26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T4d8,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious MSIL.Ransomware.Jigsaw.Generic Sample 5af6c81056ef… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 5af6c81056ef…. Malware family: MSIL.Ransomware.Jigsaw.Generic. Threat score 100/100. 15/26 AV engines flagged this file. 9 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/5af6c81056efc5768b8c269e81c769d75f39d8e31b4f048616998f0bd552a743","keywords":["Malicious","MSIL.Ransomware.Jigsaw.Generic","malware analysis","sandbox report","threat intelligence","5af6c81056efc5768b8c269e81c769d75f39d8e31b4f048616998f0bd552a743"],"about":{"@type":"SoftwareApplication","name":"BitcoinStealer.EXE","applicationCategory":["peexe","assembly","executable"],"identifier":"5af6c81056efc5768b8c269e81c769d75f39d8e31b4f048616998f0bd552a743","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"MSIL.Ransomware.Jigsaw.Generic","antivirusDetections":{"malicious":15,"total":26},"behavioralIndicators":{"malicious":9,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T478,"" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" at 00041772-00002316-0000010C-95711205 "" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" at 00041772-00002316-0000010C-95711423 "iexplorer.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" at 00046731-00002388-0000010C-107162386 "iexplorer.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" at 00046731-00002388-0000010C-107162632 "server.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" at 00051018-00002672-0000010C-116977331 "server.exe" queries volume information of "C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" at 00051018-00002672-0000010C-11697757628:T5e8,"" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config" "" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\assembly\NativeImages_v2.0.50727_32\index23c.dat" "" touched file "C:\Windows\System32\l_intl.nls" "" touched file "C:\Windows\assembly\pubpol47.dat" "" touched file "C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" "" touched file "C:\Windows\System32\rsaenh.dll" "" touched file "C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp" "" touched file "C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp" "" touched file "C:\Windows\System32\en-US\msctf.dll.mui"29:T412,"server.exe" queried SystemProcessInformation at 00051018-00002672-00000105-132734197 "server.exe" queried SystemProcessInformation at 00051018-00002672-00000105-132734483 "server.exe" queried SystemProcessInformation at 00051018-00002672-00000105-132735632 "server.exe" queried SystemProcessInformation at 00051018-00002672-00000105-137835574 "server.exe" queried SystemProcessInformation at 00051018-00002672-00000105-137835738 "server.exe" queried SystemProcessInformation at 00051018-00002672-00000105-137835918 "server.exe" queried SystemProcessInformation at 00051018-00002672-00000105-139991181 "server.exe" queried SystemProcessInformation at 00051018-00002672-00000105-139991333 "server.exe" queried SystemProcessInformation at 00051018-00002672-00000105-139991510 "server.exe" queried SystemProcessInformation at 00051018-00002672-00000105-150174755 "server.exe" queried SystemProcessInformation at 00051018-00002672-00000105-150174975 "server.exe" queried SystemProcessInformation at 00051018-00002672-00000105-1501752372a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHiIiIcAAAAAAAAAAAAAB///iIiIiHAAAAAAAAAAAP/4u7szM4iIAAAAAAAAAI/4u7uzMzMzeIcAAAAAAAj4u7u7MzMzMzOIgAAAAACPi7u7szMzMzMzOIcAAAAA+Lu7uziD9zMzMzOIAAAAD/u7u7M/h/gzMzMzOIAAAH+Lu7szf4j4MzMzMzeHAAD/u7u4//////+DMzMziAAA+Lu7u///////+DMzM4gAB/u7u7u4/4Mzj/9zMzM/cAj7u7u7uP+DMz//gzMzP4AIi7u7u7v/gzN//3MzM7+ACIu7u7u7//iP//gzMzu48AiLu7u7u/////+DMzO7uPAIi7u7u7v/gzj/8zM7u7+ACPu7u7u7/4Mzj/gzu7u/gAf7u7u7N/+DM//4O7u7v3AA+Lu7u4j/+P//87u7u48AAP+7u7j/////+Du7u7v/AAB/i7u7u7+H+DO7u7u49wAAD/u7u7u/g/g7u7u7v/AAAAD4u7u7v4uIu7u7u48AAAAAj4u7u7u7u7u7u7j4AAAAAAj4u7u7u7u7u7uPgAAAAAAAj/i7u7u7u7uP+AAAAAAAAAD/+Lu7u7uP/wAAAAAAAAAAB///+I///wAAAAAAAAAAAAAAeIiIhwAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////AP//+AAf//AAD//AAAP/gAAB/wAAAP8AAAD+AAAAfAAAADwAAAA8AAAAOAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAcAAAAPAAAADwAAAA+AAAAfwAAAP8AAAD/gAAB/8AAA//wAA//+AA///8A///////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"5af6c81056efc5768b8c269e81c769d75f39d8e31b4f048616998f0bd552a743","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790289267098,"unified_at":"2026-09-24T22:34:27.098Z","metadata":{"hashes":{"sha256":"5af6c81056efc5768b8c269e81c769d75f39d8e31b4f048616998f0bd552a743","sha1":"fc6cce250084879841ff7213526883803c6285ef","md5":"c08df3be6abfbff0635f47a28de1a0d0","sha512":"33c16ff842bfb8a30f393ab4ea59a6495b61ac68ea85046199c25ea4f990a95d8a1dd07f5803e5fdf9b5b1b1bb21a4c8218aeb0433bbcef1d75e7c4e32356974","ssdeep":"3072:KVnoDypoa6wZNzWfsZ/c2uQ8IClqcYPA7:rDypjRZB1ZzClW","ssdeep_chunks":["3072:KVnoDyp","3072:VnoDypo","3072:noDypoa","3072:oDypoa6","3072:Dypoa6w","3072:ypoa6wZ","3072:poa6wZN","3072:oa6wZNz","3072:a6wZNzW","3072:6wZNzWf","3072:wZNzWfs","3072:ZNzWfsZ","3072:NzWfsZ/","3072:zWfsZ/c","3072:WfsZ/c2","3072:fsZ/c2u","3072:sZ/c2uQ","3072:Z/c2uQ8","3072:/c2uQ8I","3072:c2uQ8IC","3072:2uQ8ICl","3072:uQ8IClq","3072:Q8IClqc","3072:8IClqcY","3072:IClqcYP","3072:ClqcYPA","3072:lqcYPA7","6144:KVnoDyp","6144:VnoDypo","6144:noDypoa","6144:oDypoa6","6144:Dypoa6w","6144:ypoa6wZ","6144:poa6wZN","6144:oa6wZNz","6144:a6wZNzW","6144:6wZNzWf","6144:wZNzWfs","6144:ZNzWfsZ","6144:NzWfsZ/","6144:zWfsZ/c","6144:WfsZ/c2","6144:fsZ/c2u","6144:sZ/c2uQ","6144:Z/c2uQ8","6144:/c2uQ8I","6144:c2uQ8IC","6144:2uQ8ICl","6144:uQ8IClq","6144:Q8IClqc","6144:8IClqcY","6144:IClqcYP","6144:ClqcYPA","6144:lqcYPA7","3072:rDypjRZ","3072:DypjRZB","3072:ypjRZB1","3072:pjRZB1Z","3072:jRZB1Zz","3072:RZB1ZzC","3072:ZB1ZzCl","3072:B1ZzClW"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"BitcoinStealer.EXE","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":237568,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1514136152000,"last_seen":1620497532000,"last_multi_scan":1620497532000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ransomware"]},"stats":{"av":{"malicious_count":15,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":14,"suspicious_count":20,"malicious_count":9,"total":43},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"Ahnlab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.TSGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1109456","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"BitDefender","success":true,"verdict":"malicious","threat_name":"Generic.MSIL.Ransomware.Jigsaw.29C80D2E","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.MSIL.Injector.MJL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Generic.MSIL.Ransomware.Jigsaw.29C80D2E (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Injector.NIK trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.Injector.fy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"Ikarus","success":true,"verdict":"malicious","threat_name":"Trojan.MSIL.Injector","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0053564e1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Backdoor.MSIL.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Bladabindi.ewktbf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Threat-Generic://Malicious-Confidence_95","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/MSIL-GIH","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"TrendMicro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"TrendMicro House Call","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xviruspersonalguard":{"name":"Xvirus Personal Guard","success":true,"verdict":"malicious","threat_name":"Suspicious:NewThreat.101","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"MSIL.Ransomware.Jigsaw.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$27","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORER.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORER.EXE\")\n \"iexplorer.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SERVER.EXE\")\n \"iexplorer.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SERVER.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"njrat072018.ddns.net\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"89.43.181.17:1604\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\iexplorer.exe\"\n \"\" created file \"%TEMP%\\iexplorer.exe:Zone.Identifier\"\n \"iexplorer.exe\" created file \"%TEMP%\\YhifiYwc\"\n \"iexplorer.exe\" created file \"%TEMP%\\server.exe\"\n \"server.exe\" created file \"%TEMP%\\YhifiYwc\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\7a36b17a31173a9539fd513f53486c37\"\n \"7a36b17a31173a9539fd513f53486c37\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\d40b99d82652dbbc000d378a824ae296\\mscorlib.ni.dll\" at 6B490000\n \"iexplorer.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\d40b99d82652dbbc000d378a824ae296\\mscorlib.ni.dll\" at 6C790000\n \"server.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\d40b99d82652dbbc000d378a824ae296\\mscorlib.ni.dll\" at 6B490000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"iexplorer.exe\" (UID: 00046731-00002388)\n Spawned process \"server.exe\" (UID: 00051018-00002672)\n Spawned process \"netsh.exe\" with commandline \"netsh firewall add allowedprogram \"%TEMP%\\server.exe\" \"server.exe\" ENABLE\" (UID: 00056449-00002848)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"iexplorer.exe\" connecting to \"\\ThemeApiPort\"\n \"server.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"server.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"\n \"YhifiYwc\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$28","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"njrat072018.ddns.net\"\n Pattern match: \"http://go.microsoft.com/fwlink/?linkid=121488\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"iexplorer.exe\" opened \"\\Device\\KsecDD\"\n \"server.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"5af6c81056efc5768b8c269e81c769d75f39d8e31b4f048616998f0bd552a743.exe.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"server.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00041772-00002316-00000105-95721361\n \"iexplorer.exe\" at 00046731-00002388-00000105-107172198\n \"server.exe\" at 00051018-00002672-00000105-116987357","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"$29","origin":"API Call","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"\" is allocating memory with PAGE_GUARD access rights\n \"iexplorer.exe\" is allocating memory with PAGE_GUARD access rights\n \"server.exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text\n .text with unusual entropies 7.10854686511\n 7.10854686511","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"DES\" (Indicator: \"des\"; File: \"00041772-00002316.00000001.45267.00A72000.00000020.mdmp\")","origin":"File/Memory","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"iexplorer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"server.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"netsh.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"iexplorer.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"server.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"netsh.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"\" sleeping for \"1566804069\" milliseconds\n \"iexplorer.exe\" sleeping for \"1566804069\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/66 reputation engines marked \"http://njrat072018.ddns.net\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"\n \"iexplorer.exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"netsh.exe\" called \"OpenService\" to access the \"policyagent\" service\n \"netsh.exe\" called \"OpenService\" to access the \"ServicesActive\" service requesting \"SERVICE_QUERY_CONFIG\" (0X1) access rights\n \"netsh.exe\" called \"OpenService\" to access the \"NapAgent\" service\n \"netsh.exe\" called \"OpenService\" to access the \"NapAgent\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"suspicious","category":"General","name":"Sent a control code to a service","description":"\"netsh.exe\" called \"ControlService\" and sent control code \"0X24\" to the service \"NapAgent\"\n \"netsh.exe\" called \"ControlService\" and sent control code \"0X120\" to the service \"NapAgent\"","origin":"API Call","relevance":10,"id":"api-75","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"server.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"server.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"7A36B17A31173A9539FD513F53486C37\"; Value: \"\"%TEMP%\\server.exe\" ..\")\n \"server.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"7A36B17A31173A9539FD513F53486C37\"; Value: \"\"%TEMP%\\server.exe\" ..\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"91.53.34.38\"\n \"69.41.37.62\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch.2316.4024500\" with delete access\n \"\" opened \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch.2316.4024500\" with delete access\n \"\" opened \"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2316.4024660\" with delete access\n \"iexplorer.exe\" opened \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch.2388.1570937820\" with delete access\n \"iexplorer.exe\" opened \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch.2388.1570937820\" with delete access\n \"iexplorer.exe\" opened \"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2388.1570937960\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"iexplorer.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"iexplorer.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"iexplorer.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"9adedece\" to virtual address \"0x6CCE1FDC\" (part of module \"MSCORWKS.DLL\")\n \"\" wrote bytes \"db4df36e00000000\" to virtual address \"0x00A72000\" (part of module \"5AF6C81056EFC5768B8C269E81C769D75F39D8E31B4F048616998F0BD552A743.EXE\")\n \"iexplorer.exe\" wrote bytes \"ebf919f2\" to virtual address \"0x6D291FDC\" (part of module \"MSCORWKS.DLL\")\n \"iexplorer.exe\" wrote bytes \"db4df36e00000000\" to virtual address \"0x00212000\" (part of module \"IEXPLORER.EXE\")\n \"netsh.exe\" wrote bytes \"a354b775013db87538edb875cfcdb7753123b775de2fb875c4cab77580bbb775aa6eb8759fbbb77592bbb77546ceb77500bfb7750abfb77546bab77500000000273ecc75efb2d07551c1ca759498ca75ee9cca7575dccc7500000000\" to virtual address \"0x6C3C1000\" (part of module \"MPRMSG.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"iexplorer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"server.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"\" created file \"%TEMP%\\iexplorer.exe:Zone.Identifier\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"25/68 Antivirus vendors marked sample as malicious (36% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"25/68 Antivirus vendors marked sample as malicious (36% detection rate)\n 2/10 Antivirus vendors marked sample as malicious (20% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"25/74 Antivirus vendors marked dropped file \"server.exe\" as malicious (classified as \"Generic.MSIL.Ransomware.Jigsaw\" with 33% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"25/74 Antivirus vendors marked spawned process \"iexplorer.exe\" (PID: 2388) as malicious (classified as \"Generic.MSIL.Ransomware.Jigsaw\" with 33% detection rate)\n 25/74 Antivirus vendors marked spawned process \"server.exe\" (PID: 2672) as malicious (classified as \"Generic.MSIL.Ransomware.Jigsaw\" with 33% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a remote process \"%TEMP%\\iexplorer.exe\" (Handle: 688)\n \"\" wrote 52 bytes to a remote process \"%TEMP%\\iexplorer.exe\" (Handle: 688)\n \"\" wrote 4 bytes to a remote process \"%TEMP%\\iexplorer.exe\" (Handle: 688)\n \"iexplorer.exe\" wrote 32 bytes to a remote process \"%TEMP%\\server.exe\" (Handle: 700)\n \"iexplorer.exe\" wrote 52 bytes to a remote process \"%TEMP%\\server.exe\" (Handle: 700)\n \"iexplorer.exe\" wrote 4 bytes to a remote process \"%TEMP%\\server.exe\" (Handle: 700)\n \"server.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\netsh.exe\" (Handle: 560)\n \"server.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\netsh.exe\" (Handle: 560)\n \"server.exe\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\netsh.exe\" (Handle: 560)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"malicious","category":"Network Related","name":"Sends network traffic on a port typically used by trojan horses","description":"\"Traffic to 89.43.181.17 on port 1604","origin":"Network Traffic","relevance":9,"id":"network-12","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 89.43.181.17 on port 1604","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"level":"malicious","category":"System Security","name":"Modifies firewall settings","description":"Process \"netsh.exe\" with commandline \"netsh firewall add allowedprogram \"%TEMP%\\server.exe\" \"server.exe\" ENABLE\" (UID: 00056449-00002848)","origin":"Monitored Target","relevance":8,"id":"target-15","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Modifies firewall settings"}],"sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"}],"sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":14,"imported_dlls_count":136,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":48,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ransomware"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5a3fe04a7ca3e13a71451a43","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Generic.MSIL.Ransomware.Jigsaw","contacted_countries":["ROU"],"submit_name":"BitcoinStealer.EXE","analysis_start_time":"2017-12-24T18:15:57+00:00","indicators_count":{"informative":14,"suspicious":23,"malicious":10},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"89.43.181.17","port":1604,"protocol":"TCP","country":"Romania","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]}],"dns_resolutions":[{"domain":"njrat072018.ddns.net","address":"89.43.181.17","country":"Romania","registrar_name":"TLDS LLC. d/b/a SRSPlus","registrar_organization":"No-IP.com","registrar_name_servers":"NF1.NO-IP.COM","registrar_creation_date":"2001-06-28T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}],"processes":[{"pid":2316,"ppid":0,"name":"5af6c81056efc5768b8c269e81c769d75f39d8e31b4f048616998f0bd552a743.exe","command_line":"","sha256":"5af6c81056efc5768b8c269e81c769d75f39d8e31b4f048616998f0bd552a743","normalized_path":"C:\\5af6c81056efc5768b8c269e81c769d75f39d8e31b4f048616998f0bd552a743.exe","uid":"00041772-00002316","icon":"$2a"},{"pid":2388,"ppid":2316,"name":"iexplorer.exe","command_line":"","sha256":"5af6c81056efc5768b8c269e81c769d75f39d8e31b4f048616998f0bd552a743","normalized_path":"%TEMP%\\iexplorer.exe","parent_uid":"00041772-00002316","uid":"00046731-00002388"},{"pid":2672,"ppid":2388,"name":"server.exe","command_line":"","sha256":"5af6c81056efc5768b8c269e81c769d75f39d8e31b4f048616998f0bd552a743","normalized_path":"%TEMP%\\server.exe","parent_uid":"00046731-00002388","uid":"00051018-00002672"},{"pid":2848,"ppid":2672,"name":"netsh.exe","command_line":"netsh firewall add allowedprogram \"%TEMP%\\server.exe\" \"server.exe\" ENABLE","sha256":"661f5d4ce4f0a6cb32669a43ce5deec6d5a9e19b2387f22c5012405e92169943","normalized_path":"%WINDIR%\\System32\\netsh.exe","parent_uid":"00051018-00002672","uid":"00056449-00002848"}],"all_imported_dlls":["mscoreei.dll","System.Xml.ni.dll","mprapi.dll","mfc42u.dll","kernel32.dll","imm32.dll","dwmapi.dll","apphelp.dll","dnsapi.dll","nshwfp.dll","nlaapi.dll","NAPMONTR.DLL","nsi.dll","netiohlp.dll","adsldpc.dll","rpcrt4.dll","srvcli.dll","nettrace.dll","KernelBase.dll","gdi32.dll","bcrypt.dll","comctl32.dll","rasman.dll","DHCPQEC.DLL","p2pcollab.dll","psapi.dll","rasadhlp.dll","winipsec.dll","ifmon.dll","devrtl.dll","wwancfg.dll","iertutil.dll","WSHTCPIP.DLL","dhcpcsvc6.dll","winhttp.dll","webio.dll","certcli.dll","System.Drawing.ni.dll","dhcpcmonitor.dll","polstore.dll","QAGENT.DLL","shell32.dll","Wldap32.dll","cfgmgr32.dll","credui.dll","FirewallAPI.dll","netapi32.dll","mprmsg.dll","profapi.dll","version.dll","whhelper.dll","wlanapi.dll","System.ni.dll","clbcatq.dll","tzres.dll","dot3api.dll","p2pnetsh.dll","advapi32.dll","mscorwks.dll","ws2help.dll","authfwcfg.dll","uxtheme.dll","sspicli.dll","wshelper.dll","ntdll.dll","FWPUCLNT.DLL","ndfapi.dll","msvcrt.dll","rsaenh.dll","RpcRtRemote.dll","wship6.dll","dhcpcsvc.dll","QUTIL.DLL","msvcr80.dll","urlmon.dll","httpapi.dll","msasn1.dll","tdh.dll","user32.dll","Microsoft.VisualBasic.dll","System.Configuration.ni.dll","netshell.dll","dot3cfg.dll","eappcfg.dll","logoncli.dll","mscoree.dll","ntmarta.dll","wininet.dll","onex.dll","activeds.dll","mscorjit.dll","devobj.dll","ws2_32.dll","wevtapi.dll","netutils.dll","wwapi.dll","crypt32.dll","mswsock.dll","odbc32.dll","odbcint.dll","eappprxy.dll","secur32.dll","usp10.dll","rasapi32.dll","wlanhlp.dll","setupapi.dll","nshhttp.dll","oleaut32.dll","winnsi.dll","rpcnsh.dll","nshipsec.dll","WcnNetsh.dll","wlanutil.dll","IPHLPAPI.DLL","userenv.dll","wdi.dll","ole32.dll","cryptsp.dll","System.Windows.Forms.ni.dll","fwcfg.dll","nci.dll","propsys.dll","hnetmon.dll","wkscli.dll","msctf.dll","cryptbase.dll","shlwapi.dll","mpr.dll","P2P.dll","sechost.dll","lpk.dll","mscorlib.ni.dll","rasmontr.dll","slc.dll","wlancfg.dll","atl.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"server.exe","sha256":"5af6c81056efc5768b8c269e81c769d75f39d8e31b4f048616998f0bd552a743","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"name":"YhifiYwc","sha256":"701e3a46846324bc8b9de70e4afb97961be9f095f7ffd9562d8b72f2d85f88e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]}],"files_written":[{"path":"C:\\5af6c81056efc5768b8c269e81c769d75f39d8e31b4f048616998f0bd552a743.exe.config","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"C:\\5af6c81056efc5768b8c269e81c769d75f39d8e31b4f048616998f0bd552a743.exe","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"C:\\5af6c81056efc5768b8c269e81c769d75f39d8e31b4f048616998f0bd552a743.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%TEMP%\\iexplorer.exe.config","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%TEMP%\\iexplorer.exe","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%WINDIR%\\System32\\en-US\\propsys.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%TEMP%\\server.exe.config","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index23c.dat","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%WINDIR%\\System32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%TEMP%\\server.exe","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\machine.config","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%TEMP%\\YhifiYwc","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%WINDIR%\\System32\\en-US\\netsh.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%WINDIR%\\System32\\en-US\\odbcint.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%WINDIR%\\System32\\en-US\\MFC42u.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%WINDIR%\\System32\\en-US\\fwcfg.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%WINDIR%\\System32\\en-US\\crypt32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%WINDIR%\\System32\\en-US\\p2pnetsh.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"path":"%WINDIR%\\System32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\FUSION\\GACCHANGENOTIFICATION\\DEFAULT\\","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\NAPAGENT\\LOCALCONFIG\\","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\NAPAGENT\\LOCALCONFIG\\ENROLL\\HCSGROUPS\\","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\NAPAGENT\\SHAS\\","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\NAPAGENT\\QECS\\","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\7a36b17a31173a9539fd513f53486c37","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"name":"7a36b17a31173a9539fd513f53486c37","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"name":"Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\3a886eb8-fe40-4d0a-b78b-9e0bcb683fb7","sources":[{"report_type":"sandbox","report_id":"5a3fe04a7ca3e13a71451a43"}]}]}},"report_ids":{"sandbox_job_ids":["5a3fe04a7ca3e13a71451a43"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious MSIL.Ransomware.Jigsaw.Generic Sample 5af6c81056ef… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 5af6c81056ef…. Malware family: MSIL.Ransomware.Jigsaw.Generic. Threat score 100/100. 15/26 AV engines flagged this file. 9 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/5af6c81056efc5768b8c269e81c769d75f39d8e31b4f048616998f0bd552a743"}],["$","meta","4",{"property":"og:title","content":"Malicious MSIL.Ransomware.Jigsaw.Generic Sample 5af6c81056ef… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 5af6c81056ef…. Malware family: MSIL.Ransomware.Jigsaw.Generic. Threat score 100/100. 15/26 AV engines flagged this file. 9 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/5af6c81056efc5768b8c269e81c769d75f39d8e31b4f048616998f0bd552a743"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious MSIL.Ransomware.Jigsaw.Generic Sample 5af6c81056ef… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 5af6c81056ef…. Malware family: MSIL.Ransomware.Jigsaw.Generic. Threat score 100/100. 15/26 AV engines flagged this file. 9 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]