26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2e:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T487,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 83b8ea93ed00… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 83b8ea93ed00…. Malware family: Trojan.Generic. Threat score 100/100. 23/26 AV engines flagged this file. 7 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/83b8ea93ed00a673c5c032696525b50a745d670bfefd2e266543ddb32bc57c6f","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","83b8ea93ed00a673c5c032696525b50a745d670bfefd2e266543ddb32bc57c6f"],"about":{"@type":"SoftwareApplication","name":"expiorer.exe","applicationCategory":["peexe","executable"],"identifier":"83b8ea93ed00a673c5c032696525b50a745d670bfefd2e266543ddb32bc57c6f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":23,"total":26},"behavioralIndicators":{"malicious":7,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T6cc,"" queries volume information of "C:\" at 00007234-00000940-00000046-831592764 "" queries volume information of "C:\" at 00007234-00000940-00000046-849590788 "" queries volume information of "C:\" at 00007234-00000940-00000046-1401551293 "" queries volume information of "C:\" at 00007234-00000940-00000046-7283336876 "" queries volume information of "C:\" at 00007234-00000940-00000046-7445922246 "" queries volume information of "C:\" at 00007234-00000940-00000046-7457245070 "mshta.exe" queries volume information of "C:\Windows\Fonts\tahomabd.ttf" at 00017639-00002352-00000046-308435482307 "mshta.exe" queries volume information of "C:\Windows\Fonts\tahomabd.ttf" at 00017639-00002352-00000046-308517500248 "mshta.exe" queries volume information of "C:\Windows\Fonts\tahoma.ttf" at 00017639-00002352-00000046-308558397098 "mshta.exe" queries volume information of "C:\Windows\Fonts\tahoma.ttf" at 00017639-00002352-00000046-308575766048 "mshta.exe" queries volume information of "C:\Windows\Fonts\wingding.ttf" at 00017639-00002352-00000046-309017886112 "mshta.exe" queries volume information of "C:\Windows\Fonts\wingding.ttf" at 00017639-00002352-00000046-309027462700 "mshta.exe" queries volume information of "C:\Windows\Fonts\tahomabd.ttf" at 00017648-00000608-00000046-303741708861 "mshta.exe" queries volume information of "C:\Windows\Fonts\tahoma.ttf" at 00017648-00000608-00000046-303768780685 "mshta.exe" queries volume information of "C:\Windows\Fonts\wingding.ttf" at 00017648-00000608-00000046-303953105808 "mshta.exe" queries volume information of "C:\Windows\Fonts\wingding.ttf" at 00017648-00000608-00000046-41475794057528:T464,"vssadmin.exe" touched "VSSCoordinator Class" (Path: "HKCU\CLSID\{E579AB5F-1CC4-44B4-BED9-DE0991FF0623}") "vssadmin.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{F2C2787D-95AB-40D4-942D-298F5F757874}") "mshta.exe" touched "HTML Document" (Path: "HKCU\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\INPROCSERVER32") "mshta.exe" touched "Microsoft HTA Document 6.0" (Path: "HKCU\CLSID\{3050F5C8-98B5-11CF-BB82-00AA00BDCE0B}") "mshta.exe" touched "Microsoft HTML About Pluggable Protocol" (Path: "HKCU\CLSID\{3050F406-98B5-11CF-BB82-00AA00BDCE0B}") "mshta.exe" touched "Multi Language Support" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}") "mshta.exe" touched "CActiveIMMAppEx_Trident" (Path: "HKCU\CLSID\{50D5107A-D278-4871-8989-F4CEAAF59CFC}\TREATAS") "mshta.exe" touched "PSOAInterface" (Path: "HKCU\CLSID\{00020424-0000-0000-C000-000000000046}\TREATAS") "mshta.exe" touched "JScript Language" (Path: "HKCU\CLSID\{16D51579-A30B-4C8B-A276-0FF4DC41E755}\TREATAS") "mshta.exe" touched "Microsoft Url History Service" (Path: "HKCU\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\TREATAS")29:T5fd,"am_get.svg.id-5FC07DB9._madbad@foxmail.com_.usa" has type "data" "media-agof-tracking-min_1_.js.id-5FC07DB9._madbad@foxmail.com_.usa" has type "data" "dictionary.azaire.id-5FC07DB9._madbad@foxmail.com_.usa" has type "data" "5ROIEMK0.txt.id-5FC07DB9._madbad@foxmail.com_.usa" has type "data" "PDIR35F.GIF.id-5FC07DB9._madbad@foxmail.com_.usa" has type "data" "cursors.properties.id-5FC07DB9._madbad@foxmail.com_.usa" has type "data" "I2A3ERK1.txt.id-5FC07DB9._madbad@foxmail.com_.usa" has type "data" "J0152702.WMF.id-5FC07DB9._madbad@foxmail.com_.usa" has type "data" "ss125047522_1_.js.id-5FC07DB9._madbad@foxmail.com_.usa" has type "data" "YAHOO.COM.XML.id-5FC07DB9._madbad@foxmail.com_.usa" has type "data" "UseAProgressBarToTrackIterations.snippet.id-5FC07DB9._madbad@foxmail.com_.usa" has type "Sendmail frozen configuration - version I\243\344\006\331\345\333" "AN04323_.WMF.id-5FC07DB9._madbad@foxmail.com_.usa" has type "data" "com-sun-tools-visualvm-modules-startup_ja.jar.id-5FC07DB9._madbad@foxmail.com_.usa" has type "data" "wxpr.dll.id-5FC07DB9._madbad@foxmail.com_.usa" has type "data" "MSOHTMED.EXE.id-5FC07DB9._madbad@foxmail.com_.usa" has type "data" "OLNOTER.FAE.id-5FC07DB9._madbad@foxmail.com_.usa" has type "data" "main.css.id-5FC07DB9._madbad@foxmail.com_.usa" has type "data" "login.58746981_1_.css.id-5FC07DB9._madbad@foxmail.com_.usa" has type "data" "ZX______.PFB.id-5FC07DB9._madbad@foxmail.com_.usa" has type "data" "ui-strings.js.id-5FC07DB9._madbad@foxmail.com_.usa" has type "data"2a:T4af,"" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\System32\expiorer.exe" "" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\expiorer.exe" "" touched file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\expiorer.exe" "" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\expiorer.exe" "" touched file "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\expiorer.exe" "cmd.exe" touched file "C:\Windows\Branding\Basebrd\basebrd.dll" "cmd.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "cmd.exe" touched file "C:\Windows\AppPatch\AppPatch64\sysmain.sdb" "mode.com" touched file "C:\Windows\System32\en-US\ulib.dll.mui" "vssadmin.exe" touched file "C:\Windows\System32\en-US\vssadmin.exe.mui" "vssadmin.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "vssadmin.exe" touched file "C:\Windows\System32\rsaenh.dll" "mshta.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat"2b:T4be,"" opened "C:\$Recycle.Bin\S-1-5-21-686412048-2446563785-1323799475-1001\desktop.ini" with delete access "" opened "C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\OWOW32WW.cab" with delete access "" opened "C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.msi" with delete access "" opened "C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\ose.exe" with delete access "" opened "C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\ProPlusWW.xml" with delete access2c:T962,"" wrote bytes "2212a1767749a1763611a176e618a1769022bb77c011a176d022bb771e11a176e013a17600000000" to virtual address "0x0040B000" (part of module "EXPIORER.EXE") "" wrote bytes "b4360200" to virtual address "0x75454EA4" (part of module "SSPICLI.DLL") "" wrote bytes "b4364575" to virtual address "0x754601E4" (part of module "SSPICLI.DLL") "" wrote bytes "d83a4575" to virtual address "0x754601E0" (part of module "SSPICLI.DLL") "" wrote bytes "b4364575" to virtual address "0x75460200" (part of module "SSPICLI.DLL") "" wrote bytes "b4360200" to virtual address "0x75454D68" (part of module "SSPICLI.DLL") "" wrote bytes "60122475" to virtual address "0x768AE324" (part of module "WININET.DLL") "" wrote bytes "b8c0152475ffe0" to virtual address "0x754536B4" (part of module "SSPICLI.DLL") "" wrote bytes "d83a4575" to virtual address "0x75460274" (part of module "SSPICLI.DLL") "" wrote bytes "c0dfbb771cf9ba77ccf8ba770d64bc7700000000c011a17600000000fc3ea17600000000e013a176000000009457f07625e0bb77c6e0bb7700000000bc6aef7600000000cf31a176000000009319f076000000002c32a17600000000" to virtual address "0x77141000" (part of module "NSI.DLL") "" wrote bytes "711130017a3b2f01ab8b02007f950200fc8c0200729602006cc805001ecd2c017d262c01" to virtual address "0x769107E4" (part of module "USER32.DLL") "" wrote bytes "b830122475ffe0" to virtual address "0x76BF1368" (part of module "WS2_32.DLL") "" wrote bytes "b4364575" to virtual address "0x7546025C" (part of module "SSPICLI.DLL") "" wrote bytes "d83a4575" to virtual address "0x754601FC" (part of module "SSPICLI.DLL") "" wrote bytes "b840132475ffe0" to virtual address "0x75453AD8" (part of module "SSPICLI.DLL") "" wrote bytes "d83a0200" to virtual address "0x75454E38" (part of module "SSPICLI.DLL") "" wrote bytes "d83a0200" to virtual address "0x75454D78" (part of module "SSPICLI.DLL") "" wrote bytes "d83a4575" to virtual address "0x75460258" (part of module "SSPICLI.DLL") "" wrote bytes "b4364575" to virtual address "0x75460278" (part of module "SSPICLI.DLL") "" wrote bytes "68130000" to virtual address "0x76BF1680" (part of module "WS2_32.DLL")2d:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"83b8ea93ed00a673c5c032696525b50a745d670bfefd2e266543ddb32bc57c6f","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790442279512,"unified_at":"2026-09-26T17:04:39.512Z","metadata":{"hashes":{"sha256":"83b8ea93ed00a673c5c032696525b50a745d670bfefd2e266543ddb32bc57c6f","sha1":"57cdd4e738d6ec3d0d56d22db19029fc7544c748","md5":"deb972e6446df21f6f9b7d148fe1076d","sha512":"de1ba670df05b9f53052ea40beb3963e3769461b83ca8b84b64026b314195d6bf2103d69c933b46ebc5f456718ae323a63129f5c884387abda39fdac1a862253","ssdeep":"1536:mBwl+KXpsqN5vlwWYyhY9S4AqzNvsvaOH7//rUX17JfmNEPWoFN8dt:Qw+asqN5aW/hLMzNvmT/rUX17JpWG","ssdeep_chunks":["1536:mBwl+KX","1536:Bwl+KXp","1536:wl+KXps","1536:l+KXpsq","1536:+KXpsqN","1536:KXpsqN5","1536:XpsqN5v","1536:psqN5vl","1536:sqN5vlw","1536:qN5vlwW","1536:N5vlwWY","1536:5vlwWYy","1536:vlwWYyh","1536:lwWYyhY","1536:wWYyhY9","1536:WYyhY9S","1536:YyhY9S4","1536:yhY9S4A","1536:hY9S4Aq","1536:Y9S4Aqz","1536:9S4AqzN","1536:S4AqzNv","1536:4AqzNvs","1536:AqzNvsv","1536:qzNvsva","1536:zNvsvaO","1536:NvsvaOH","1536:vsvaOH7","1536:svaOH7/","1536:vaOH7//","1536:aOH7//r","1536:OH7//rU","1536:H7//rUX","1536:7//rUX1","1536://rUX17","1536:/rUX17J","1536:rUX17Jf","1536:UX17Jfm","1536:X17JfmN","1536:17JfmNE","1536:7JfmNEP","1536:JfmNEPW","1536:fmNEPWo","1536:mNEPWoF","1536:NEPWoFN","1536:EPWoFN8","1536:PWoFN8d","1536:WoFN8dt","3072:mBwl+KX","3072:Bwl+KXp","3072:wl+KXps","3072:l+KXpsq","3072:+KXpsqN","3072:KXpsqN5","3072:XpsqN5v","3072:psqN5vl","3072:sqN5vlw","3072:qN5vlwW","3072:N5vlwWY","3072:5vlwWYy","3072:vlwWYyh","3072:lwWYyhY","3072:wWYyhY9","3072:WYyhY9S","3072:YyhY9S4","3072:yhY9S4A","3072:hY9S4Aq","3072:Y9S4Aqz","3072:9S4AqzN","3072:S4AqzNv","3072:4AqzNvs","3072:AqzNvsv","3072:qzNvsva","3072:zNvsvaO","3072:NvsvaOH","3072:vsvaOH7","3072:svaOH7/","3072:vaOH7//","3072:aOH7//r","3072:OH7//rU","3072:H7//rUX","3072:7//rUX1","3072://rUX17","3072:/rUX17J","3072:rUX17Jf","3072:UX17Jfm","3072:X17JfmN","3072:17JfmNE","3072:7JfmNEP","3072:JfmNEPW","3072:fmNEPWo","3072:mNEPWoF","3072:NEPWoFN","3072:EPWoFN8","3072:PWoFN8d","3072:WoFN8dt","1536:Qw+asqN","1536:w+asqN5","1536:+asqN5a","1536:asqN5aW","1536:sqN5aW/","1536:qN5aW/h","1536:N5aW/hL","1536:5aW/hLM","1536:aW/hLMz","1536:W/hLMzN","1536:/hLMzNv","1536:hLMzNvm","1536:LMzNvmT","1536:MzNvmT/","1536:zNvmT/r","1536:NvmT/rU","1536:vmT/rUX","1536:mT/rUX1","1536:T/rUX17","1536:rUX17Jp","1536:UX17JpW","1536:X17JpWG"],"imphash":"f86dec4a80961955a89e7ed62046cc0e"},"file_info":{"file_name":"expiorer.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":94720,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1549143458000,"last_seen":1639649592000,"last_multi_scan":1639649592000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["crysis","dharmaransomware","mofksys","nemreq","neshta","ransomware","troldesh","wadhrama","dharma"]},"stats":{"av":{"malicious_count":23,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":10},"sandbox_signatures":{"informative_count":14,"suspicious_count":17,"malicious_count":7,"total":38},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Crusis.tqMs","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Crysis","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.AGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Dropper.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.Crysis.E","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.Crysis.D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Trojan.ILHO-9216","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.Crysis.E (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Filecoder.Crysis.P trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/Crysis.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Crysis","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 00519f781 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Crusis.to","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Ransom-Dharma!DEB972E6446D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Filecoder.emdnxn","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Ransom.Crysis.A3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Threat-Generic://Malicious-Confidence_98","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Criakl-G","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Ransom/W32.Dharma.94720","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom.71377523","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom.71377523","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanRansom.Crusis","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Service Execution","attack_id":"T1035","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","identifiers":[{"type":"suspicious","value":"Opened the service control manager"}],"sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Start Folder","attack_id":"T1060","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1060","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"suspicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","identifiers":[{"type":"malicious","value":"Deletes volume snapshots (often used by ransomware)"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","identifiers":[{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"suspicious","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1057","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00007466-00002596-45023-16--00A9A7FA\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00017627-00003408-49763-16--000DA7FA","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$27","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"\" queries volume information of \"C:\\\" at 00007234-00000940-00000046-831592764\n \"\" queries volume information of \"C:\\\" at 00007234-00000940-00000046-849590788\n \"\" queries volume information of \"C:\\\" at 00007234-00000940-00000046-1401551293\n \"\" queries volume information of \"C:\\\" at 00007234-00000940-00000046-7283336876\n \"\" queries volume information of \"C:\\\" at 00007234-00000940-00000046-7445922246\n \"\" queries volume information of \"C:\\\" at 00007234-00000940-00000046-7457245070","origin":"API Call","mitre_attack_id":"T1120","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\")\n \"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\"; Key: \"PATH\"; Value: \"00000000010000005800000043003A005C00500072006F006700720061006D002000460069006C00650073005C004D006900630072006F0073006F006600740020004F00660066006900630065005C004F0066006600690063006500310034005C000000\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\crysis\\Release\\PDB\\payload.pdb\"\n \"mode.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Global\\syncronize_Z54RDIA\"\n \"Global\\syncronize_Z54RDIU\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\syncronize_Z54RDIA\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\syncronize_Z54RDIU\"\n \"\\Sessions\\1\\BaseNamedObjects\\!IECompat!Mutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\MSIMGSIZECacheMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$28","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"cmd.exe\" (UID: 00007460-00002460) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"\n Process \"mode.com\" (UID: 00007466-00002596) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"\n Process \"mode.com\" (UID: 00007466-00002596) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"\n Process \"cmd.exe\" (UID: 00017620-00000492) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"cmd.exe\" (UID: 00017620-00000492) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"\n Process \"mode.com\" (UID: 00017627-00003408) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"\n Process \"mode.com\" (UID: 00017627-00003408) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" (UID: 00007460-00002460)\n Spawned process \"mode.com\" with commandline \"mode con cp select=1251\" (UID: 00007466-00002596)\n Spawned process \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00007835-00002092)\n Spawned process \"cmd.exe\" (UID: 00017620-00000492)\n Spawned process \"mode.com\" with commandline \"mode con cp select=1251\" (UID: 00017627-00003408)\n Spawned process \"mshta.exe\" with commandline \"\"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Info.ht ...\" (UID: 00017639-00002352), Spawned process \"mshta.exe\" with commandline \"\"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup ...\" (UID: 00017648-00000608)\n Spawned process \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00017955-00003732)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"cmd.exe\" (UID: 00007460-00002460)\n Spawned process \"mode.com\" with commandline \"mode con cp select=1251\" (UID: 00007466-00002596)\n Spawned process \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00007835-00002092)\n Spawned process \"cmd.exe\" (UID: 00017620-00000492)\n Spawned process \"mode.com\" with commandline \"mode con cp select=1251\" (UID: 00017627-00003408)\n Spawned process \"mshta.exe\" with commandline \"\"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Info.ht ...\" (UID: 00017639-00002352), Spawned process \"mshta.exe\" with commandline \"\"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup ...\" (UID: 00017648-00000608)\n Spawned process \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00017955-00003732)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"mode.com\" connecting to \"\\ThemeApiPort\"\n \"mshta.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$29","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$2a","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"vssadmin.exe\" opened \"\\Device\\KsecDD\"\n \"mshta.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"mshta.exe\" is protecting memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rdata\n .data with unusual entropies 7.78504061339\n 7.98358460608","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to measure performance","description":"rdtsc at 00007234-00000940-35533-120-004053B0","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-6","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"mshta.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_ENUMERATE_SERVICE\" (0x4)","origin":"API Call","mitre_attack_id":"T1035","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"C:\\$Recycle.Bin\\S-1-5-21-686412048-2446563785-1323799475-1001\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"EXPIORER.EXE\"; Value: \"%WINDIR%\\System32\\expiorer.exe\")","origin":"Registry Access","mitre_attack_id":"T1060","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"cmd.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\mode.com\" (Handle: 84)\n \"cmd.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\mode.com\" (Handle: 84)\n \"cmd.exe\" wrote 8 bytes to a remote process \"%WINDIR%\\System32\\mode.com\" (Handle: 84)\n \"cmd.exe\" wrote 8 bytes to a remote process \"%WINDIR%\\System32\\vssadmin.exe\" (Handle: 80)\n \"cmd.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\vssadmin.exe\" (Handle: 80)\n \"cmd.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\vssadmin.exe\" (Handle: 80)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 2000 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\expiorer.exe\" marked \"C:\\$Recycle.Bin\\S-1-5-21-686412048-2446563785-1323799475-1001\\desktop.ini\" for deletion\n \"C:\\expiorer.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml\" for deletion\n \"C:\\expiorer.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml\" for deletion\n \"C:\\expiorer.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml\" for deletion\n \"C:\\expiorer.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe\" for deletion\n \"C:\\expiorer.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml\" for deletion\n \"C:\\expiorer.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml\" for deletion","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$2b","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"mshta.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"mshta.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetProcAddress\n LoadLibraryA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2c","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"mode.com\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"mshta.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"55/70 Antivirus vendors marked sample as malicious (78% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"55/70 Antivirus vendors marked sample as malicious (78% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"dharma_ransomware\" classified file \"expiorer.exe.bin\" as \"dharma,crysis,ransomware\" based on indicators: \"C:\\crysis\\Release\\PDB\\payload.pdb\" (Author: Marc Rivero | Hybrid Analysis)","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00007835-00002092)\n Deletes volume snapshots files \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00017955-00003732)","origin":"Monitored Target","mitre_attack_id":"T1107","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"level":"malicious","category":"Ransomware/Banking","name":"The analysis extracted a known ransomware file","description":"Found dropped filename \"_ReadMe_.txt.id-5FC07DB9._madbad@foxmail.com_.usa\" which has been seen in the context of ransomware (Indicator: README_.txt)","origin":"Binary File","relevance":5,"id":"binary-9","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"mshta.exe\" checked file \"C:\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00007234-00000940)\n Spawned process \"cmd.exe\" (UID: 00007460-00002460)\n Spawned process \"mode.com\" with commandline \"mode con cp select=1251\" (UID: 00007466-00002596)\n Spawned process \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00007835-00002092)\n Spawned process \"cmd.exe\" (UID: 00017620-00000492)\n Spawned process \"mode.com\" with commandline \"mode con cp select=1251\" (UID: 00017627-00003408)\n Spawned process \"mshta.exe\" with commandline \"\"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Info.hta\"\" (UID: 00017639-00002352)\n Spawned process \"mshta.exe\" with commandline \"\"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Info.hta\"\" (UID: 00017648-00000608)\n Spawned process \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00017955-00003732)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]}],"incidents":[{"name":"Ransomware","details_count":2,"details":[{"detail":"The analysis extracted a known ransomware file"},{"detail":"Deletes volume snapshots (often used by ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Deletes volume snapshots (often used by ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries process information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Reads the active computer name"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]}]},"activity":{"stats":{"process_count":9,"spawned_processes_count":9,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":12,"imported_dlls_count":99,"dropped_files_count":0,"extracted_files_count":20,"files_written_count":44,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":6,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["crysis","dharmaransomware","mofksys","nemreq","neshta","ransomware","troldesh","wadhrama","dharma"],"sample_flags":["Multi-Process","Extracted Files","TOR analysis"],"sandbox_reports":[{"id":"5c560da17ca3e17ccd32c335","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Ransom.Crysis","submit_name":"expiorer.exe","analysis_start_time":"2019-02-02T22:50:16+00:00","indicators_count":{"informative":14,"suspicious":23,"malicious":9},"tags":["Multi-Process","Extracted Files","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}],"processes":[{"pid":940,"ppid":0,"name":"expiorer.exe","command_line":"","sha256":"83b8ea93ed00a673c5c032696525b50a745d670bfefd2e266543ddb32bc57c6f","normalized_path":"C:\\expiorer.exe","uid":"00007234-00000940","icon":"$2d"},{"pid":2460,"ppid":940,"name":"cmd.exe","command_line":"","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00007234-00000940","uid":"00007460-00002460"},{"pid":2596,"ppid":2460,"name":"mode.com","command_line":"mode con cp select=1251","sha256":"64ad2057863172cbfef4328bc57be134f956a7736e87eb90b04f2be391bca517","normalized_path":"%WINDIR%\\System32\\mode.com","parent_uid":"00007460-00002460","uid":"00007466-00002596"},{"pid":2092,"ppid":2460,"name":"vssadmin.exe","command_line":"vssadmin delete shadows /all /quiet","sha256":"4de7fa20e3224382d8c4a81017e5bdd4673afbef9c0f017e203d7b78977fbf8c","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","parent_uid":"00007460-00002460","uid":"00007835-00002092"},{"pid":492,"ppid":940,"name":"cmd.exe","command_line":"","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00007234-00000940","uid":"00017620-00000492"},{"pid":3408,"ppid":492,"name":"mode.com","command_line":"mode con cp select=1251","sha256":"64ad2057863172cbfef4328bc57be134f956a7736e87eb90b04f2be391bca517","normalized_path":"%WINDIR%\\System32\\mode.com","parent_uid":"00017620-00000492","uid":"00017627-00003408"},{"pid":3732,"ppid":492,"name":"vssadmin.exe","command_line":"vssadmin delete shadows /all /quiet","sha256":"4de7fa20e3224382d8c4a81017e5bdd4673afbef9c0f017e203d7b78977fbf8c","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","parent_uid":"00017620-00000492","uid":"00017955-00003732"},{"pid":2352,"ppid":940,"name":"mshta.exe","command_line":"\"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Info.hta\"","sha256":"8c10ae4be93834a4c744f27ca79736d9123ed9b0d180db28556d2d002545baf2","normalized_path":"%WINDIR%\\System32\\mshta.exe","parent_uid":"00007234-00000940","uid":"00017639-00002352"},{"pid":608,"ppid":940,"name":"mshta.exe","command_line":"\"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Info.hta\"","sha256":"8c10ae4be93834a4c744f27ca79736d9123ed9b0d180db28556d2d002545baf2","normalized_path":"%WINDIR%\\System32\\mshta.exe","parent_uid":"00007234-00000940","uid":"00017648-00000608"}],"all_imported_dlls":["msctf.dll","normaliz.dll","devobj.dll","winbrand.dll","basebrd.dll","oleaccrc.dll","ws2_32.dll","drprov.dll","msvcrt.dll","uxtheme.dll","propsys.dll","profapi.dll","secur32.dll","msvcr100.dll","ntdll.dll","gdi32.dll","d2d1.dll","DWrite.dll","WindowsCodecs.dll","api-ms-win-downlevel-version-l1-1-0.dll","setupapi.dll","cfgmgr32.dll","apphelp.dll","wkscli.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","iertutil.dll","wininet.dll","ulib.dll","version.dll","shell32.dll","nsi.dll","cryptbase.dll","ole32.dll","oleaut32.dll","mshtml.dll","lpk.dll","usp10.dll","comctl32.dll","ieframe.dll","wow64.dll","dwmapi.dll","d3d11.dll","mpr.dll","vsstrace.dll","rsaenh.dll","RpcRtRemote.dll","webio.dll","msimtf.dll","wintrust.dll","shlwapi.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","atl.dll","mlang.dll","d3d10warp.dll","cscapi.dll","wow64win.dll","rpcrt4.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","vssapi.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","netutils.dll","userenv.dll","sfc.dll","cryptsp.dll","oleacc.dll","IPHLPAPI.DLL","winnsi.dll","crypt32.dll","rpcss.dll","api-ms-win-downlevel-user32-l1-1-0.dll","sxs.dll","dxgi.dll","msls31.dll","browcli.dll","wow64cpu.dll","user32.dll","KernelBase.dll","advapi32.dll","clbcatq.dll","winhttp.dll","mswsock.dll","imm32.dll","sspicli.dll","davhlpr.dll","kernel32.dll","wship6.dll","sechost.dll","winsta.dll","ntlanman.dll","davclnt.dll","urlmon.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","ureg.dll","vss_ps.dll","VxSSL64.dll","msasn1.dll","jscript9.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"am_get.svg.id-5FC07DB9._madbad@foxmail.com_.usa","sha256":"baa271f4e80a6980c76da975fe55936f2af65d85448aed90b36d58a8d15cdb04","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"name":"media-agof-tracking-min_1_.js.id-5FC07DB9._madbad@foxmail.com_.usa","sha256":"d2e6cd4371fcb761178d50ff3847cca1b0efd42397c372baa73eb111c1ed66c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"name":"dictionary.azaire.id-5FC07DB9._madbad@foxmail.com_.usa","sha256":"d10f1541294a6d38aa9892a9d5c39089da6e7cb7adad5d7caf378866092b141f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"name":"5ROIEMK0.txt.id-5FC07DB9._madbad@foxmail.com_.usa","sha256":"4ff68cf23a1026b5d9fe7f75947ccfdad2462a9cce5135fc0ccd4515e78e08f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"name":"PDIR35F.GIF.id-5FC07DB9._madbad@foxmail.com_.usa","sha256":"27549553bbea55ade50333e8ca2113da391c2308753cfd2ddae8abcec4ae8581","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"name":"cursors.properties.id-5FC07DB9._madbad@foxmail.com_.usa","sha256":"812572ac39395f552d0bb17a90b9735b596e126859e45e9e4743bd2f9b2b65ac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"name":"I2A3ERK1.txt.id-5FC07DB9._madbad@foxmail.com_.usa","sha256":"7a5e86ca5bd0e9fb91cf9f45d1dfcd057a84deaefc6a751c97d867d2582ddc10","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"name":"J0152702.WMF.id-5FC07DB9._madbad@foxmail.com_.usa","sha256":"85d906102f28c2ff40b7b250f5334c23874cbef9989ca086a00a31c4e05c911b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"name":"ss125047522_1_.js.id-5FC07DB9._madbad@foxmail.com_.usa","sha256":"cecbab8ea41e56fbd48c8c134eabdcb1a6ac305839f6287c3b181f173340f182","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"name":"YAHOO.COM.XML.id-5FC07DB9._madbad@foxmail.com_.usa","sha256":"c22e045fdd2b4027a59429efcbf59ef65133dd4a3418871ce15d010f85348c4b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"name":"UseAProgressBarToTrackIterations.snippet.id-5FC07DB9._madbad@foxmail.com_.usa","sha256":"198e02e71fce96956465aad13e61769cce0e525a48f54a217a9dadad92dacac8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"name":"AN04323_.WMF.id-5FC07DB9._madbad@foxmail.com_.usa","sha256":"853686489eb89b6763703d2af7c3dae9ed879c1f953162d2eb1c980e1ee0defb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"name":"com-sun-tools-visualvm-modules-startup_ja.jar.id-5FC07DB9._madbad@foxmail.com_.usa","sha256":"bfb2e8ce547daf40a6c212df9f5e76570bcf7a2c3710493738cb8191bff49b68","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"name":"wxpr.dll.id-5FC07DB9._madbad@foxmail.com_.usa","sha256":"914c66ddbf39e9b32b82956c5274f152cd2e43278d425d91fef8b8b101d63a90","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"name":"MSOHTMED.EXE.id-5FC07DB9._madbad@foxmail.com_.usa","sha256":"d54b2e7dbd1911c056eb22ee4e3ac2b79ecb07532a6910d1d1c21afae36bdb6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"name":"OLNOTER.FAE.id-5FC07DB9._madbad@foxmail.com_.usa","sha256":"52b2888194b71690b5546c420792a6d977cb79e0809431cd155807ca094bf041","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"name":"main.css.id-5FC07DB9._madbad@foxmail.com_.usa","sha256":"0dcef3b5f746ac0cd9070367bb1600a90cf3c4194dc688a17b9858f0b575e10c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"name":"login.58746981_1_.css.id-5FC07DB9._madbad@foxmail.com_.usa","sha256":"4a9d32eb1f0ad44ffe833acd313577f0da3159f91177115876f2331827bbf546","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"name":"ZX______.PFB.id-5FC07DB9._madbad@foxmail.com_.usa","sha256":"489a86999f393b443694f5b69c382cf244fe468b478c7602e91813c682adf8e9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"name":"ui-strings.js.id-5FC07DB9._madbad@foxmail.com_.usa","sha256":"ced608a4fce06bb17d4c715bee1f898971c35f8d5174d5913b416fca8c10d905","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]}],"files_written":[{"path":"C:\\expiorer.exe","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"%WINDIR%\\System32\\expiorer.exe","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\expiorer.exe","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"%WINDIR%\\AppPatch\\AppPatch64\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-5FC07DB9.[madbad@foxmail.com].usa","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-5FC07DB9.[madbad@foxmail.com].usa","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\expiorer.exe","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-5FC07DB9.[madbad@foxmail.com].usa","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-5FC07DB9.[madbad@foxmail.com].usa","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-5FC07DB9.[madbad@foxmail.com].usa","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"%WINDIR%\\System32\\en-US\\mshta.exe.mui","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Info.hta","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\msiexec.exe","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"%WINDIR%\\System32\\msiexec.exe","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"%WINDIR%\\System32\\mshta.exe","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"%WINDIR%\\Branding\\Basebrd\\basebrd.dll","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"%WINDIR%\\Fonts\\tahomabd.ttf","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"%WINDIR%\\Fonts\\tahoma.ttf","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"%WINDIR%\\Fonts\\wingding.ttf","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"%WINDIR%\\System32\\en-US\\ulib.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"C:\\Users\\0DQLje4","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Info.hta","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\msiexec.exe","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"%WINDIR%\\System32\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"name":"Global\\syncronize_Z54RDIA","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"name":"Global\\syncronize_Z54RDIU","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\syncronize_Z54RDIA","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\syncronize_Z54RDIU","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"name":"!IECompat!Mutex","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"name":"Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\!IECompat!Mutex","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"5c560da17ca3e17ccd32c335"}]}]}},"report_ids":{"sandbox_job_ids":["5c560da17ca3e17ccd32c335"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 83b8ea93ed00… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 83b8ea93ed00…. Malware family: Trojan.Generic. Threat score 100/100. 23/26 AV engines flagged this file. 7 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/83b8ea93ed00a673c5c032696525b50a745d670bfefd2e266543ddb32bc57c6f"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 83b8ea93ed00… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 83b8ea93ed00…. Malware family: Trojan.Generic. Threat score 100/100. 23/26 AV engines flagged this file. 7 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/83b8ea93ed00a673c5c032696525b50a745d670bfefd2e266543ddb32bc57c6f"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 83b8ea93ed00… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 83b8ea93ed00…. Malware family: Trojan.Generic. Threat score 100/100. 23/26 AV engines flagged this file. 7 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2e","11",{}]]