HERMES RANSOMWARE

24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2d:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T47f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 851032eb03bc… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 851032eb03bc…. Malware family: Trojan.Generic. Threat score 100/100. 25/28 AV engines flagged this file. 7 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/851032eb03bc8ee05c381f7614a0cbf13b9a13293dfe5e4d4b7cd230970105e3","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","851032eb03bc8ee05c381f7614a0cbf13b9a13293dfe5e4d4b7cd230970105e3"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"851032eb03bc8ee05c381f7614a0cbf13b9a13293dfe5e4d4b7cd230970105e3","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":25,"total":28},"behavioralIndicators":{"malicious":7,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Ta59,Spawned process "cmd.exe" with commandline "/C copy /B "C:\851032eb03bc8ee05c381f7614a0cbf13b9a13293dfe5e4d4b7cd230970105e3.exe" "%TEMP%\svchosta.exe" && exit" (UID: 00021461-00004040) Spawned process "cmd.exe" with commandline "/C ""%TEMP%\svchosta.exe" "C:\851032eb03bc8ee05c381f7614a0cbf13b9a13293dfe5e4d4b7cd230970105e3.exe""" (UID: 00021561-00004084) Spawned process "svchosta.exe" with commandline ""C:\851032eb03bc8ee05c381f7614a0cbf13b9a13293dfe5e4d4b7cd230970105e3.exe"" (UID: 00021571-00004076) Spawned process "cmd.exe" with commandline "/C "%PUBLIC%\window.bat"" (UID: 00027032-00001736) Spawned process "cmd.exe" with commandline "/C %USERPROFILE%\Desktop\DECRYPT_INFORMATION.html" (UID: 00027107-00003028) Spawned process "vssadmin.exe" with commandline "vssadmin Delete Shadows /all /quiet" (UID: 00027115-00002996) Spawned process "vssadmin.exe" with commandline "vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB" (UID: 00027293-00002444) Spawned process "iexplore.exe" with commandline "%USERPROFILE%\Desktop\DECRYPT_INFORMATION.html" (UID: 00027299-00001672) Spawned process "vssadmin.exe" with commandline "vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded" (UID: 00027313-00001488) Spawned process "vssadmin.exe" with commandline "vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB" (UID: 00027338-00000448) Spawned process "vssadmin.exe" with commandline "vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded" (UID: 00027402-00001976) Spawned process "cmd.exe" with commandline "/C "%TEMP%\svchostaaexe.bat"" (UID: 00027409-00003276) Spawned process "timeout.exe" with commandline "TIMEOUT /T 10 /NOBREAK" (UID: 00027434-00003320) Spawned process "vssadmin.exe" with commandline "vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB" (UID: 00027461-00003176) Spawned process "vssadmin.exe" with commandline "vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded" (UID: 00027488-00003304) Spawned process "iexplore.exe" with commandline "SCODEF:1672 CREDAT:79873" (UID: 00027508-00003452) Spawned process "vssadmin.exe" with commandline "vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB" (UID: 00027531-00003480) Spawned process "vssadmin.exe" with commandline "vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded" (UID: 00027576-00003444) Spawned process "vssadmin.exe" with commandline "vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB" (UID: 00027593-00001036) Spawned process "vssadmin.exe" with commandline "vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded" (UID: 00027607-00001068)26:T6da,"" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Users\TJ4GrLt\AppData\Local\Microsoft\Windows\Caches" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "" touched file "C:\Windows\System32\en-US\propsys.dll.mui" "" touched file "C:\Windows\System32\cmd.exe" "" touched file "C:\Windows\System32\en-US\setupapi.dll.mui" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "svchosta.exe" touched file "C:\Windows\System32\rsaenh.dll" "svchosta.exe" touched file "C:\Windows\System32\crypt32.dll" "svchosta.exe" touched file "C:\Windows\System32\en-US\crypt32.dll.mui" "svchosta.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.bat" "svchosta.exe" touched file "C:\Windows\System32\en-US\mpr.dll.mui" "svchosta.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "svchosta.exe" touched file "C:\Users\TJ4GrLt\AppData\Local\Microsoft\Windows\Caches" "svchosta.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "svchosta.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db"27:T193e,"HERMES RANSOMWARE

primary email: BM-2cU4s1wYpwd6NwVRnUP5LuKJ5cPEFx8N2J@bitmessage.ch

reserve email: info@decrypt-info.pw