21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 33:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4a4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Ransom.Amnesia Sample 7e74ecfe0f93… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 7e74ecfe0f93…. Malware family: Trojan.Ransom.Amnesia. Threat score 100/100. 19/27 AV engines flagged this file. 10 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7e74ecfe0f9389fbfd037ae0eedbbfd9502600490977866850f90146eecad549","keywords":["Malicious","Trojan.Ransom.Amnesia","malware analysis","sandbox report","threat intelligence","7e74ecfe0f9389fbfd037ae0eedbbfd9502600490977866850f90146eecad549"],"about":{"@type":"SoftwareApplication","name":"amnesia.exe","applicationCategory":["peexe","executable"],"identifier":"7e74ecfe0f9389fbfd037ae0eedbbfd9502600490977866850f90146eecad549","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Ransom.Amnesia","antivirusDetections":{"malicious":19,"total":27},"behavioralIndicators":{"malicious":10,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T5d5,Spawned process "" with commandline "runas" (UID: 00014386-00003224) Spawned process "guide.exe" (UID: 00014483-00002764) Spawned process "cmd.exe" with commandline "cmd /c %TEMP%\{77B3CC07-E172-2B3B-5893-925C8B33E99E}.bat" (UID: 00014515-00003052) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c vssadmin Delete Shadows /All /Quiet" (UID: 00014594-00002840) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No" (UID: 00014595-00002816) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00014596-00002852) Spawned process "vssadmin.exe" with commandline "vssadmin Delete Shadows /All /Quiet" (UID: 00014631-00003396) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} recoveryenabled No" (UID: 00014633-00003348) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00014638-00003356) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c start /max notepad.exe "%USERPROFILE%\HOW TO RECOVER ENCRYPTED FILES.TXT"" (UID: 00017970-00003772) Spawned process "cmd.exe" with commandline "cmd /c %TEMP%\{722F69F2-F4F2-496D-9077-DA30E016C45F}.bat" (UID: 00017972-00003676) Spawned process "notepad.exe" with commandline ""%USERPROFILE%\HOW TO RECOVER ENCRYPTED FILES.TXT"" (UID: 00017982-00003904)23:T63c,"========================================================================================================= YOUR FILES ARE ENCRYPTED! Your personal ID: 3224828115892085413904364980090163274140074199575883268202932114827786797814789188884036184166141291 5004852803688872985568657492917171378587227508764849619840731759131709320373245385806929972926195524 3486331252316338067312501205190686686239717253497902382895994661200700103229870445573018924854789558 0085709434181455633726755063366799455353615780545802017368600980976599334552207325561674965156320452 1047344084920331739334610506057302599337763583804513060195896062986040756628216181256655255175743376 3863344828965475844103065352939035438908026861546357932780086376992065222293642524480537902149809057 557935039376646425 Attention! What happened? Your documents, databases and other important data has been encrypted. If you want to restore files send an email to: s1an1er111@protonmail.com In a letter to indicate your personal identifier (see in the beginning of this document). Attention! * Do not attempt to remove the program or run the anti-virus tools. * Attempts to self-decrypting files will result in the loss of your data. * Decoders are not compatible with other users of your data, because each user's unique encryption key. =========================================================================================================" (Source: HOW TO RECOVER ENCRYPTED FILES.TXT, Indicator: "files are encrypted") "YOUR FILES ARE ENCRYPTED!" (Source: HOW TO RECOVER ENCRYPTED FILES.TXT, Indicator: "files are encrypted")24:T69c,"" opened "%APPDATA%\guide.exe" with delete access "guide.exe" opened "%APPDATA%\guide.exe" with delete access "guide.exe" opened "C:\autoexec.bat" with delete access "guide.exe" opened "C:\config.sys" with delete access "guide.exe" opened "C:\Recovery\72d3f4c2-b53f-11e4-b6d9-9157ca704b30\boot.sdi" with delete access "guide.exe" opened "C:\Recovery\72d3f4c2-b53f-11e4-b6d9-9157ca704b30\Winre.wim" with delete access "guide.exe" opened "C:\Users\Default\NTUSER.DAT" with delete access "guide.exe" opened "C:\Users\Default\NTUSER.DAT.LOG" with delete access "guide.exe" opened "C:\Users\Default\NTUSER.DAT.LOG1" with delete access "guide.exe" opened "C:\Users\Default\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf" with delete access "guide.exe" opened "C:\Users\Default\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms" with delete access "guide.exe" opened "C:\Users\Default\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms" with delete access "guide.exe" opened "C:\Users\desktop.ini" with delete access "guide.exe" opened "C:\Users\PSPUBWS\Contacts\desktop.ini" with delete access "guide.exe" opened "C:\Users\PSPUBWS\Contacts\PSPUBWS.contact" with delete access "guide.exe" opened "C:\Users\PSPUBWS\Desktop\Calculator.lnk" with delete access "guide.exe" opened "C:\Users\PSPUBWS\Desktop\desktop.ini" with delete access "guide.exe" opened "C:\Users\PSPUBWS\Desktop\MineSweeper.lnk" with delete access "guide.exe" opened "C:\Users\PSPUBWS\Desktop\Paint.lnk" with delete access "guide.exe" opened "C:\Users\PSPUBWS\Desktop\Sticky Notes.lnk" with delete access25:T610,Spawned process "" (UID: 00014265-00003096) Spawned process "" with commandline "runas" (UID: 00014386-00003224) Spawned process "guide.exe" (UID: 00014483-00002764) Spawned process "cmd.exe" with commandline "cmd /c %TEMP%\{77B3CC07-E172-2B3B-5893-925C8B33E99E}.bat" (UID: 00014515-00003052) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c vssadmin Delete Shadows /All /Quiet" (UID: 00014594-00002840) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No" (UID: 00014595-00002816) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00014596-00002852) Spawned process "vssadmin.exe" with commandline "vssadmin Delete Shadows /All /Quiet" (UID: 00014631-00003396) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} recoveryenabled No" (UID: 00014633-00003348) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00014638-00003356) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c start /max notepad.exe "%USERPROFILE%\HOW TO RECOVER ENCRYPTED FILES.TXT"" (UID: 00017970-00003772) Spawned process "cmd.exe" with commandline "cmd /c %TEMP%\{722F69F2-F4F2-496D-9077-DA30E016C45F}.bat" (UID: 00017972-00003676) Spawned process "notepad.exe" with commandline ""%USERPROFILE%\HOW TO RECOVER ENCRYPTED FILES.TXT"" (UID: 00017982-00003904)26:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==27:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==28:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==29:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==2a:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==2c:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==2e:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==30:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHAAAAAAAAAAAAAAAAAAAHd4hwAAAAAAAAAAAAAHB4iP+IhwAAAAAAAAAAB3eIj/iIiIdwAAAAAAAAeIj4iIiPiIiHgzEAAAAAeIiIiId3iIiIh3MzAAAHiIiIh3d3d3iIiIh3MwCIiIh3h3d3d3d4/4j4dzMQiHZmZnd3d3d3d4iIiHczMHZmZmZ3d3d3d3ePiPiHEzB2ZmZmeIiIiIiIiIiIhxMwd2ZmZniIiIiIiIj/+IcTMAd2Z3d4iIiIiIiIiI+HEQAAd3d3eIiIiIiIiI+PhzEAAHiIiIiIiIiIiIiIj4cxAAAHiIiIiIiIiIiIiPiHMQAAB4iIiIiIiIiIiIiPhzEAAAB4iIiIiIiIiIiIj4cxAAAACIiIiIiIiIiIiI/4MQAAAAeIiIiIiIiIiIiI+DEAAAAAj///iIiIiIiIiPgxAAAAAHj/+IiIiIiIiIiIMQAAAAAI//////iIiIiIiDEAAAAABo//////iIiIiIhxAAAAAAB///////+IiId4cQAAAAAACP///4iHd3d3eHEAAAAAAAf4iIh3eHh4d3dwAAAAAAAAiHh4eHh4iIiIAAAAAAAAAIh4eIiIiAAAAAAAAAAAAAAPiIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD////////4f///wD///AAP/8AAA/4AAAH8AAAA4AAAAQAAAAEAAAABAAAAAQAAAAEAAAABgAAAA8AAAAPAAAAD4AAAA+AAAAPwAAAD+AAAA/gAAAP8AAAD/AAAA/4AAAP+AAAD/wAAA/+AAAP/gAAH/8AAD//AA///4f///////w==31:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==32:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"7e74ecfe0f9389fbfd037ae0eedbbfd9502600490977866850f90146eecad549","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790593098148,"unified_at":"2026-09-28T10:58:18.148Z","metadata":{"hashes":{"sha256":"7e74ecfe0f9389fbfd037ae0eedbbfd9502600490977866850f90146eecad549","sha1":"12163f6d885ce9c594371b0847054cc648da8442","md5":"98c0c4e58a97cf92f9c6992ee65e3f0f","sha512":"0414b2bcb49fbbd46f926d02369bbae93a0e9a4123f11b3d37b0763a672222b872d44522a21c0bd7a0754461bd06f4cbc7d9a173ab7379c5790ad086c5cd6d30","ssdeep":"6144:hGZOapXeYP6OlF546A6WVhyZqY3IlpP6OlF57:hILheErW+25","ssdeep_chunks":["6144:hGZOapX","6144:GZOapXe","6144:ZOapXeY","6144:OapXeYP","6144:apXeYP6","6144:pXeYP6O","6144:XeYP6Ol","6144:eYP6OlF","6144:YP6OlF5","6144:P6OlF54","6144:6OlF546","6144:OlF546A","6144:lF546A6","6144:F546A6W","6144:546A6WV","6144:46A6WVh","6144:6A6WVhy","6144:A6WVhyZ","6144:6WVhyZq","6144:WVhyZqY","6144:VhyZqY3","6144:hyZqY3I","6144:yZqY3Il","6144:ZqY3Ilp","6144:qY3IlpP","6144:Y3IlpP6","6144:3IlpP6O","6144:IlpP6Ol","6144:lpP6OlF","6144:pP6OlF5","6144:P6OlF57","12288:hGZOapX","12288:GZOapXe","12288:ZOapXeY","12288:OapXeYP","12288:apXeYP6","12288:pXeYP6O","12288:XeYP6Ol","12288:eYP6OlF","12288:YP6OlF5","12288:P6OlF54","12288:6OlF546","12288:OlF546A","12288:lF546A6","12288:F546A6W","12288:546A6WV","12288:46A6WVh","12288:6A6WVhy","12288:A6WVhyZ","12288:6WVhyZq","12288:WVhyZqY","12288:VhyZqY3","12288:hyZqY3I","12288:yZqY3Il","12288:ZqY3Ilp","12288:qY3IlpP","12288:Y3IlpP6","12288:3IlpP6O","12288:IlpP6Ol","12288:lpP6OlF","12288:pP6OlF5","12288:P6OlF57","6144:hILheEr","6144:ILheErW","6144:LheErW+","6144:heErW+2","6144:eErW+25"],"imphash":"6b16042d2c9d97ac8a75354d149320c2"},"file_info":{"file_name":"amnesia.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":201216,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499286941000,"last_seen":1690008338000,"last_multi_scan":1690008338000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ransomware"]},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":15,"suspicious_count":17,"malicious_count":10,"total":42},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Worm/Win32.RL_AutoRun","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.AGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Downloader.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.Amnesia.C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Ransomware.Scarab-6336012-1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.TrojanDownloader.Delf.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.Amnesia.C (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Filecoder.FS trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0050c62e1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Purga.an","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Ransom-Amnesia!98C0C4E58A97","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Purga.epfegz","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Ransom/W32.DP-Purga.201216","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_AMNESIA.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_AMNESIA.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Hoax.Purga","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Purga.Win32.62","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Ransom.Amnesia","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.DLL at 00014265-00003096-62714-256-004082F0\n GetLocalTime@KERNEL32.DLL at 00014265-00003096-62714-195-004082C4\n GetLocalTime@KERNEL32.DLL at 00014386-00003224-178-195-004082C4\n GetLocalTime@KERNEL32.DLL at 00014386-00003224-178-256-004082F0\n GetLocalTime@KERNEL32.DLL at 00014483-00002764-2595-256-004082F0\n GetLocalTime@KERNEL32.DLL at 00014483-00002764-2595-195-004082C4","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@KERNEL32.DLL at 00014265-00003096-62714-628-0040A78C\n GetVersionExA@KERNEL32.DLL at 00014386-00003224-178-628-0040A78C\n GetVersionExA@KERNEL32.DLL at 00014483-00002764-2595-629-0040A78C","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@KERNEL32.DLL at 00014265-00003096-62714-605-00407318\n GetDiskFreeSpaceA@KERNEL32.DLL at 00014386-00003224-178-605-00407318\n GetDiskFreeSpaceA@KERNEL32.DLL at 00014483-00002764-2595-606-00407318","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\AMNESIA.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\AMNESIA.EXE\")\n \"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\GUIDE.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\GUIDE.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\{77B3CC07-E172-2B3B-5893-925C8B33E99E}.bat\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\{1B31B55F-9B46-8988-6D18-41A7B67F0BD8}\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"cmd /c %TEMP%\\{77B3CC07-E172-2B3B-5893-925C8B33E99E}.bat\" on 2017-5-10.09:28:15.775\n \"%WINDIR%\\system32\\cmd.exe /c vssadmin Delete Shadows /All /Quiet\" on 2017-5-10.09:28:16.466\n \"%WINDIR%\\system32\\cmd.exe /c bcdedit /set {default} recoveryenabled No\" on 2017-5-10.09:28:16.476\n \"%WINDIR%\\system32\\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures\" on 2017-5-10.09:28:16.486\n \"%WINDIR%\\system32\\cmd.exe /c start /max notepad.exe \"%USERPROFILE%\\HOW TO RECOVER ENCRYPTED FILES.TXT\"\" on 2017-5-10.09:29:30.255\n \"cmd /c %TEMP%\\{722F69F2-F4F2-496D-9077-DA30E016C45F}.bat\" on 2017-5-10.09:29:30.265","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$22","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"autoexec.bat\" has type \"data\"\n \"blogger.com.url\" has type \"data\"\n \"jDJAedKZ.txt\" has type \"data\"\n \"9rNtWnjTq9RGbU.exe\" has type \"data\"\n \"metrolyrics.com.url\" has type \"data\"\n \"5yqb2pxbZ.txt\" has type \"data\"\n \"HOW TO RECOVER ENCRYPTED FILES.TXT\" has type \"ASCII text with CRLF line terminators\"\n \"netlog.com.url\" has type \"data\"\n \"ocNqp38QzZ.jpg\" has type \"data\"\n \"NTUSER.DAT.LOG\" has type \"data\"\n \"surveymonkey.com.url\" has type \"data\"\n \"5aFd8vA3PE3A.mp3\" has type \"data\"\n \"Tulips.jpg\" has type \"data\"\n \"Adobe Reader XI.lnk\" has type \"data\"\n \"monster.com.url\" has type \"data\"\n \"tudou.com.url\" has type \"data\"\n \"PpzHcsYvXs2l.img\" has type \"data\"\n \"fnHklmDjE.pdf\" has type \"data\"\n \"match.com.url\" has type \"data\"\n \"boot.sdi\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db\"\n \"\" touched file \"%WINDIR%\\system32\\en-US\\PROPSYS.dll.mui\"\n \"\" touched file \"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db\"\n \"guide.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"guide.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"If you want to restore files send an email to: s1an1er111@protonmail.com\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Found Delphi 4 - Delphi 2006 artifact","description":"\"amnesia.exe.bin\" has a PE timestamp using the buggy magic timestamp 0x2A425E19.","origin":"Static Parser","relevance":10,"id":"static-19","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"amnesia.exe.bin\" was detected as \"BobSoft Mini Delphi -> BoB / BobSoft\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 16 calls to GetProcAddress@KERNEL32.DLL at 00014265-00003096-62714-353-0040B948\n Found 16 calls to GetProcAddress@KERNEL32.DLL at 00014386-00003224-178-353-0040B948\n Found 16 calls to GetProcAddress@KERNEL32.DLL at 00014483-00002764-2595-353-0040B948","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.97987592605","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a dropped file containing the Windows username (possible fingerprint attempt)","description":"Found dropped filename \"PSPUBWS.contact\" containing the Windows username \"PSPUBWS\"","origin":"Binary File","relevance":5,"id":"binary-19","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"guide.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceA@KERNEL32.DLL at 00014265-00003096-62714-117-0040C734\n FindResourceA@KERNEL32.DLL at 00014386-00003224-178-117-0040C734\n FindResourceA@KERNEL32.DLL at 00014483-00002764-2595-117-0040C734","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"\n \"guide.exe\" read file \"%USERPROFILE%\\Users\\PSPUBWS\\Contacts\\desktop.ini\"\n \"guide.exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"\n \"guide.exe\" read file \"%USERPROFILE%\\Documents\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\")\n \"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"{1B31B55F-9B46-8988-6D18-41A7B67F0BD8}\"; Value: \"%APPDATA%\\guide.exe\")\n \"guide.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"guide.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"{1B31B55F-9B46-8988-6D18-41A7B67F0BD8}\"; Value: \"notepad.exe \"C:\\Users\\ttVc6s1\\HOW TO RECOVER ENCRYPTED FILES.TXT\"\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"$23","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"guide.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00014483-00002764-2595-355-0040BBC4","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\amnesia.exe\" marked \"%APPDATA%\\guide.exe\" for deletion\n \"%APPDATA%\\guide.exe\" marked \"%APPDATA%\\guide.exe\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$24","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegDeleteKeyA\n RegCloseKey\n RegDeleteValueA\n RegCreateKeyExA\n RegOpenKeyExA\n RegEnumKeyExA\n GetFileAttributesA\n CopyFileA\n GetVersionExA\n GetModuleFileNameA\n LoadLibraryA\n GetFileSize\n OpenProcess\n LockResource\n DeleteFileA\n UnhandledExceptionFilter\n GetCommandLineA\n GetProcAddress\n CreateThread\n GetModuleHandleA\n FindFirstFileA\n WriteFile\n GetStartupInfoA\n FindNextFileA\n LoadLibraryExA\n TerminateProcess\n WinExec\n Sleep\n GetTickCount\n CreateFileA\n FindResourceA\n VirtualAlloc\n ShellExecuteExA\n ShellExecuteA\n InternetReadFile\n InternetOpenUrlA\n InternetCloseHandle\n InternetOpenA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"bcdedit.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"notepad.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"\" created file \"%APPDATA%\\guide.exe\\:Zone.Identifier:$DATA\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Tries to suppress failures during boot (often used to hide system changes)","description":"Tries to suppress failures during boot \"cmd.exe\" with commandline \"%WINDIR%\\system32\\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00014596-00002852)\n Tries to suppress failures during boot \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00014638-00003356)","origin":"Monitored Target","relevance":8,"id":"target-6","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"34/60 Antivirus vendors marked sample as malicious (56% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"34/60 Antivirus vendors marked sample as malicious (56% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"34/60 Antivirus vendors marked spawned process \"\" (PID: 3096) as malicious (classified as \"Gen:Trojan.Heur2.GZ\" with 56% detection rate)\n 34/60 Antivirus vendors marked spawned process \"\" (PID: 3224) as malicious (classified as \"Gen:Trojan.Heur2.GZ\" with 56% detection rate)\n 34/60 Antivirus vendors marked spawned process \"guide.exe\" (PID: 2764) as malicious (classified as \"Gen:Trojan.Heur2.GZ\" with 56% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"level":"malicious","category":"Installation/Persistance","name":"Disables startup repair","description":"Disables startup repair \"cmd.exe\" with commandline \"%WINDIR%\\system32\\cmd.exe /c bcdedit /set {default} recoveryenabled No\" (UID: 00014595-00002816)\n Disables startup repair \"bcdedit.exe\" with commandline \"bcdedit /set {default} recoveryenabled No\" (UID: 00014633-00003348)","origin":"Monitored Target","relevance":8,"id":"target-5","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"vssadmin Delete Shadows /All /Quiet\" (UID: 00014631-00003396)","origin":"Monitored Target","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"level":"malicious","category":"Ransomware/Banking","name":"The analysis extracted a known ransomware file","description":"Found dropped filename \"HOW TO RECOVER ENCRYPTED FILES.TXT\" which has been seen in the context of ransomware (Indicator: How To Recover Encrypted Files.txt)","origin":"Binary File","relevance":5,"id":"binary-9","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"\" checked file \"C:\\amnesia.exe\\:Zone.Identifier:$DATA\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$25","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"Ransomware","details_count":3,"details":[{"detail":"The analysis extracted a known ransomware file"},{"detail":"Deletes volume snapshots (often used by ransomware)"},{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Disables startup repair"},{"detail":"Tries to suppress failures during boot (often used to hide system changes)"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Found a dropped file containing the Windows username (possible fingerprint attempt)"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]}]},"activity":{"stats":{"process_count":13,"spawned_processes_count":13,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":10,"imported_dlls_count":57,"dropped_files_count":0,"extracted_files_count":55,"files_written_count":31,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":1,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":6,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ransomware"],"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"5912cec0aac2edde5ea8085b","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Trojan.Heur2.GZ","submit_name":"amnesia.exe","analysis_start_time":"2017-05-10T09:27:00+00:00","indicators_count":{"informative":15,"suspicious":26,"malicious":12},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}],"processes":[{"pid":3096,"ppid":0,"name":"amnesia.exe","command_line":"","sha256":"7e74ecfe0f9389fbfd037ae0eedbbfd9502600490977866850f90146eecad549","normalized_path":"C:\\amnesia.exe","uid":"00014265-00003096","icon":"$26"},{"pid":3224,"ppid":3096,"name":"amnesia.exe","command_line":"runas","sha256":"7e74ecfe0f9389fbfd037ae0eedbbfd9502600490977866850f90146eecad549","normalized_path":"C:\\amnesia.exe","parent_uid":"00014265-00003096","uid":"00014386-00003224","icon":"$27"},{"pid":2764,"ppid":3224,"name":"guide.exe","command_line":"","sha256":"7e74ecfe0f9389fbfd037ae0eedbbfd9502600490977866850f90146eecad549","normalized_path":"%APPDATA%\\guide.exe","parent_uid":"00014386-00003224","uid":"00014483-00002764","icon":"$28"},{"pid":2840,"ppid":2764,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c vssadmin Delete Shadows /All /Quiet","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014483-00002764","uid":"00014594-00002840","icon":"$29"},{"pid":3396,"ppid":2840,"name":"vssadmin.exe","command_line":"vssadmin Delete Shadows /All /Quiet","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","parent_uid":"00014594-00002840","uid":"00014631-00003396","icon":"$2a"},{"pid":2816,"ppid":2764,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c bcdedit /set {default} recoveryenabled No","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014483-00002764","uid":"00014595-00002816","icon":"$2b"},{"pid":3348,"ppid":2816,"name":"bcdedit.exe","command_line":"bcdedit /set {default} recoveryenabled No","sha256":"aa501dc5b621527b0e3dd2787d4969647631c4904d3ae9fc06d177251bc760e3","normalized_path":"%WINDIR%\\System32\\bcdedit.exe","parent_uid":"00014595-00002816","uid":"00014633-00003348","icon":"$2c"},{"pid":2852,"ppid":2764,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014483-00002764","uid":"00014596-00002852","icon":"$2d"},{"pid":3356,"ppid":2852,"name":"bcdedit.exe","command_line":"bcdedit /set {default} bootstatuspolicy ignoreallfailures","sha256":"aa501dc5b621527b0e3dd2787d4969647631c4904d3ae9fc06d177251bc760e3","normalized_path":"%WINDIR%\\System32\\bcdedit.exe","parent_uid":"00014596-00002852","uid":"00014638-00003356","icon":"$2e"},{"pid":3772,"ppid":2764,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c start /max notepad.exe \"%USERPROFILE%\\HOW TO RECOVER ENCRYPTED FILES.TXT\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014483-00002764","uid":"00017970-00003772","icon":"$2f"},{"pid":3904,"ppid":3772,"name":"notepad.exe","command_line":"\"%USERPROFILE%\\HOW TO RECOVER ENCRYPTED FILES.TXT\"","sha256":"c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102","normalized_path":"%WINDIR%\\System32\\notepad.exe","parent_uid":"00017970-00003772","uid":"00017982-00003904","icon":"$30"},{"pid":3676,"ppid":2764,"name":"cmd.exe","command_line":"cmd /c %TEMP%\\{722F69F2-F4F2-496D-9077-DA30E016C45F}.bat","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014483-00002764","uid":"00017972-00003676","icon":"$31"},{"pid":3052,"ppid":3224,"name":"cmd.exe","command_line":"cmd /c %TEMP%\\{77B3CC07-E172-2B3B-5893-925C8B33E99E}.bat","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014386-00003224","uid":"00014515-00003052","icon":"$32"}],"all_imported_dlls":["vss_ps.dll","version.dll","ntdll.dll","sechost.dll","netutils.dll","KernelBase.dll","lpk.dll","msasn1.dll","devobj.dll","winbrand.dll","oleaut32.dll","rpcss.dll","vssapi.dll","usp10.dll","cryptbase.dll","Wldap32.dll","cfgmgr32.dll","browcli.dll","advapi32.dll","profapi.dll","apphelp.dll","drprov.dll","winsta.dll","rsaenh.dll","iertutil.dll","msctf.dll","clbcatq.dll","kernel32.dll","comctl32.dll","cscapi.dll","comdlg32.dll","msvcrt.dll","ole32.dll","shell32.dll","wininet.dll","cryptsp.dll","mpr.dll","sspicli.dll","setupapi.dll","urlmon.dll","davhlpr.dll","wkscli.dll","vsstrace.dll","user32.dll","crypt32.dll","ntmarta.dll","davclnt.dll","uxtheme.dll","propsys.dll","imm32.dll","gdi32.dll","atl.dll","RpcRtRemote.dll","shlwapi.dll","dwmapi.dll","rpcrt4.dll","ntlanman.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"{77B3CC07-E172-2B3B-5893-925C8B33E99E}.bat","sha256":"be4da545510fff160282b92d6e01005dac3e040b225995e608d1aaf981230bff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"{722F69F2-F4F2-496D-9077-DA30E016C45F}.bat","sha256":"662aff038ac4712eac18b984b0168ef5bcac3a6c168acd8037299f9e606a530b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"PSPUBWS.contact","sha256":"e39f706860831b9111f985b86789522c828c2191df348d035dd7d058bc789206","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"Desktop background.png","sha256":"074efaf17ad519995d33b47e5650ce836fafccfde91ce12e43de081c3335ab87","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"Calculator.lnk","sha256":"4128980b3d625d35d5f6e6d904e1697b1ecb5df78202b9ec3b6e0cf5afbabcad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"MineSweeper.lnk","sha256":"1d4e0e983fddaa336ee86d464fe15e050fc56648e4ab220c8d502e57f5f44a3d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"Paint.lnk","sha256":"645fbdad1a921fec5a78c3fbb13f278eb4f60a90ad8aba7216bedd9b5a2898c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"Sticky Notes.lnk","sha256":"8ffbd502371c4d5d617ec7897ae2fb7c1eceb974f1ee1ba1a9ffcf77ed327287","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"Windows Media Player.lnk","sha256":"6d0be93eedb7bd7b4fb6623e7d8f0793653369a5586cb8969523ce1fbdf24f21","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"01dMtnkBz9.gif","sha256":"2ff050c5d27b6626e7bd74219c6c739cd37043b070a60b270137a40305455bea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"04bZ.txt","sha256":"648958905aa1e29a088b01254638c30ac2b37d161ef281df5cf66e0aba6b06a6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"0Og1.rar","sha256":"e5b7661e4fe6051e8bce58aa243bfaeb8a96f912b2287e0c966d316611613cf5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"0gakl8ixtWMkw.doc","sha256":"aa8d242002e3fb97339006087bdddda7c61f5e5b2720fc5104e7e43ad38d7eec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"0pYWspjURe8aqA.exe","sha256":"9cb721618ceca39c9c3dd064eb80a94c1731607256effda4dd3fad505eb945ce","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"0zIG0D.doc","sha256":"e538032807ea57e67b1b4eb88debf9bf077fbd024e3723f867fea3b061dd9950","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"1N1A3vlRdYRii5C.mp3","sha256":"5f12fc54412ef29b882028ab5216d052973e0aca21bd0961e2ccc4a5dcd0e2c2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"1q4yvQVxByym4.rar","sha256":"8dace5feead9d35d6cf03b9b7efdd10e6997e295c930854b291fd241ed775887","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"3AVoUo9c20GI.pdf","sha256":"fc64987fb2023fa3346de6f56560aa88794b7eb7743a693c8d7bdad6e37735a2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"3Awf.mp3","sha256":"5417856c19816d2112e903b5ab289e0225258d15a705d0ce67aea9d51e4a7129","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"3dfFyhzUJVQSk.img","sha256":"230adc05ed38f8af4e7c2ce552f6565e9dd43eb9ccf7caf5b52a28eee53b92a9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"4lpro8p6KuJo0.mp3","sha256":"b5dbc69a16c0337fb257afa248ffbfe50b38887c3eb48f66e65794d3569f2f3f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"5F1yaAIKfUGQcmmt.doc","sha256":"41246fd3e82669bf48be3005aaccf3838f66be9e5bf6c40928aeca993ec78ac7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"63sDzrkUoHoRT.exe","sha256":"ee87005d4d918e3f3328ab157768f0a75020131438bc0285879aa4a50e60d659","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"6SZfLTu9z.doc","sha256":"45135ff9362321dd825b91b121eb67c2b89d3d4d467972c05adfe52e89d044af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"6WMjwc1zqk3IB.exe","sha256":"58f57d0de36c479dea11b22400b743706a39955d84b6af73d838e313d08a384b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"9rNtWnjTq9RGbU.exe","sha256":"4e424b89f728d4257487f3db757fe73e2fce97f645c37606e105bc3ab64d01b2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"C04T72pR0Bcl.doc","sha256":"2c7770898dd8a531931ba8821693945a6c5edb874da16b7f9614a457768e74bc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"a3Ntx.exe","sha256":"b7ad7e07cea9cc4c7073d02184aec9608a4cca0ebadd8fff8636c6bc5ce906c4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"bg3oTe.doc","sha256":"d5a6b31227add03ab2e1a59b6d6e948d227cf675e6e981b32168c4c5bdaef5a2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"bvYkKJ33N9A.exe","sha256":"1a2acf8df8b1f6b4c0cb5e273cc5d9ae1460d15c5285216d60cc46d781421abc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"autoexec.bat","sha256":"53a25616cf0884a5f5d2eb6b4163599d9027b48e7ad54a0a9a2bb43c3c4e2765","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"Adobe Reader XI.lnk","sha256":"73de61b14bdf0edac88d852262ee8d619430c59caa72df1a916e9f594ca480c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"yZw6snqBQ28DAzu.exe","sha256":"1922dd0a4bd58b4ead6753b75a3ca5401d498f5496a5edc39c8d3e1047790ebb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"rRgk91Ih5n.doc","sha256":"5235edfda34d0b382b3aad8717bd76a31fcba76d23d8f300ba08d3ca5306a855","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"dH1rDN9f9.doc","sha256":"d881856f3b664ea86a7b25ac713a751264e712fa6a85c87eb47970183835d871","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"lCEf83Wf7e4nuIMk.doc","sha256":"6603c6bf51693f8bb118e75c2dad7493f6067a590fd18f55e5ae8859b28e2da7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"Desktop.lnk","sha256":"da009dcfba7d8a7c0716791a87b634d7d85667957c8167840ac6a66bf22ef4e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"w5JaoO.doc","sha256":"e890055b6990157a36d0f89ff82fba5771b943352b3f4ddcd2430dc29fd57d2c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"tDUzYwYK5f.exe","sha256":"a66e8612eec340d0db00b0f66aac858f9ce38eceb9927f928298b768703c1841","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"kdo6iAicsoicvHg.exe","sha256":"aa4bf060bccbeb1c6d76e092ef8e76151accf10505d9f6c444bc2cb1405145d0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"dskCEJ.exe","sha256":"7dae8cb0857e14994b2ebbbe6c2b93226b5ad3994fc0e6b2f5cb82fee9386070","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"kY01UeAiy5.exe","sha256":"04c5ff89eec7eb44e88a91602c8114efb8fac21741d0bb9543b481b2a67cae2c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"Downloads.lnk","sha256":"290c2324d850d4186b3576f35901aee1bf1aa0f7d91b481843784d1f9f380d9c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"Google Chrome.lnk","sha256":"4d44476271a56ce05f9f36d06b900fcab489303422b177784b513bd0dfba795a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"hlchPBL.exe","sha256":"0939d80bd06e62904ec804b247e6e572957cb45300a403173567886d467e372c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"iLLOga.exe","sha256":"3c77e4f52199ebe2e93b1bb6e2314e497cb666d14cdc950c9668adf7b393be57","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"klmqz.doc","sha256":"547ab8a9022174896d22ab86684ad4a65dfa9bb2d447eb2eb31522abd93e8c95","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"mtgFs8Za.doc","sha256":"46d13ccce8c3512ad48fed7358f446daf36c03058fe9983a213e3ae8941bac1f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"RecentPlaces.lnk","sha256":"8d4ac405616e526fca2e15b887cf960aa9268153edee86daeec38e6344797ccc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"F3hzum1.doc","sha256":"cdf0517ee049ca382515a71d53afb4a5b9e7052d3b4e44acbde587eba98c8949","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"Tmg2wsFHYf9ioO.doc","sha256":"0110599c0abb18496dbd8c0b53d9515f96e021c7d119d78066eeea198ba130b4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"hKY8.doc","sha256":"9c0e3c6ab02eeb61e80a43c6a121eb35bc1b4bd4cb4761ab0d4bd8a3b025ad54","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"EKeaJO.doc","sha256":"f783416eba34b471a8ff9f7fc673bb4a77cb76ea4c71d172ccc9adff9c9ebf99","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"dgQJde60mPXhI.exe","sha256":"e6f379d4e3bdb1641400e9efae11cd838a8dbb2874e32b16fa9e6228f93c0718","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"Mozilla Firefox.lnk","sha256":"08553e8be84abf450d2656fe7d1aff01bd0d01198cd653fd81f3e9ef6c8d7c51","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]}],"files_written":[{"path":"C:\\amnesia.exe\\:Zone.Identifier:$DATA","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"path":"%APPDATA%\\guide.exe\\:Zone.Identifier:$DATA","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"path":"%WINDIR%\\system32\\en-US\\PROPSYS.dll.mui","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"path":"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"path":"%WINDIR%\\system32\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"path":"%WINDIR%\\system32\\bcdedit.exe","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"path":"%WINDIR%\\system32\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"path":"%TEMP%\\{77B3CC07-E172-2B3B-5893-925C8B33E99E}.bat","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"path":"C:\\HOW TO RECOVER ENCRYPTED FILES.TXT","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"path":"C:\\pagefile.sys","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"path":"C:\\Recovery\\72d3f4c2-b53f-11e4-b6d9-9157ca704b30\\HOW TO RECOVER ENCRYPTED FILES.TXT","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"path":"%USERPROFILE%\\NTUSER.DAT.LOG2","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"path":"C:\\Users\\HOW TO RECOVER ENCRYPTED FILES.TXT","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"path":"%USERPROFILE%\\Contacts\\HOW TO RECOVER ENCRYPTED FILES.TXT","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"path":"%USERPROFILE%\\Desktop\\HOW TO RECOVER ENCRYPTED FILES.TXT","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"path":"%USERPROFILE%\\Documents\\HOW TO RECOVER ENCRYPTED FILES.TXT","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"path":"%USERPROFILE%\\Downloads\\HOW TO RECOVER ENCRYPTED FILES.TXT","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"path":"%WINDIR%\\system32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"path":"%WINDIR%\\system32\\notepad.exe","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"path":"%TEMP%\\{722F69F2-F4F2-496D-9077-DA30E016C45F}.bat","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"path":"%WINDIR%\\system32\\en-US\\notepad.exe.mui","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"path":"%WINDIR%\\system32\\en-US\\USER32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"path":"%USERPROFILE%\\HOW TO RECOVER ENCRYPTED FILES.TXT","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\{1B31B55F-9B46-8988-6D18-41A7B67F0BD8}\\","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\NOTEPAD\\","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"key":"HKLM\\BCD00000000\\OBJECTS\\{72D3F4C1-B53F-11E4-B6D9-9157CA704B30}\\ELEMENTS\\16000009\\","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"key":"HKLM\\BCD00000000\\OBJECTS\\{72D3F4C1-B53F-11E4-B6D9-9157CA704B30}\\ELEMENTS\\250000E0\\","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\{1B31B55F-9B46-8988-6D18-41A7B67F0BD8}\\TEMP\\TEMP","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{1B31B55F-9B46-8988-6D18-41A7B67F0BD8}","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]},{"name":"{1B31B55F-9B46-8988-6D18-41A7B67F0BD8}","sources":[{"report_type":"sandbox","report_id":"5912cec0aac2edde5ea8085b"}]}]}},"report_ids":{"sandbox_job_ids":["5912cec0aac2edde5ea8085b"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Trojan.Ransom.Amnesia Sample 7e74ecfe0f93… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 7e74ecfe0f93…. Malware family: Trojan.Ransom.Amnesia. Threat score 100/100. 19/27 AV engines flagged this file. 10 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/7e74ecfe0f9389fbfd037ae0eedbbfd9502600490977866850f90146eecad549"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Ransom.Amnesia Sample 7e74ecfe0f93… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 7e74ecfe0f93…. Malware family: Trojan.Ransom.Amnesia. Threat score 100/100. 19/27 AV engines flagged this file. 10 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/7e74ecfe0f9389fbfd037ae0eedbbfd9502600490977866850f90146eecad549"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Ransom.Amnesia Sample 7e74ecfe0f93… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 7e74ecfe0f93…. Malware family: Trojan.Ransom.Amnesia. Threat score 100/100. 19/27 AV engines flagged this file. 10 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L33","11",{}]]