23:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 26:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 22:T4a7,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Cripack.Generic Sample 838f89a2eead… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 838f89a2eead…. Malware family: Trojan.Cripack.Generic. Threat score 100/100. 21/26 AV engines flagged this file. 11 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/838f89a2eead1cfdf066010c6862005cd3ae15cf8dc5190848b564352c412cfa","keywords":["Malicious","Trojan.Cripack.Generic","malware analysis","sandbox report","threat intelligence","838f89a2eead1cfdf066010c6862005cd3ae15cf8dc5190848b564352c412cfa"],"about":{"@type":"SoftwareApplication","name":"vcwlcm.exe","applicationCategory":["peexe","executable"],"identifier":"838f89a2eead1cfdf066010c6862005cd3ae15cf8dc5190848b564352c412cfa","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Cripack.Generic","antivirusDetections":{"malicious":21,"total":26},"behavioralIndicators":{"malicious":11,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T58a,"GET /ip HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022) Host: ipinfo.io" "GET /wp-content/themes/r.php?D0B1745184D4B19325F8CA239D78E8047EA9BB66DCAC3E265F22F6FB4744F963E2D29AE441D21EB8CB70A1C80050943A6DC30E831CAE84CF2CB6C83D44C7670E28B207DF9805D237BCC9D03C917064FEDCB9D7227955B5215F1A6596E44BD7F1B41E5B9C0D5FD60A4CA15DB806D0B311717E95A72AC754B852EBAC256E9F4E90FA936484F8EFC3B06D131B99AE03B8F1E945DFB28498428AD5A7A15F0EED2022FE06498C31965C514DA63F7A7B5DB97F7D17DFA5756AB0DA792A2946879A58A99B47302430558D64B09F64E6FB7B376C45853BBFEC774B7B7A5936980A42E2E1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0 Host: www.micropiso.cl Connection: Keep-Alive" "GET /wp-content/themes/r.php?D0B1745184D4B19325F8CA239D78E8047EA9BB66DCAC3E265F22F6FB4744F963E2D29AE441D21EB8CB70A1C80050943A6DC30E831CAE84CF2CB6C83D44C7670E28B207DF9805D237BCC9D03C917064FEDCB9D7227955B5215F1A6596E44BD7F1B41E5B9C0D5FD60A4CA15DB806D0B3110C60A3B9F33E27D1CBEA2A2FBFB3713E5D54AFFA139F182A95F41E9ED1D6F1721DE88BE1F257917A179787A97B807E9C3542D3389009D0FA139898C828B90B161BD6884D6843B6CF364E0B69EFCABD348FEDA8FD0B7AF0535516364FF5309D7B5C3CB699746AEC6444F07A4BBFD4D0B9 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0 Host: ledshoppen.nl Connection: Keep-Alive"25:T710,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAATgSURBVFhHlVdbTFxFGD67ZznLsstZFrlDd7lfhC1QKFi6FClFDEgQ6CJbwdLUbuUmlVQtXhuNGI21sY009ZIIWDXYEBNjo6ISb220JuAl4cGqDyZ9NcaX+vS5zHGHM2fm7KYnmeyZmX/m/+b7v/8/s5LEP4gxFp0T2USXbc6ZtU2b6BzjxnTjve1TwgULy4tISXFTIN7iQvI+e+dZ/DJ3jazJyfchLTuLvDcXdehBcwegANp6OpnJ91c/pf3gyGHyXlFbwwEOz0yj/eXncLz3FSxc0ACUbq+Ct7iIvA/uOKpfg/a+btTXa/vRpzlwEhMTP8WiV2+Ola8+4myzU/PhducxIVgYWsbK2HcMAEGYJWnm8SfMnBtPzIWluLyE2MyvfIJvLl8h8/3VIXw8uoZtKSQ8xhBs9Q9MHImPToNsavfkC0+he2AW9kQPFNmO/bdNo6N3EuGuMUyNPoCddURLehHy2hqfnIxJvz0z3fwUus1lqw3V+a0o374HTZUBtAR2I79wH1l7sCFM93j10gemYmRibaBPkq0y7PZEIa1y5PSb7f81sFgTIu8WJNjJmNTV9aJ+HQsgxa2lkuBhxrur+rF45r1IGqYYGZFa2+fQ03OOAihomEJici4sNptx762+v2aYdG5JreDjwhYOYldW1kV+naoqCgl1HmVB92uqgZixN4hPUhQnPGkZEXqtonXxABjFzKmbiUCef4g6cblIVTPqg/S9WbVIjTSrrHAAgsF5LB26rM8CPQgOgMgJM7anZZcWAmcSHe9tfRY1kaYkEl2QlptbB3/gBEKTDxmFpwcZFwCHdnPgzNkbSE7OjKmBTcbS8xpRsaPeXPlmlAoyQXKo2xgm9k9f57IgenrZ6WRCYVW0NIz3xDOKN0/Ykh0OlDz8IANAqweS1H3vgAi0hqtp314uDfPLSI0XCii7vJfTS3PrabwUXMSJU2+hoCpEQdgSmDrAaYAASFCogvVMcaCiNOuASf7AY8ROUVSoESE6VTdkm1Ytmw9fQZANl1BX0cFYWcDMnbr4jlADToeKq0t/4eraNYSfWcXuli5UZxMhmvnQZlrZW4uRBZF+hGCtdgWN4WNo8rYQBo4cHUa4kX4NzUFkJeegurKK2TQ9I4OG4Hzfu8ZTUNsh7XaDhsEP0XRwlRGgLmR656LQMpcGeuIkN62A5grW0auqLmz8uYbwDC1AZjqiPmLGp23kPMPKgUMjpO9wEJExT86tQfj9JNVQklaB3u4QXG4VNvZryAEyBVBeeR86ey6SeTlBK70LS/O4tPIPVDdfCdMjOiotJTdg+DyFaLu9E0kuWpSklqI2nJ59E7k+UtToAUwBWCK3G1nmTzr36A0kOZmPk1ncyfiX1zc4tvQAojQKhSGQvx4wky0/rHyPR177F7uGP4OvjlzF9S2uCEWpZjZmBEtA3VM7jNHx8XhZIE7FtMxMeLLKGar6tsppdJHxFEaA1PldwyF8/eM6CgqZazkf7pI0zekbyz/j+MlfRbEiTnJys43UU9tj0xzdCNbcj88nfoPXUwSLxWLcVxjum9UAE39DvCkT/QN3IzRK/3vEDDMHIBi5kl049zZB7/MFjPSZKZvRwBfPf4v11/8mtqrqRX3hHXApydQXucsNPg0U7ByLmUrGE3b8vo6NP9Zvao1xj/8AzMPIEudSIswAAAAASUVORK5CYII=1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"838f89a2eead1cfdf066010c6862005cd3ae15cf8dc5190848b564352c412cfa","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790449230868,"unified_at":"2026-09-26T19:00:30.868Z","metadata":{"hashes":{"sha256":"838f89a2eead1cfdf066010c6862005cd3ae15cf8dc5190848b564352c412cfa","sha1":"352f81f9f7c1dcdb5dbfe9bee0faa82edba043b9","md5":"4321192c28109be890decfa5657fb3b3","sha512":"f9b568278b9466cb111da5ad5d20ba9e7fffbb4d32bf9d005a114a0fb81a464295b1ae324b036b1431bb845367059ebde07611d91633a7a5a5734f509879896c","ssdeep":"6144:+Ef1ZCGSHFayE3eHw7QjHIh372SiJjJ0a3rsJv9j2/1hLn:+Ef7CHgyE3maQjoBSJjJ0ysZ96v","ssdeep_chunks":["6144:+Ef1ZCG","6144:Ef1ZCGS","6144:f1ZCGSH","6144:1ZCGSHF","6144:ZCGSHFa","6144:CGSHFay","6144:GSHFayE","6144:SHFayE3","6144:HFayE3e","6144:FayE3eH","6144:ayE3eHw","6144:yE3eHw7","6144:E3eHw7Q","6144:3eHw7Qj","6144:eHw7QjH","6144:Hw7QjHI","6144:w7QjHIh","6144:7QjHIh3","6144:QjHIh37","6144:jHIh372","6144:HIh372S","6144:Ih372Si","6144:h372SiJ","6144:372SiJj","6144:72SiJjJ","6144:2SiJjJ0","6144:SiJjJ0a","6144:iJjJ0a3","6144:JjJ0a3r","6144:jJ0a3rs","6144:J0a3rsJ","6144:0a3rsJv","6144:a3rsJv9","6144:3rsJv9j","6144:rsJv9j2","6144:sJv9j2/","6144:Jv9j2/1","6144:v9j2/1h","6144:9j2/1hL","6144:j2/1hLn","12288:+Ef1ZCG","12288:Ef1ZCGS","12288:f1ZCGSH","12288:1ZCGSHF","12288:ZCGSHFa","12288:CGSHFay","12288:GSHFayE","12288:SHFayE3","12288:HFayE3e","12288:FayE3eH","12288:ayE3eHw","12288:yE3eHw7","12288:E3eHw7Q","12288:3eHw7Qj","12288:eHw7QjH","12288:Hw7QjHI","12288:w7QjHIh","12288:7QjHIh3","12288:QjHIh37","12288:jHIh372","12288:HIh372S","12288:Ih372Si","12288:h372SiJ","12288:372SiJj","12288:72SiJjJ","12288:2SiJjJ0","12288:SiJjJ0a","12288:iJjJ0a3","12288:JjJ0a3r","12288:jJ0a3rs","12288:J0a3rsJ","12288:0a3rsJv","12288:a3rsJv9","12288:3rsJv9j","12288:rsJv9j2","12288:sJv9j2/","12288:Jv9j2/1","12288:v9j2/1h","12288:9j2/1hL","12288:j2/1hLn","6144:+Ef7CHg","6144:Ef7CHgy","6144:f7CHgyE","6144:7CHgyE3","6144:CHgyE3m","6144:HgyE3ma","6144:gyE3maQ","6144:yE3maQj","6144:E3maQjo","6144:3maQjoB","6144:maQjoBS","6144:aQjoBSJ","6144:QjoBSJj","6144:joBSJjJ","6144:oBSJjJ0","6144:BSJjJ0y","6144:SJjJ0ys","6144:JjJ0ysZ","6144:jJ0ysZ9","6144:J0ysZ96","6144:0ysZ96v"],"imphash":"b37bf8b910b1ecc536af90fee20cd3e7"},"file_info":{"file_name":"vcwlcm.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":355239,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499297611000,"last_seen":1663032602000,"last_multi_scan":1663032602000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":13,"suspicious_count":14,"malicious_count":11,"total":38},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Win-Trojan/Lockycrypt.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/Win32.Bitman","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1219501","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Cripack.Gen.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Cripack.Gen.1 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.DUNX trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Crypt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004d41c61 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"TeslaCrypt!4321192C2810","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Bitman.dvrzxb","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Ransom.TeslaCrypt.WR4","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Tinba-L","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.Bitman.355239","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_CR.21E3277A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_CR.21E3277A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Dropper.PW","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Hoax.Bitman","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Cripack.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts domains","description":"\"ipinfo.io\"\n \"www.micropiso.cl\"\n \"ledshoppen.nl\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"55dcc7520e316da105a73a27"},{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"54.209.122.171:80\"\n \"192.185.171.111:80\"\n \"149.210.193.39:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"55dcc7520e316da105a73a27"},{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys","description":"UnregisterHotKey@USER32.dll at 513-3-004186FA","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-15","sources":[{"report_type":"sandbox","report_id":"55dcc7520e316da105a73a27"},{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$24","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"55dcc7520e316da105a73a27"},{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 54.209.122.171 on port 80 is sent without HTTP header\n TCP traffic to 192.185.171.111 on port 80 is sent without HTTP header\n TCP traffic to 149.210.193.39 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":10,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"55dcc7520e316da105a73a27"},{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"55dcc7520e316da105a73a27"},{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"FindWindowExW\n SetWindowsHookExA\n GetUpdateRgn\n SetKeyboardState\n SetWindowsHookA\n FindWindowA\n GetStartupInfoA\n GetModuleHandleA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"55dcc7520e316da105a73a27"},{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/49 Antivirus vendors marked sample as malicious (6% detection rate)","origin":"External System","relevance":10,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"55dcc7520e316da105a73a27"},{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"level":"malicious","category":"Network Related","name":"Found more than one unique User-Agent","description":"Found the following User-Agents: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)\n Mozilla/5.0 (Windows NT 6.1; rv:31.0) Gecko/20100101 Firefox/31.0","origin":"Network Traffic","relevance":5,"id":"network-15","sources":[{"report_type":"sandbox","report_id":"55dcc7520e316da105a73a27"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"ipinfo.io\"","origin":"Network Traffic","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"55dcc7520e316da105a73a27"},{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop","description":"CreateWindowStationA@USER32.dll at 513-3-004186FA","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-8","sources":[{"report_type":"sandbox","report_id":"55dcc7520e316da105a73a27"},{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 02015500-00002832-77E701AA-2104082","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\ZonesCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\".exe\" loaded module \"SHLWAPI.DLL\" at base 76300000\n \".exe\" loaded module \"PSAPI.DLL\" at base 75DF0000\n \".exe\" loaded module \"NTDLL.DLL\" at base 77E40000\n \".exe\" loaded module \"KERNEL32.DLL\" at base 77850000\n \".exe\" loaded module \"USER32.DLL\" at base 76AB0000\n \".exe\" loaded module \"GDI32.DLL\" at base 766A0000\n \".exe\" loaded module \"ADVAPI32.DLL\" at base 75A70000\n \".exe\" loaded module \"SHELL32.DLL\" at base 76BB0000\n \".exe\" loaded module \"OLE32.DLL\" at base 76450000\n \".exe\" loaded module \"MPR.DLL\" at base 75660000","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"RtlDecompressBuffer@ntdll.dll\"\n \"PathFindFileNameW@SHLWAPI.dll\"\n \"PathFindExtensionW@SHLWAPI.dll\"\n \"GetProcessImageFileNameW@PSAPI.DLL\"\n \"EnumProcesses@PSAPI.DLL\"\n \"_allshl@ntdll.dll\"\n \"_aullshr@ntdll.dll\"\n \"RtlUnwind@ntdll.dll\"\n \"_vsnwprintf@ntdll.dll\"\n \"NtQueryInformationProcess@ntdll.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c del Z:\\838F89~1.EXE >> NUL\" on 2015-08-26.19:51:17","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"vcwpuc.exe\" (UID: 02107015-00002960)\n Spawned process \"cmd.exe\" with commandline \"/c del Z:\\838F89~1.EXE >> NUL\" (UID: 02114390-00001368)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"LookupAccountNameLocalW@SECHOST.DLL at 02015500-00002832-77E701AA-2112912\n GetUserNameExW@SSPICLI.DLL at 02015500-00002832-77E701AA-2114261","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"vcwpuc.exe\" has type \"PE32 executable (GUI) Intel 80386, for MS Windows\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\".exe\" at 02015500-00002832-77E5FDA0-2113010","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\".exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 02015500-00002832-77E701AA-2104094","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"RtlGetVersion@NTDLL.DLL at 02015500-00002832-77E701AA-2103902\n GetVersionExW@KERNEL32.DLL at 02015500-00002832-77E701AA-2103946","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 02015500-00002832-77E701AA-2104044","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\".exe\" read file \"C:\\Users\\PSPUBWS\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\".exe\" created file \"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls\"\n \".exe\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \".exe\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \".exe\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db\"\n \".exe\" created file \"C:\\Windows\\system32\\rsaenh.dll\"\n \".exe\" created file \"C:\\Windows\\system32\\de-DE\\PROPSYS.dll.mui\"\n \".exe\" created file \"C:\\Windows\\system32\\cmd.exe\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"vcwpuc.exe\" has type \"PE32 executable (GUI) Intel 80386, for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\".exe\" opened \"Z:\\838f89a2eead1cfdf066010c6862005cd3ae15cf8dc5190848b564352c412cfa.exe:Zone.Identifier\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\".exe\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-1663702577-2139711211-3687027567-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")\n \".exe\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\", Key: \"00000407\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Tries to hide tracks of having downloaded a file from the internet","description":"\".exe\" opened \"Z:\\838f89a2eead1cfdf066010c6862005cd3ae15cf8dc5190848b564352c412cfa.exe:Zone.Identifier\" with delete access","origin":"API Call","relevance":7,"id":"api-42","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"23/56 Antivirus vendors marked sample as malicious (41% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\".exe\" allocated 00000088 bytes of memory in \"vcwpuc.exe\" (Protection: \"read/write\")\n \".exe\" allocated 00000088 bytes of memory in \"cmd.exe\" (Protection: \"read/write\")","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes a PE file header to disc","description":"\".exe\" wrote 65536 bytes starting with PE header signature to file \"C:\\Users\\PSPUBWS\\AppData\\Roaming\\vcwpuc.exe\": 4d5a90000300000004000000ffff0000b8000000000000004000000000000000000000000000000000000000000000000000 ...","origin":"API Call","relevance":1,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\".exe\" wrote 32 bytes to a foreign process \"vcwpuc.exe\" (PID: 00002960)\n \".exe\" wrote 52 bytes to a foreign process \"vcwpuc.exe\" (PID: 00002960)\n \".exe\" wrote 4 bytes to a foreign process \"vcwpuc.exe\" (PID: 00002960)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"level":"malicious","category":"System Security","name":"Queries/modifies the display settings of system associated file extensions","description":"\".exe\" (Access type: \"QUERYVAL\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\", Key: \"ALWAYSSHOWEXT\")\n \".exe\" (Access type: \"QUERYVAL\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\", Key: \"NEVERSHOWEXT\")","origin":"Registry Access","relevance":7,"id":"registry-28","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtQueryInformationProcess@NTDLL.DLL at 02015500-00002832-77E701AA-2103900\n NtQuerySystemInformation@NTDLL.DLL at 02015500-00002832-77E701AA-2103904","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Tries to identify its external IP address"}],"sources":[{"report_type":"sandbox","report_id":"55dcc7520e316da105a73a27"},{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"name":"Ransomware","details_count":1,"details":[{"detail":"Contains ability to create/switch the desktop"}],"sources":[{"report_type":"sandbox","report_id":"55dcc7520e316da105a73a27"},{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"55dcc7520e316da105a73a27"},{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":44,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":10,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":4,"dns_resolutions_count":3,"contacted_urls_count":5,"http_requests_count":5},"behavior_tags":null,"sample_flags":["Network Traffic","Launch Failed","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"55ddfb140e316df9704a9b8b","environment_id":2,"environment_description":"Windows 7 64 bit (DE)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.GenericKD","contacted_countries":["NLD","USA"],"submit_name":"vcwlcm.exe","analysis_start_time":"2015-08-26T12:46:12+00:00","indicators_count":{"informative":13,"suspicious":20,"malicious":10},"tags":["Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true},{"id":"55dcc7520e316da105a73a27","environment_id":4,"environment_description":"W7 32 bit 'Stealthy Mode'","state":"SUCCESS","verdict":"suspicious","threat_score":35,"malware_family":"HW32.Packed","contacted_countries":["NLD","USA"],"submit_name":"2015-08-25-Angler-EK-payload-TeslaCrypt-2.0.exe","analysis_start_time":"2015-08-25T15:04:07+00:00","indicators_count":{"informative":4,"suspicious":4,"malicious":4},"tags":["Network Traffic","Launch Failed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"54.209.122.171","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55dcc7520e316da105a73a27"}]},{"address":"192.185.171.111","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55dcc7520e316da105a73a27"},{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"address":"149.210.193.39","port":80,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"55dcc7520e316da105a73a27"},{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"address":"209.133.57.122","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]}],"dns_resolutions":[{"domain":"ledshoppen.nl","address":"149.210.193.39","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"55dcc7520e316da105a73a27"},{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"domain":"ipinfo.io","address":"54.209.122.171","country":"United States","sources":[{"report_type":"sandbox","report_id":"55dcc7520e316da105a73a27"},{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"domain":"www.micropiso.cl","address":"192.185.171.111","country":"United States","sources":[{"report_type":"sandbox","report_id":"55dcc7520e316da105a73a27"},{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]}],"http_requests":[{"host":"ipinfo.io","host_ip":"54.209.122.171:80","url":"/ip","method":"GET","sources":[{"report_type":"sandbox","report_id":"55dcc7520e316da105a73a27"}]},{"host":"www.micropiso.cl","host_ip":"192.185.171.111:80","url":"/wp-content/themes/r.php?D0B1745184D4B19325F8CA239D78E8047EA9BB66DCAC3E265F22F6FB4744F963E2D29AE441D21EB8CB70A1C80050943A6DC30E831CAE84CF2CB6C83D44C7670E28B207DF9805D237BCC9D03C917064FEDCB9D7227955B5215F1A6596E44BD7F1B41E5B9C0D5FD60A4CA15DB806D0B311717E95A72AC754B852EBAC256E9F4E90FA936484F8EFC3B06D131B99AE03B8F1E945DFB28498428AD5A7A15F0EED2022FE06498C31965C514DA63F7A7B5DB97F7D17DFA5756AB0DA792A2946879A58A99B47302430558D64B09F64E6FB7B376C45853BBFEC774B7B7A5936980A42E2E1","method":"GET","sources":[{"report_type":"sandbox","report_id":"55dcc7520e316da105a73a27"}]},{"host":"ledshoppen.nl","host_ip":"149.210.193.39:80","url":"/wp-content/themes/r.php?D0B1745184D4B19325F8CA239D78E8047EA9BB66DCAC3E265F22F6FB4744F963E2D29AE441D21EB8CB70A1C80050943A6DC30E831CAE84CF2CB6C83D44C7670E28B207DF9805D237BCC9D03C917064FEDCB9D7227955B5215F1A6596E44BD7F1B41E5B9C0D5FD60A4CA15DB806D0B3110C60A3B9F33E27D1CBEA2A2FBFB3713E5D54AFFA139F182A95F41E9ED1D6F1721DE88BE1F257917A179787A97B807E9C3542D3389009D0FA139898C828B90B161BD6884D6843B6CF364E0B69EFCABD348FEDA8FD0B7AF0535516364FF5309D7B5C3CB699746AEC6444F07A4BBFD4D0B9","method":"GET","sources":[{"report_type":"sandbox","report_id":"55dcc7520e316da105a73a27"}]},{"host":"www.micropiso.cl","host_ip":"192.185.171.111:80","url":"/wp-content/themes/r.php?D0B1745184D4B19325F8CA239D78E8047A0E782307A0122134F4FFA7B7B79EB842AF53569FCD0A0C1B7994EAAB0288195D66F5C225A8C27149BD390D0B4235CA7B7BA2F6A25AF1D56DF19C30F5AD42D060AC305CD191B54B33BF590BA80FC9585B997183AC9B3C3BCD2DD1F59B954AC95489D65841B7E44BC0F19338B85A424FA68936886C633AC2CBE7E1EBF1B3E48FB78CD73ACAE7D6797C156856736E5C0A604380B76E8F148778A042FA0F5CDF65283EF716ED3D89469632E7412B3F0E052A7535AE9FF4DB1C1B359819C55DEB776068844FD9C6063A10D18BD81BC4BA38","method":"GET","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"host":"ledshoppen.nl","host_ip":"149.210.193.39:80","url":"/wp-content/themes/r.php?D0B1745184D4B19325F8CA239D78E8047A0E782307A0122134F4FFA7B7B79EB842AF53569FCD0A0C1B7994EAAB0288195D66F5C225A8C27149BD390D0B4235CA7B7BA2F6A25AF1D56DF19C30F5AD42D060AC305CD191B54B33BF590BA80FC9585B997183AC9B3C3BCD2DD1F59B954AC95489D65841B7E44BC0F19338B85A424FA68936886C633AC2CBE7E1EBF1B3E48FB78CD73ACAE7D6797C156856736E5C0A3AA6907B01EC33DA9A89D94E6DF9AABDA118441C5C2AD43F5EAA06D55B1B4C4473A3DBB815D1AA32F4839D0D1CE79836","method":"GET","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}],"processes":[{"pid":2832,"ppid":0,"name":"838f89a2eead1cfdf066010c6862005cd3ae15cf8dc5190848b564352c412cfa.exe","command_line":"","normalized_path":"","uid":"02015500-00002832","icon":"$25"},{"pid":2960,"ppid":0,"name":"vcwpuc.exe","command_line":"","normalized_path":"","uid":"02107015-00002960"},{"pid":1368,"ppid":0,"name":"cmd.exe","command_line":"/c del Z:\\838F89~1.EXE >> NUL","normalized_path":"","uid":"02114390-00001368"}],"all_imported_dlls":["PROPSYS.dll","RpcRtRemote.dll","SHELL32.dll","NETAPI32.DLL","ieframe.dll","MSCTF.dll","comctl32.dll","rsaenh.dll","urlmon.dll","sfc.dll","KERNELBASE.dll","CFGMGR32.dll","SHLWAPI.dll","USER32.dll","quartz.dll","WINBRAND.dll","PSAPI.DLL","uxtheme.dll","CRYPTSP.dll","apphelp.dll","RPCRT4.dll","USP10.dll","SspiCli.dll","CLBCatQ.DLL","qcap.dll","ntmarta.dll","MPR.dll","dwmapi.dll","sechost.dll","CRYPTBASE.dll","msvcrt.dll","DEVOBJ.dll","ole32.dll","LPK.dll","SETUPAPI.dll","IMM32.DLL","VERSION.dll","GDI32.dll","kernel32.dll","profapi.dll","ADVAPI32.dll","ntdll.dll","WININET.dll","OLEAUT32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"vcwpuc.exe","sha256":"838f89a2eead1cfdf066010c6862005cd3ae15cf8dc5190848b564352c412cfa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"path":"%APPDATA%\\838f89a2eead1cfdf066010c6862005cd3ae15cf8dc5190848b564352c412cfa.exe","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"path":"%APPDATA%\\vcwpuc.exe","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"path":"%WINDIR%\\system32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"path":"%WINDIR%\\system32\\de-DE\\PROPSYS.dll.mui","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"path":"%WINDIR%\\system32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"55ddfb140e316df9704a9b8b"}]}]}},"report_ids":{"sandbox_job_ids":["55ddfb140e316df9704a9b8b","55dcc7520e316da105a73a27"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious Trojan.Cripack.Generic Sample 838f89a2eead… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 838f89a2eead…. Malware family: Trojan.Cripack.Generic. Threat score 100/100. 21/26 AV engines flagged this file. 11 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/838f89a2eead1cfdf066010c6862005cd3ae15cf8dc5190848b564352c412cfa"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Cripack.Generic Sample 838f89a2eead… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 838f89a2eead…. Malware family: Trojan.Cripack.Generic. Threat score 100/100. 21/26 AV engines flagged this file. 11 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/838f89a2eead1cfdf066010c6862005cd3ae15cf8dc5190848b564352c412cfa"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Cripack.Generic Sample 838f89a2eead… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 838f89a2eead…. Malware family: Trojan.Cripack.Generic. Threat score 100/100. 21/26 AV engines flagged this file. 11 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L26","11",{}]]