24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 28:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T499,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.Ryuk.Generic Sample 795db7bdad1b… — Score 97/100 — Hybrid Analysis","description":"Malicious verdict for sample 795db7bdad1b…. Malware family: Ransom.Ryuk.Generic. Threat score 97/100. 22/27 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/795db7bdad1befdd3ad942be79715f6b0c5083d859901b81657b590c9628790f","keywords":["Malicious","Ransom.Ryuk.Generic","malware analysis","sandbox report","threat intelligence","795db7bdad1befdd3ad942be79715f6b0c5083d859901b81657b590c9628790f"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","64bits","executable"],"identifier":"795db7bdad1befdd3ad942be79715f6b0c5083d859901b81657b590c9628790f","additionalType":"Malicious sample"},"threatScore":97,"malwareFamily":"Ransom.Ryuk.Generic","antivirusDetections":{"malicious":22,"total":27},"behavioralIndicators":{"malicious":6,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tc3e,"taskhost.exe" opened "Z:\network.pcapng" with delete access "taskhost.exe" opened "C:\Documents and Settings\All Users\Adobe\ARM\Reader_18.009.20050\ReaderDCManifest2.msi" with delete access "taskhost.exe" opened "Z:\1597321632684$MAPFAILURE" with delete access "taskhost.exe" opened "C:\Documents and Settings\All Users\Application Data\Application Data\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Data1.cab" with delete access "taskhost.exe" opened "C:\Documents and Settings\All Users\Application Data\Application Data\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\AcroRdrDCUpd1800920044.msp" with delete access "taskhost.exe" opened "C:\Documents and Settings\All Users\Application Data\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\AcroRead.msi" with delete access "taskhost.exe" opened "C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Data1.cab" with delete access "taskhost.exe" opened "C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Data1.cab" with delete access "taskhost.exe" opened "Z:\1597321632684$OK" with delete access "taskhost.exe" opened "C:\Documents and Settings\All Users\Adobe\ARM\ArmReport.ini" with delete access "taskhost.exe" opened "C:\Documents and Settings\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\abcpy.ini" with delete access "taskhost.exe" opened "C:\Documents and Settings\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.ini" with delete access "taskhost.exe" opened "C:\Documents and Settings\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\AcroRead.msi" with delete access "taskhost.exe" opened "C:\Documents and Settings\All Users\Application Data\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Data1.cab" with delete access "taskhost.exe" opened "C:\Documents and Settings\All Users\Application Data\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\AcroRdrDCUpd1800920044.msp" with delete access "taskhost.exe" opened "C:\Documents and Settings\All Users\Application Data\Application Data\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\AcroRead.msi" with delete access "taskhost.exe" opened "C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\AcroRdrDCUpd1800920044.msp" with delete access "taskhost.exe" opened "C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Data1.cab" with delete access "taskhost.exe" opened "C:\Documents and Settings\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\AcroRdrDCUpd1800920044.msp" with delete access "taskhost.exe" opened "C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Data1.cab" with delete access26:T673,Found string "FlsGetValue" (Source: 795db7bdad1befdd3ad942be79715f6b0c5083d859901b81657b590c9628790f.bin, API is part of module: KERNELBASE.DLL) Found string "FlsSetValue" (Source: 795db7bdad1befdd3ad942be79715f6b0c5083d859901b81657b590c9628790f.bin, API is part of module: KERNELBASE.DLL) Found string "InitializeCriticalSectionEx" (Source: 795db7bdad1befdd3ad942be79715f6b0c5083d859901b81657b590c9628790f.bin, API is part of module: KERNELBASE.DLL) Found string "LCMapStringEx" (Source: 795db7bdad1befdd3ad942be79715f6b0c5083d859901b81657b590c9628790f.bin, API is part of module: KERNELBASE.DLL) Found string "LocaleNameToLCID" (Source: 795db7bdad1befdd3ad942be79715f6b0c5083d859901b81657b590c9628790f.bin, API is part of module: KERNELBASE.DLL) Found string "GetSystemDefaultLangID" (Source: 795db7bdad1befdd3ad942be79715f6b0c5083d859901b81657b590c9628790f.bin, API is part of module: KERNELBASE.DLL) Found string "WaitForMultipleObjects" (Source: 795db7bdad1befdd3ad942be79715f6b0c5083d859901b81657b590c9628790f.bin, API is part of module: KERNEL32.DLL) Found string "GetFileSizeEx" (Source: 795db7bdad1befdd3ad942be79715f6b0c5083d859901b81657b590c9628790f.bin, API is part of module: KERNELBASE.DLL) Found string "MoveFileExW" (Source: 795db7bdad1befdd3ad942be79715f6b0c5083d859901b81657b590c9628790f.bin, API is part of module: KERNEL32.DLL) Found string "CreateThread" (Source: 795db7bdad1befdd3ad942be79715f6b0c5083d859901b81657b590c9628790f.bin, API is part of module: KERNELBASE.DLL) Found string "IsWow64Process" (Source: 795db7bdad1befdd3ad942be79715f6b0c5083d859901b81657b590c9628790f.bin, API is part of module: KERNELBASE.DLL)27:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"795db7bdad1befdd3ad942be79715f6b0c5083d859901b81657b590c9628790f","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":97,"unified_at_epoch_ms":1791550322643,"unified_at":"2026-10-09T12:52:02.643Z","metadata":{"hashes":{"sha256":"795db7bdad1befdd3ad942be79715f6b0c5083d859901b81657b590c9628790f","sha1":"35dd5239977c2922a06389061cca846ec09453bb","md5":"32cbc69f85cc47d8e35dc20dfbda6948","sha512":"f485a56c783dba3c15d691709a6736d5589194ec8f54e8d01342e7d6f4c54b4a56eae0fa49e150e8a13780fcb7e2e50337c8eaa026baf51774527351b365a25c","ssdeep":"3072:FnJc2mXEkovNxp/gR4DoBOX8CdMzCqV5NNFqe/P:7EsV/gekBIt9W3","ssdeep_chunks":["3072:FnJc2mX","3072:nJc2mXE","3072:Jc2mXEk","3072:c2mXEko","3072:2mXEkov","3072:mXEkovN","3072:XEkovNx","3072:EkovNxp","3072:kovNxp/","3072:ovNxp/g","3072:vNxp/gR","3072:Nxp/gR4","3072:xp/gR4D","3072:p/gR4Do","3072:/gR4DoB","3072:gR4DoBO","3072:R4DoBOX","3072:4DoBOX8","3072:DoBOX8C","3072:oBOX8Cd","3072:BOX8CdM","3072:OX8CdMz","3072:X8CdMzC","3072:8CdMzCq","3072:CdMzCqV","3072:dMzCqV5","3072:MzCqV5N","3072:zCqV5NN","3072:CqV5NNF","3072:qV5NNFq","3072:V5NNFqe","3072:5NNFqe/","3072:NNFqe/P","6144:FnJc2mX","6144:nJc2mXE","6144:Jc2mXEk","6144:c2mXEko","6144:2mXEkov","6144:mXEkovN","6144:XEkovNx","6144:EkovNxp","6144:kovNxp/","6144:ovNxp/g","6144:vNxp/gR","6144:Nxp/gR4","6144:xp/gR4D","6144:p/gR4Do","6144:/gR4DoB","6144:gR4DoBO","6144:R4DoBOX","6144:4DoBOX8","6144:DoBOX8C","6144:oBOX8Cd","6144:BOX8CdM","6144:OX8CdMz","6144:X8CdMzC","6144:8CdMzCq","6144:CdMzCqV","6144:dMzCqV5","6144:MzCqV5N","6144:zCqV5NN","6144:CqV5NNF","6144:qV5NNFq","6144:V5NNFqe","6144:5NNFqe/","6144:NNFqe/P","3072:7EsV/ge","3072:EsV/gek","3072:sV/gekB","3072:V/gekBI","3072:/gekBIt","3072:gekBIt9","3072:ekBIt9W","3072:kBIt9W3"],"imphash":"c7a0309d45fd007c2ce268b7218e075c"},"file_info":{"file_name":"file","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":155648,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1547546433000,"last_seen":1756383355000,"last_multi_scan":1756383355000}},"detections":{"summary":{"verdict":"malicious","score":97,"tags":["commodity","criminal","filecoder","grimspider","jabaxsta","ransomware","ryuk"]},"stats":{"av":{"malicious_count":22,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":6},"sandbox_signatures":{"informative_count":5,"suspicious_count":13,"malicious_count":6,"total":24},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win64.Ransom","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[APT]/Win32.Ryuk","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1317641","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.Ryuk.9F9DE2E6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Ransomware.Ryuk-6688842-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.Ryuk.9F9DE2E6 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win64/Filecoder.Ryuk.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Ransom.Win64.Generic.oa!s1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/LockFile.b","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Ransomware ( 00553fc91 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Cryptor.trR9","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Ransom-Ryuk!32CBC69F85CC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.Encoder.flulke","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Ransom-FAF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/Ransom.Ryuk.A.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanRansom.Cryptor","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_46.0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Filecoder.Win64.8900","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom.Ryuk.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/techniques/T1215","identifiers":[{"type":"malicious","value":"References suspicious system modules"},{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Injects into remote processes"}],"sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"malicious","value":"The input sample contains a known anti-VM trick"}],"sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Monitors specific registry key for changes"},{"type":"suspicious","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"tactic":"Discovery","technique":"Network Service Scanning","attack_id":"T1046","attack_id_wiki":"https://attack.mitre.org/techniques/T1046","identifiers":[{"type":"suspicious","value":"Detected increased number of ARP broadcast requests (network device lookup)"}],"sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"%USERPROFILE%\\Documents\\Visual Studio 2015\\Projects\\ConsoleApplication54new crypted\\x64\\Release\\ConsoleApplication54.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"conhost.exe\" (UID: 00085055-00002012) was launched with modified environment variables: \"TEMP, TMP, USERNAME\"\n Process \"conhost.exe\" (UID: 00085055-00002012) was launched with missing environment variables: \"LOCALAPPDATA, COMPUTERNAME, USERDOMAIN, LOGONSERVER, ALLUSERSPROFILE, ProgramData, HOMEPATH, APPDATA, HOMEDRIVE, USERPROFILE, PUBLIC\"\n Process \"net.exe\" (UID: 00085151-00002188) was launched with new environment variables: \"LOCALAPPDATA=\"%APPDATA%\\\n HOMEDRIVE=\"C:\"\n USERPROFILE=\"C:\\Users\\GOriyoT\"\n PUBLIC=\"C:\\Users\\Public\"\", Process \"net.exe\" (UID: 00085151-00002188) was launched with modified environment variables: \"TEMP\n TMP\n USERNAME\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"Acrobat Reader DC.lnk\" has type \"data\"\n \"account-icon_1_.svg\" has type \"data\"\n \"7-Zip File Manager.lnk\" has type \"data\"\n \"3985b-0cf6f_1_.svg\" has type \"data\"\n \"AcroRead.msi\" has type \"data\"\n \"7-Zip Help.lnk\" has type \"data\"\n \"About Java.lnk\" has type \"data\"\n \"600x600_5_.jpg\" has type \"data\"\n \"3047073_Peach_Opal_1_.wdp\" has type \"data\"\n \"1300_1_.gif\" has type \"data\"\n \"2BP4ZA20.htm\" has type \"data\"\n \"a1109446_1_.js\" has type \"data\"\n \"9EGKCCIX.htm\" has type \"data\"\n \"752596_16x16_1_.jpg\" has type \"data\"\n \"300x300_2_.jpg\" has type \"data\"\n \"201803151148001091_1_.jpg\" has type \"data\"\n \"117775243_150x200_1_.jpg\" has type \"data\"\n \"5TCFCCMV.htm\" has type \"data\"\n \"62530634_1_.htm\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"Ryuk_T1055_.exe\" touched file \"%WINDIR%\\System32\\rsaenh.dll\"\n \"dwm.exe\" touched file \"%WINDIR%\\System32\\en-US\\setupapi.dll.mui\"\n \"net.exe\" touched file \"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"Ryuk_T1055_.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"Ryuk_T1055_.exe\" at 00084926-00003796-00000033-8365870240993465","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"Ryuk_T1055_.exe\" queried SystemProcessInformation at 00084926-00003796-00000033-891718","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"Ryuk_T1055_.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"Ryuk_T1055_.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"taskhost.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"taskhost.exe\" read file \"%ALLUSERSPROFILE%\\Adobe\\ARM\\ArmReport.ini\"\n \"taskhost.exe\" read file \"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\abcpy.ini\"\n \"taskhost.exe\" read file \"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\setup.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\"Ryuk_T1055_.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\HwOrder\" (Filter: 4; Subtree: 0)\n \"taskhost.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\HwOrder\" (Filter: 4; Subtree: 0)\n \"dwm.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\HwOrder\" (Filter: 4; Subtree: 0)\n \"conhost.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\HwOrder\" (Filter: 4; Subtree: 0)","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"level":"suspicious","category":"Network Related","name":"Detected increased number of ARP broadcast requests (network device lookup)","description":"Attempt to find devices in networks: \"192.168.240.49/32, 192.168.241.62/32, 192.168.241.87/32, 192.168.241.90/32, 192.168.241.112/32, 192.168.241.133/32, 192.168.241.202/32, 192.168.241.218/32, 192.168.241.222/32, 192.168.241.247/32, ...\"","origin":"Network Traffic","mitre_attack_id":"T1046","relevance":10,"id":"network-32","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 2000 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$25","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"OpenProcessToken\n CreateToolhelp32Snapshot\n VirtualAllocEx\n GetModuleFileNameW\n GetVersionExW\n IsDebuggerPresent\n LoadLibraryA\n CreateRemoteThread\n WriteProcessMemory\n OpenProcess\n GetCommandLineW\n UnhandledExceptionFilter\n LoadLibraryExW\n GetStartupInfoW\n DeleteFileW\n GetProcAddress\n Process32FirstW\n Process32NextW\n GetModuleHandleA\n FindNextFileW\n GetCommandLineA\n TerminateProcess\n FindFirstFileExW\n GetModuleHandleW\n GetModuleHandleExW\n WriteFile\n CreateFileW\n Sleep","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$26","origin":"File/Memory","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Opens many files with write access (often indicator for full-system infection)","description":"\"conhost.exe\" opens more than 500 files with write access","origin":"API Call","relevance":10,"id":"api-49","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"795db7bdad1befdd3ad942be79715f6b0c5083d859901b81657b590c9628790f.bin\" has a section named \".gfids\"","origin":"Static Parser","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"795db7bdad1befdd3ad942be79715f6b0c5083d859901b81657b590c9628790f.bin\" (Offset: 31066)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"25/39 Antivirus vendors marked sample as malicious (64% detection rate)\n 59/73 Antivirus vendors marked sample as malicious (80% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"25/39 Antivirus vendors marked sample as malicious (64% detection rate)\n 59/73 Antivirus vendors marked sample as malicious (80% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into remote processes","description":"Injected into \"taskhost.exe\" at 2020-8-13.12:28:05.499 (UID: 00084990-00001336)\n Injected into \"dwm.exe\" at 2020-8-13.12:28:06.390 (UID: 00085023-00001512)\n Injected into \"conhost.exe\" at 2020-8-13.12:28:06.796 (UID: 00085055-00002012)\n Injected into \"cmd.exe\" at 2020-8-13.12:29:07.265 (UID: 00085087-00001072)\n Injected into \"conhost.exe\" at 2020-8-13.12:28:07.749 (UID: 00085119-00002440)\n Injected into \"net.exe\" at 2020-8-13.12:29:01.656 (UID: 00085151-00002188)\n Injected into \"conhost.exe\" at 2020-8-13.12:28:08.718 (UID: 00085183-00000468)\n Injected into \"conhost.exe\" at 2020-8-13.12:28:09.249 (UID: 00085215-00002460)","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":6,"id":"target-0","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"Ryuk_T1055_.exe\" wrote 3706880 bytes to a remote process \"%WINDIR%\\System32\\taskhost.exe\" (Handle: 180)\n \"Ryuk_T1055_.exe\" wrote 3706880 bytes to a remote process \"%WINDIR%\\System32\\conhost.exe\" (Handle: 284)\n \"Ryuk_T1055_.exe\" wrote 3706880 bytes to a remote process \"%WINDIR%\\System32\\conhost.exe\" (Handle: 292)\n \"Ryuk_T1055_.exe\" wrote 3706880 bytes to a remote process \"%WINDIR%\\System32\\dwm.exe\" (Handle: 268)\n \"Ryuk_T1055_.exe\" wrote 3706880 bytes to a remote process \"%WINDIR%\\System32\\conhost.exe\" (Handle: 276)\n \"Ryuk_T1055_.exe\" wrote 3706880 bytes to a remote process \"%WINDIR%\\System32\\conhost.exe\" (Handle: 300)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"level":"malicious","category":"Unusual Characteristics","name":"References suspicious system modules","description":"\"csrss.exe\"","origin":"File/Memory","mitre_attack_id":"T1215","relevance":5,"id":"string-24","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]}],"incidents":[{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Injects into remote processes"}],"sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"The input sample contains a known anti-VM trick"}],"sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]}]},"activity":{"stats":{"process_count":9,"spawned_processes_count":9,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":31,"dropped_files_count":0,"extracted_files_count":19,"files_written_count":56,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["commodity","criminal","filecoder","grimspider","jabaxsta","ransomware","ryuk"],"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"5f3531926a3ac037002ebad5","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":97,"malware_family":"Generic.Ransom.Ryuk","submit_name":"Ryuk_T1055_795db7bdad1befdd3ad942be79715f6b0c5083d859901b81657b590c9628790f","analysis_start_time":"2020-08-13T12:27:01+00:00","indicators_count":{"informative":5,"suspicious":13,"malicious":9},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true},{"id":"5f3530a61065487fe3727621","environment_id":100,"environment_description":"Windows 7 32 bit","state":"ERROR","error_type":"Cannot run a 64-bit native file on a 32-bit virtual machine","verdict":"undetected","submit_name":"Ryuk_T1055_795db7bdad1befdd3ad942be79715f6b0c5083d859901b81657b590c9628790f","analysis_start_time":"2020-08-13T12:23:02+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"5c3b94c47ca3e115773ea303","environment_id":120,"environment_description":"Windows 7 64 bit","state":"ERROR","error_type":"Failed to save report to webservice","verdict":"undetected","submit_name":"795db7bdad1befdd3ad942be79715f6b0c5083d859901b81657b590c9628790f.exe","analysis_start_time":"2019-01-13T19:43:00+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"5c3b94c27ca3e115a027dd3a","environment_id":100,"environment_description":"Windows 7 32 bit","state":"ERROR","error_type":"Cannot run a 64-bit native file on a 32-bit virtual machine","verdict":"undetected","submit_name":"795db7bdad1befdd3ad942be79715f6b0c5083d859901b81657b590c9628790f","analysis_start_time":"2019-01-15T10:21:03+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}],"processes":[{"pid":3796,"ppid":0,"name":"Ryuk_T1055_795db7bdad1befdd3ad942be79715f6b0c5083d859901b81657b590c9628790f.exe","command_line":"","sha256":"795db7bdad1befdd3ad942be79715f6b0c5083d859901b81657b590c9628790f","normalized_path":"C:\\Ryuk_T1055_795db7bdad1befdd3ad942be79715f6b0c5083d859901b81657b590c9628790f.exe","uid":"00084926-00003796","icon":"$27"},{"pid":1336,"ppid":3796,"name":"taskhost.exe","command_line":"","normalized_path":"%WINDIR%\\System32\\taskhost.exe","parent_uid":"00084926-00003796","uid":"00084990-00001336"},{"pid":1512,"ppid":3796,"name":"dwm.exe","command_line":"","normalized_path":"%WINDIR%\\System32\\dwm.exe","parent_uid":"00084926-00003796","uid":"00085023-00001512"},{"pid":2012,"ppid":3796,"name":"conhost.exe","command_line":"\"112083822-1615563344-16867065681217571278-512431544-498391863-20317611142145371340","normalized_path":"%WINDIR%\\System32\\conhost.exe","parent_uid":"00084926-00003796","uid":"00085055-00002012"},{"pid":1072,"ppid":3796,"name":"","command_line":"","normalized_path":"","parent_uid":"00084926-00003796","uid":"00085087-00001072"},{"pid":2440,"ppid":3796,"name":"conhost.exe","command_line":"\"6342769081904459292-780022185183399333213847312201931460385957221614-413158181","normalized_path":"%WINDIR%\\System32\\conhost.exe","parent_uid":"00084926-00003796","uid":"00085119-00002440"},{"pid":2188,"ppid":3796,"name":"","command_line":"","normalized_path":"","parent_uid":"00084926-00003796","uid":"00085151-00002188"},{"pid":468,"ppid":3796,"name":"conhost.exe","command_line":"\"-362645675-1110849330121224488212872533941310342301-13778903670681893-1399083701","normalized_path":"%WINDIR%\\System32\\conhost.exe","parent_uid":"00084926-00003796","uid":"00085183-00000468"},{"pid":2460,"ppid":3796,"name":"conhost.exe","command_line":"\"-41512785-194401196951792353315973661461566762689860185408513403191885338874","normalized_path":"%WINDIR%\\System32\\conhost.exe","parent_uid":"00084926-00003796","uid":"00085215-00002460"}],"all_imported_dlls":["ntdll.dll","mpr.dll","ole32.dll","kernel32.dll","KernelBase.dll","imm32.dll","cryptsp.dll","setupapi.dll","cryptbase.dll","gdi32.dll","cfgmgr32.dll","msctf.dll","oleaut32.dll","nsi.dll","winnsi.dll","rsaenh.dll","profapi.dll","powrprof.dll","user32.dll","sechost.dll","msvcrt.dll","rpcrt4.dll","lpk.dll","api-ms-win-core-synch-l1-2-0.dll","shlwapi.dll","devobj.dll","shell32.dll","userenv.dll","usp10.dll","advapi32.dll","IPHLPAPI.DLL"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"AcroRead.msi","sha256":"0390bd274226db136723669560470289555be3b312b4939a66767fbca975f9de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"name":"abcpy.ini","sha256":"5108065281ace462585359d935722f0c57a410a38ad41cae94b878cd82a9518c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"name":"08e575673cce10c72090304839888e02_6b06490d-f9fd-424c-8b6d-83edc4369e89","sha256":"797b08c6226098447bebe0110065b14c3b9cdf0311486f6f5bdad51be2b014a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"name":"Acrobat Reader DC.lnk","sha256":"76e609136af05d476fbb1512a0e0cccf4b72fc98bc14f5e1890128f924a8214a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"name":"account-icon_1_.svg","sha256":"345f82e0c25f6cdd5511eb9ef6c86e8d2a22467cd6004f45b505bd2e7317c705","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"name":"7-Zip File Manager.lnk","sha256":"b58c182ea29865fc40508d30ab43aa1110b1ebe8d541248d2095e6863ea398b6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"name":"3985b-0cf6f_1_.svg","sha256":"b6251a71716416f025453aefe28e2abeb55a2a4c5cf24e7e02ea6b1077bb0222","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"name":"7-Zip Help.lnk","sha256":"6bb96de66a88d831612a59837ea9d8273c4a2a028ed27d7f42ee1b2c23bd6702","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"name":"About Java.lnk","sha256":"8e9f2846372cd4a20354506035909e38cdd476bfe41a33f3ff1cf0c5de4d9c4b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"name":"600x600_5_.jpg","sha256":"f37eb49f62dd708df17d6c8017c3d4ae82ebfe0baf95d7e39528bf799c01a787","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"name":"3047073_Peach_Opal_1_.wdp","sha256":"d371e84b1ab3b65d9ebafa0446c7f8ae6dfcd116c07e4f18af050b65f7dd2e5f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"name":"1300_1_.gif","sha256":"ee549e54567265aeb9ede03963fda5b46e24a8d10b30392011a1b1cbc2f6bedb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"name":"2BP4ZA20.htm","sha256":"05ba116d644ba3e4739968ede72af7b12c20f3115e552ca773ae76c2d8316d6a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"name":"a1109446_1_.js","sha256":"be16d6d3ceae1639388ab4d8e923868e9b463e58fe005d1771098891d42e7cd2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"name":"9EGKCCIX.htm","sha256":"b8f85db992fdfe3f83b68d5106ab1dee6cc1ec4f06f3b224bddc7be26aacc171","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"name":"752596_16x16_1_.jpg","sha256":"45de271f8bb4e1bf34e55b76f4410d506743d75d135cf1f673f45beac25afc4f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"name":"300x300_2_.jpg","sha256":"34b79675c9c9adaa3402c2fe94f8b9a89e12576f37efce8473807e1aaecf0953","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"name":"201803151148001091_1_.jpg","sha256":"70310cbd0351c1a764b3aedcd3af4c7af55e4eb248d447fad07417b8e1f7f168","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"name":"117775243_150x200_1_.jpg","sha256":"02738f43eb8d436de9106e0223a0a7f18025fca43f8fa7467f54d12c9ef18fe9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]}],"files_written":[{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"C:\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"C:\\Users\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%ALLUSERSPROFILE%\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\AIR\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\AIR\\Updater\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\ARM\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\ARM\\Reader_18.009.20050\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%SAMPLEDIR%\\network.pcapng","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\ARM\\Reader_18.009.20050\\ReaderDCManifest2.msi","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\Data1.cab","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\AcroRdrDCUpd1800920044.msp","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"C:\\share\\1597321632684$MAPFAILURE","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%ALLUSERSPROFILE%\\Application Data\\Application Data\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\Data1.cab","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%ALLUSERSPROFILE%\\Application Data\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\AcroRead.msi","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%ALLUSERSPROFILE%\\Application Data\\Application Data\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\AcroRdrDCUpd1800920044.msp","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%ALLUSERSPROFILE%\\Application Data\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\abcpy.ini.RYK","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\AcroRead.msi.RYK","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%ALLUSERSPROFILE%\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\Data1.cab","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%ALLUSERSPROFILE%\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\Data1.cab","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%PUBLIC%\\sys","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%APPDATA%\\Microsoft\\Crypto","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-686412048-2446563785-1323799475-1001\\08e575673cce10c72090304839888e02_6b06490d-f9fd-424c-8b6d-83edc4369e89","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto\\RSA","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto\\RSA\\MachineKeys","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto\\RSA\\MachineKeys\\08e575673cce10c72090304839888e02_6b06490d-f9fd-424c-8b6d-83edc4369e89","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"C:\\share\\1597321632684$OK","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\ARM\\ArmReport.ini","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\abcpy.ini","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\setup.ini","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\AcroRead.msi","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\ARM\\Reader_18.009.20050\\ReaderDCManifest2.msi.RYK","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%ALLUSERSPROFILE%\\Application Data\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\Data1.cab","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%ALLUSERSPROFILE%\\Application Data\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\AcroRdrDCUpd1800920044.msp","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%ALLUSERSPROFILE%\\Application Data\\Application Data\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\AcroRead.msi","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\ARM\\ArmReport.ini.RYK","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\setup.ini.RYK","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\abcpy.ini.RYK","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%ALLUSERSPROFILE%\\Application Data\\Application Data\\Application Data\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\AcroRdrDCUpd1800920044.msp","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%ALLUSERSPROFILE%\\Application Data\\Application Data\\Application Data\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\Data1.cab","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\AcroRdrDCUpd1800920044.msp.RYK","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%ALLUSERSPROFILE%\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\Data1.cab","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%ALLUSERSPROFILE%\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\Data1.cab","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\Data1.cab.RYK","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5f3531926a3ac037002ebad5"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5f3531926a3ac037002ebad5"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Ransom.Ryuk.Generic Sample 795db7bdad1b… — Score 97/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 795db7bdad1b…. Malware family: Ransom.Ryuk.Generic. Threat score 97/100. 22/27 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/795db7bdad1befdd3ad942be79715f6b0c5083d859901b81657b590c9628790f"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom.Ryuk.Generic Sample 795db7bdad1b… — Score 97/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 795db7bdad1b…. Malware family: Ransom.Ryuk.Generic. Threat score 97/100. 22/27 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/795db7bdad1befdd3ad942be79715f6b0c5083d859901b81657b590c9628790f"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom.Ryuk.Generic Sample 795db7bdad1b… — Score 97/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 795db7bdad1b…. Malware family: Ransom.Ryuk.Generic. Threat score 97/100. 22/27 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L28","11",{}]]