default} recoveryenabled No\" (UID: 00014750-00002328)\n Disables startup repair \"bcdedit.exe\" with commandline \"bcdedit /set {default} recoveryenabled No\" (UID: 00014763-00002208)","origin":"Monitored Target","relevance":8,"id":"target-5","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$2a","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2b","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"$2c","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$2d","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to retrieve keyboard strokes"}],"sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Disables startup repair"},{"detail":"Tries to suppress failures during boot (often used to hide system changes)"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Found a dropped file containing the Windows username (possible fingerprint attempt)"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Tries to access unusual system drive letters"}],"sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]}]},"activity":{"stats":{"process_count":14,"spawned_processes_count":14,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":97,"dropped_files_count":0,"extracted_files_count":16,"files_written_count":99,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ransomware"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5b2e62b47ca3e1716f618ca3","environment_id":100,"environment_description":"Windows 7 32 bit","state":"ERROR","error_type":"Cannot run a 64-bit native file on a 32-bit virtual machine","verdict":"undetected","submit_name":"4deff7d8434583ea8e5c3ef9b4c64674","analysis_start_time":"2018-08-23T08:44:42+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"5acfc2127ca3e15b6c7f3923","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["USA"],"submit_name":"sous","analysis_start_time":"2018-04-13T01:09:01+00:00","indicators_count":{"informative":23,"suspicious":34,"malicious":15},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.16.54.3","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]}],"dns_resolutions":[{"domain":"blockchain.info","address":"104.16.55.3","ttl":299,"country":"United States","registrar_name":"CloudFlare, Inc.","registrar_organization":"Blockchain","registrar_name_servers":"BETH.NS.CLOUDFLARE.COM","registrar_creation_date":"2011-10-15T15:48:38+00:00","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}],"processes":[{"pid":3532,"ppid":0,"name":"sous.exe","command_line":"","sha256":"4deff7d8434583ea8e5c3ef9b4c64674dfb165b1720ddf63b5abdd8ed6a7399c","normalized_path":"C:\\sous.exe","uid":"00014493-00003532","icon":"$2e"},{"pid":2168,"ppid":3532,"name":"cmd.exe","command_line":"/c schtasks /create /sc onlogon /tn 1544090992 /rl highest /tr %PROGRAMFILES%\\COMMON~1\\sous.exe","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014493-00003532","uid":"00014680-00002168"},{"pid":2408,"ppid":2168,"name":"schtasks.exe","command_line":"schtasks /create /sc onlogon /tn 1544090992 /rl highest /tr %PROGRAMFILES%\\COMMON~1\\sous.exe","sha256":"6dce7d58ebb0d705fcb4179349c441b45e160c94e43934c5ed8fa1964e2cd031","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00014680-00002168","uid":"00014687-00002408"},{"pid":3824,"ppid":3532,"name":"cmd.exe","command_line":"/C title 6636748|vssadmin.exe Delete Shadows /All /Quiet","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014493-00003532","uid":"00014748-00003824"},{"pid":2256,"ppid":3824,"name":"cmd.exe","command_line":"/S /D /c\" title 6636748\"","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014748-00003824","uid":"00014758-00002256"},{"pid":2460,"ppid":3824,"name":"vssadmin.exe","command_line":"Delete Shadows /All /Quiet","sha256":"4de7fa20e3224382d8c4a81017e5bdd4673afbef9c0f017e203d7b78977fbf8c","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","parent_uid":"00014748-00003824","uid":"00014759-00002460"},{"pid":2328,"ppid":3532,"name":"cmd.exe","command_line":"/C title 1723291|bcdedit /set {default} recoveryenabled No","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014493-00003532","uid":"00014750-00002328"},{"pid":2176,"ppid":2328,"name":"cmd.exe","command_line":"/S /D /c\" title 1723291\"","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014750-00002328","uid":"00014761-00002176"},{"pid":2208,"ppid":2328,"name":"bcdedit.exe","command_line":"bcdedit /set {default} recoveryenabled No","sha256":"29dbfde0ab20f31de72b8a9b50f9843ae7cafb62933f4f306e7168d4acf33947","normalized_path":"%WINDIR%\\System32\\bcdedit.exe","parent_uid":"00014750-00002328","uid":"00014763-00002208"},{"pid":2296,"ppid":3532,"name":"cmd.exe","command_line":"/C title 8076079|bcdedit /set {default} bootstatuspolicy ignoreallfailures","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014493-00003532","uid":"00014751-00002296"},{"pid":2140,"ppid":2296,"name":"cmd.exe","command_line":"/S /D /c\" title 8076079\"","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014751-00002296","uid":"00014768-00002140"},{"pid":2196,"ppid":2296,"name":"bcdedit.exe","command_line":"bcdedit /set {default} bootstatuspolicy ignoreallfailures","sha256":"29dbfde0ab20f31de72b8a9b50f9843ae7cafb62933f4f306e7168d4acf33947","normalized_path":"%WINDIR%\\System32\\bcdedit.exe","parent_uid":"00014751-00002296","uid":"00014769-00002196"},{"pid":1272,"ppid":3532,"name":"sous.exe","command_line":"","sha256":"4deff7d8434583ea8e5c3ef9b4c64674dfb165b1720ddf63b5abdd8ed6a7399c","normalized_path":"C:\\sous.exe","parent_uid":"00014493-00003532","uid":"00016034-00001272"},{"pid":3904,"ppid":1272,"name":"sous.exe","command_line":"","sha256":"4deff7d8434583ea8e5c3ef9b4c64674dfb165b1720ddf63b5abdd8ed6a7399c","normalized_path":"C:\\sous.exe","parent_uid":"00016034-00001272","uid":"00027227-00003904"}],"all_imported_dlls":["vss_ps.dll","shlwapi.dll","sechost.dll","usp10.dll","comctl32.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","IPHLPAPI.DLL","rasadhlp.dll","npmproxy.dll","ktmw32.dll","wkscli.dll","ntdll.dll","nsi.dll","msasn1.dll","credssp.dll","vsstrace.dll","winnsi.dll","shell32.dll","sspicli.dll","netprofm.dll","wshqos.dll","ncrypt.dll","winbrand.dll","xmllite.dll","psapi.dll","ole32.dll","devobj.dll","dhcpcsvc6.dll","winhttp.dll","imageres.dll","msvcrt.dll","wininet.dll","netutils.dll","dnsapi.dll","wintrust.dll","webio.dll","imm32.dll","propsys.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","taskschd.dll","vssapi.dll","version.dll","bcrypt.dll","normaliz.dll","rsaenh.dll","ntmarta.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","RpcRtRemote.dll","atl.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","secur32.dll","KernelBase.dll","lpk.dll","mpr.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","cfgmgr32.dll","netapi32.dll","dhcpcsvc.dll","cryptnet.dll","wsock32.dll","user32.dll","gdi32.dll","iertutil.dll","profapi.dll","msctf.dll","crypt32.dll","bcryptprimitives.dll","api-ms-win-downlevel-user32-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","userenv.dll","oleaut32.dll","cryptbase.dll","cryptsp.dll","mswsock.dll","urlmon.dll","rpcrt4.dll","winmm.dll","apphelp.dll","clbcatq.dll","setupapi.dll","Wldap32.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","nlaapi.dll","kernel32.dll","advapi32.dll","uxtheme.dll","comdlg32.dll","dwmapi.dll","WSHTCPIP.DLL","schannel.dll","SensApi.dll","ws2_32.dll","rpcss.dll","srvcli.dll","wship6.dll","FWPUCLNT.DLL","gpapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"OneDrive.lnk","sha256":"3e58ed4eb23840a7939c58f516a734d818f95faf6b74d4d82e00ce0ad3292e8c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"name":"1544090992","sha256":"ad95131bc0b799c0b1af477fb14fcf26a6a9f76079e48bf090acb7e8367bfd0e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"name":"15440909921544090992","sha256":"bbc1a1f0ab880d8bd0f6777ef3f6c4cd636625298476f8e0e0cf25fb939760d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"name":"2990904451","sha256":"ea1679035f1451934df4331017d0b9bcddcfdb07a997a0fee01aa76fa5336d48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"name":"log.txt","sha256":"a02c6666af36d31f5e51fa01bd059c70539361187a2b2306f0f86dc8542baa3a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"name":"HAPUBWS.contact","sha256":"617f31bac209a183022ebc3652cc68b81c0a3d52b9c9f1ee000e6cd17cafbb54","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"name":"HAPUBWS.encrypted.contact","sha256":"1134d6e23d5916836966314a254d1bf602a0b961d318edc98f79436a35816b78","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"name":"Database1.encrypted.accdb","sha256":"f2c66729e35777f27ad7b35ff2273aee8b125271a727d12bddf07f9eb5589fea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"name":"Outlook.encrypted.pst","sha256":"8e93fdcd9a063d5b8fab3642e431a799d0460762e86ca347d38c5e611786c320","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"name":"Outlook.pst","sha256":"6af064458f368ed1f175936b1cdde6203d28fe8036b69049c7aba0f6a93fb0c0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"name":"OneDrive.encrypted.lnk","sha256":"dc57a89207004dc7af9377d56b3c872990a62cbe43f140e610c1ae8d67670705","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"name":"EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619","sha256":"8786a12e9bbc5f20e4b71818041f298f67b0288099987e0a16658e68d79b654e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"name":"BO6HZA14.txt","sha256":"9dd4e60d236fc87710d373634050e5ad77781ea17513bf46ebf34d1ee4705ce9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"name":"tobtc[1].txt","sha256":"56d1058769da5d3201cfecca30b0fce62bd642856c691738278c74c53b7121a0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"name":"Microsoft Outlook.searchconnector-ms","sha256":"5f44843643c39747e4270a8a9324e5bf95f72ad9685b54ab9694f2704a381543","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"name":"Microsoft Outlook.encrypted.searchconnector-ms","sha256":"fc7657f9539cd85958bd2fb65c82200bba56da74e1d6bcdd1d6232fb7e8cd531","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]}],"files_written":[{"path":"%PROGRAMFILES%\\COMMON~1\\sous.exe","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"C:\\sous.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%PROGRAMFILES%\\COMMON~1\\sous.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%WINDIR%\\System32\\en-US\\schtasks.exe.mui","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Contacts\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Contacts\\%OSUSER%.encrypted.contact","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Documents\\Database1.encrypted.accdb","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Documents\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Documents\\Outlook Files\\Outlook.encrypted.pst","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Downloads\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\1616.net.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\17173.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\17kuxun.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\3366.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\360.cn.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\360buy.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\39.net.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\4399.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\51.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\51wan.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\58.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\5pk.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\6.cn.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\61.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\726.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\7k7k.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\95599.cn.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\96pk.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\abchina.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\about.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\accountonline.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\addictinggames.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\adobe.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\agame.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\alibaba.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\alipay.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\allegro.pl.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\allrecipes.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\alot.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\amazon.cn.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\amazon.co.uk.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\amazon.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\amazon.de.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ameba.jp.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\answers.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\aol.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\apple.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\asahi.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\att.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\autohome.com.cn.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\avast.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\babylon.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\badoo.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\baidu.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\baixaki.com.br.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\baixing.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\bankofamerica.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\baomihua.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\bbc.co.uk.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\bestbuy.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\biglobe.ne.jp.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\bitauto.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\bizrate.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\blogger.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\blogspot.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\booking.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\brothersoft.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\caixa.gov.br.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\camzap.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\capitalone.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\careerbuilder.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\ccb.com.cn.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\chase.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\china.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\chinanews.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\clubpenguin.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\cnet.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\cnn.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\cntv.cn.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\cocolog-nifty.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\cyworld.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\dailymail.co.uk.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\dailymotion.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\dangdang.com.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\daum.net.url","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%WINDIR%\\AppPatch\\AppPatch64\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%WINDIR%\\System32\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%PROGRAMFILES%\\COMMON~1\\15440909921544090992","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"C:\\sous.exe","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%PROGRAMFILES%\\COMMON~1\\log.txt","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%PROGRAMFILES%\\COMMON~1\\2990904451","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"path":"%WINDIR%\\System32\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\CryptoWire","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]},{"name":"CryptoWire","sources":[{"report_type":"sandbox","report_id":"5acfc2127ca3e15b6c7f3923"}]}]}},"report_ids":{"sandbox_job_ids":["5acfc2127ca3e15b6c7f3923"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.AutoIT.Ransom Sample 4deff7d84345… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 4deff7d84345…. Malware family: Trojan.AutoIT.Ransom. Threat score 100/100. 14/27 AV engines flagged this file. 12 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/4deff7d8434583ea8e5c3ef9b4c64674dfb165b1720ddf63b5abdd8ed6a7399c"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.AutoIT.Ransom Sample 4deff7d84345… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 4deff7d84345…. Malware family: Trojan.AutoIT.Ransom. Threat score 100/100. 14/27 AV engines flagged this file. 12 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/4deff7d8434583ea8e5c3ef9b4c64674dfb165b1720ddf63b5abdd8ed6a7399c"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.AutoIT.Ransom Sample 4deff7d84345… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 4deff7d84345…. Malware family: Trojan.AutoIT.Ransom. Threat score 100/100. 14/27 AV engines flagged this file. 12 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2f","11",{}]]