26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2f:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T4ba,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.HiddenTears.Generic Sample 8f667cf24653… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 8f667cf24653…. Malware family: Ransom.HiddenTears.Generic. Threat score 100/100. 18/27 AV engines flagged this file. 5 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8f667cf246538d401b16eba6d525e04b3e4863b79e67c58887fb29ac9d33050b","keywords":["Malicious","Ransom.HiddenTears.Generic","malware analysis","sandbox report","threat intelligence","8f667cf246538d401b16eba6d525e04b3e4863b79e67c58887fb29ac9d33050b"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","assembly","executable"],"identifier":"8f667cf246538d401b16eba6d525e04b3e4863b79e67c58887fb29ac9d33050b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom.HiddenTears.Generic","antivirusDetections":{"malicious":18,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T822,"" queries volume information of "%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll" at 00014338-00003256-0000010C-40083349 "" queries volume information of "%WINDIR%\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll" at 00014338-00003256-0000010C-40083514 "" queries volume information of "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll" at 00014338-00003256-0000010C-40308008 "" queries volume information of "%WINDIR%\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll" at 00014338-00003256-0000010C-40308133 "" queries volume information of "%WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00014338-00003256-0000010C-40431507 "" queries volume information of "%WINDIR%\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00014338-00003256-0000010C-40431596 "" queries volume information of "%WINDIR%\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00014338-00003256-0000010C-40521190 "" queries volume information of "%WINDIR%\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00014338-00003256-0000010C-40521272 "" queries volume information of "%WINDIR%\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll" at 00014338-00003256-0000010C-40640145 "" queries volume information of "%WINDIR%\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll" at 00014338-00003256-0000010C-40640237 "" queries volume information of "%WINDIR%\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll" at 00014338-00003256-0000010C-40727404 "" queries volume information of "%WINDIR%\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll" at 00014338-00003256-0000010C-4072750328:T7e9,"" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")29:T745,"" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA"; Key: "BLOB") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135"; Key: "BLOB") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")2a:T633,".doc|.zip|.htm|.pdf|.htm|.txt|.xls|.xml|.dot|.ppt|.pps|.ai|.pub|.rar|.tar|.gz|.adn|.acc|.cab|.exe|.png|.jpg|.raw|.gif|.css|.js|.php|.mdf|.avi|.mp3|.mp4|.oxt|.cs|.cpp|.123|.3ds|.3gp|.7z|.abr|.act|.adi|.aep|.aes|.alc|.apk|.apx|.asd|.asm|.aup|.avr|.bas|.bat|.vbs|.bal|.bmp|.boo|.bup|.c++|.cab|.cc|.cdr|.odt|.rtf|.log|.csv|.key|.aif|.wmv|.3dm|.max|.obj|.dds|.psd|.svg|.eps|.ps|.accdb|.mdb|.pdb|.sql|.gam|.sav|.dwg|.dxf|.kml|.asp|.cer|.cfm|.csr|.css|.js|.php|.xhtml|.fnt|.fon|.otf|.ttf|.cfg|.ini|.class|.dtd|.fla|.h|.java|.lua|.pl|.py|.sh|.sln|.vb|.vcxproj|.bak|.tmp|.ics|.torrent|.xcf|.ico|.unity3d|.blob|.wma|.odb|.asset|.forge|.map|.big|.jpeg|.litesql|.backup|.wallet" ".zip|.htm|.pdf|.htm|.txt|.xls|.xml|.dot|.ppt|.pps|.ai|.pub|.rar|.tar|.gz|.adn|.acc|.cab|.exe|.png|.jpg|.raw|.gif|.css|.js|.php|.mdf|.avi|.mp3|.mp4|.oxt|.cs|.cpp|.123|.3ds|.3gp|.7z|.abr|.act|.adi|.aep|.aes|.alc|.apk|.apx|.asd|.asm|.aup|.avr|.bas|.bat|.vbs|.bal|.bmp|.boo|.bup|.c++|.cab|.cc|.cdr|.odt|.rtf|.log|.csv|.key|.aif|.wmv|.3dm|.max|.obj|.dds|.psd|.svg|.eps|.ps|.accdb|.mdb|.pdb|.sql|.gam|.sav|.dwg|.dxf|.kml|.asp|.cer|.cfm|.csr|.css|.js|.php|.xhtml|.fnt|.fon|.otf|.ttf|.cfg|.ini|.class|.dtd|.fla|.h|.java|" ".bmp|.boo|.bup|.c++|.cab|.cc|.cdr|.odt|.rtf|.log|.csv|.key|.aif|.wmv|.3dm|.max|.obj|.dds|.psd|.svg|.eps|.ps|.accdb|.mdb|.pdb|.sql|.gam|.sav|.dwg|.dxf|.kml|.asp|.cer|.cfm|.csr|.css|.js|.php|.xhtml|.fnt|.fon|.otf|.ttf|.cfg|.ini|.class|.dtd|.fla|.h|.java|.lua|.pl|.py|.sh|.sln|.vb|.vcxproj|.bak|.tmp|.ics|.torrent|.xcf|.ico|.unity3d|.blob|.wma|.odb|.asset|.forge|.map|.big|.jpeg|.litesql|.backup|.wallet"2b:T50c,"" touched file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\clr.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\clr.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\clr.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\machine.config" "" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\security.config" "" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch" "" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config" "" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch" "" touched file "%WINDIR%\Globalization\Sorting\sortdefault.nls" "" touched file "%WINDIR%\assembly\NativeImages_v2.0.50727_32\index23b.dat"2c:T8cc,"" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32" (Filter: 14; Subtree: 0) "" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9" (Filter: 1; Subtree: 0) "" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\NameSpace_Catalog5" (Filter: 1; Subtree: 0) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS" (Filter: 14; Subtree: 0) "" monitors "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" (Filter: 4; Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" (Filter: 4; Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" (Filter: 4; Subtree: 1) "" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\crypt32" (Filter: 4; Subtree: 0) "" monitors "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\Software\Microsoft\SystemCertificates\Root" (Filter: 5; Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 5; Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 5; Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 5; Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 5; Subtree: 1) "" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 5; Subtree: 1) "" monitors "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\Software\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 5; Subtree: 1) "" monitors "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\Software\Microsoft\SystemCertificates\trust" (Filter: 5; Subtree: 1) "" monitors "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\Software\Policies\Microsoft\SystemCertificates" (Filter: 5; Subtree: 1)2d:T54a,"All your personal files have been encrypted. You can find a list of them in FILELIST.txt on your desktop" (Source: 8f667cf246538d401b16eba6d525e04b3e4863b79e67c58887fb29ac9d33050b.exe.bin, Indicator: "files have been encrypted") "Please visit http://127.0.0.1:8080 in your web browser and login with the ID below to decrypt your files" (Source: 8f667cf246538d401b16eba6d525e04b3e4863b79e67c58887fb29ac9d33050b.exe.bin, Indicator: "decrypt your files") "It is recommended that you do not shutdown your computer until you have successfully paid for and decrypted your files. In the event that this program is closed, you can find a copy on your desktop named BeethoveN.exe which you can use to decrypt your filesBSJB" (Source: 8f667cf246538d401b16eba6d525e04b3e4863b79e67c58887fb29ac9d33050b.exe.bin, Indicator: "decrypt your files") "Thankyou for choosing to decrypt your files. If any have been missed, please place them on your desktop then click "Rescan" to decrypt them" (Source: 8f667cf246538d401b16eba6d525e04b3e4863b79e67c58887fb29ac9d33050b.exe.bin, Indicator: "decrypt your files") "Your payment has been accepted. We will decrypt your files now. This may take a while and your computer will be unresponsive during this time" (Source: 8f667cf246538d401b16eba6d525e04b3e4863b79e67c58887fb29ac9d33050b.exe.bin, Indicator: "decrypt your files")2e:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"8f667cf246538d401b16eba6d525e04b3e4863b79e67c58887fb29ac9d33050b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790347680314,"unified_at":"2026-09-25T14:48:00.314Z","metadata":{"hashes":{"sha256":"8f667cf246538d401b16eba6d525e04b3e4863b79e67c58887fb29ac9d33050b","sha1":"15f867830d53806a06bf6a941d28e2f38e7ecc8c","md5":"cedfe1c1bd3dfaa89420de14ef41d638","sha512":"ecb1963a89afb8a8345438bacebdd077379235eadcbed4a34cd7cdc8bc29c3f2b8515d7b174115d2fd8b204232f2a873bd187e53ec5c54356734682c42ca49b4","ssdeep":"384:Q/RMOWYnw85et8+JmWZs/ojAIoxcCX7bFNuJLNiYgUb5j/dk6IXaQaM7:Q/5UALnu3jPR/e","ssdeep_chunks":["384:Q/RMOWY","384:/RMOWYn","384:RMOWYnw","384:MOWYnw8","384:OWYnw85","384:WYnw85e","384:Ynw85et","384:nw85et8","384:w85et8+","384:85et8+J","384:5et8+Jm","384:et8+JmW","384:t8+JmWZ","384:8+JmWZs","384:+JmWZs/","384:JmWZs/o","384:mWZs/oj","384:WZs/ojA","384:Zs/ojAI","384:s/ojAIo","384:/ojAIox","384:ojAIoxc","384:jAIoxcC","384:AIoxcCX","384:IoxcCX7","384:oxcCX7b","384:xcCX7bF","384:cCX7bFN","384:CX7bFNu","384:X7bFNuJ","384:7bFNuJL","384:bFNuJLN","384:FNuJLNi","384:NuJLNiY","384:uJLNiYg","384:JLNiYgU","384:LNiYgUb","384:NiYgUb5","384:iYgUb5j","384:YgUb5j/","384:gUb5j/d","384:Ub5j/dk","384:b5j/dk6","384:5j/dk6I","384:j/dk6IX","384:/dk6IXa","384:dk6IXaQ","384:k6IXaQa","384:6IXaQaM","384:IXaQaM7","768:Q/RMOWY","768:/RMOWYn","768:RMOWYnw","768:MOWYnw8","768:OWYnw85","768:WYnw85e","768:Ynw85et","768:nw85et8","768:w85et8+","768:85et8+J","768:5et8+Jm","768:et8+JmW","768:t8+JmWZ","768:8+JmWZs","768:+JmWZs/","768:JmWZs/o","768:mWZs/oj","768:WZs/ojA","768:Zs/ojAI","768:s/ojAIo","768:/ojAIox","768:ojAIoxc","768:jAIoxcC","768:AIoxcCX","768:IoxcCX7","768:oxcCX7b","768:xcCX7bF","768:cCX7bFN","768:CX7bFNu","768:X7bFNuJ","768:7bFNuJL","768:bFNuJLN","768:FNuJLNi","768:NuJLNiY","768:uJLNiYg","768:JLNiYgU","768:LNiYgUb","768:NiYgUb5","768:iYgUb5j","768:YgUb5j/","768:gUb5j/d","768:Ub5j/dk","768:b5j/dk6","768:5j/dk6I","768:j/dk6IX","768:/dk6IXa","768:dk6IXaQ","768:k6IXaQa","768:6IXaQaM","768:IXaQaM7","384:Q/5UALn","384:/5UALnu","384:5UALnu3","384:UALnu3j","384:ALnu3jP","384:Lnu3jPR","384:nu3jPR/","384:u3jPR/e"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"file","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":40960,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499286678000,"last_seen":1660009071000,"last_multi_scan":1660009071000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ransomware"]},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":13,"suspicious_count":12,"malicious_count":5,"total":30},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.VKont","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.TSGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/FileCoder.ihgqm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Ransom.HiddenTears.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Ransom.HiddenTears.1 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"MSIL/Filecoder.BeethoveN.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.BeethoveN","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 700000121 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Backdoor.MSIL.VKont.ajt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan-FNGK!CEDFE1C1BD3D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.FileCoder.epsuph","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Ransom-ENW","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_BEETHOV.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_BEETHOV.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Backdoor.MSIL.VKont","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom.HiddenTears.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$27","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$28","origin":"Registry Access","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$29","origin":"Registry Access","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"soltec6d5qinsppi.hiddenservice.net\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"178.17.173.18:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"$2a","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking\"\n \"Global\\.net clr networking\"\n \"RasPbFile\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 6AE80000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$2b","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://127.0.0.1:8080\"\n Pattern match: \"https://soltec6d5qinsppi.hiddenservice.net/\"\n Pattern match: \"c6d5qinsppi.hiddenservice.net/register.php?foobar=\"\n Pattern match: \"c6d5qinsppi.hiddenservice.net/get.php?refid=\"\n Heuristic match: \"soltec6d5qinsppi.hiddenservice.net\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"8f667cf246538d401b16eba6d525e04b3e4863b79e67c58887fb29ac9d33050b.exe.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00014338-00003256-00000105-40340055","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/64 reputation engines marked \"http://127.0.0.1\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"\" called \"OpenSCManager\" requesting access rights \"0X0\"\n \"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"\" called \"OpenService\" to access the \"RASMAN\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"\" called \"OpenService\" to access the \"rasman\" service\n \"\" called \"OpenService\" to access the \"ServicesActive\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"\" called \"OpenService\" to access the \"gpsvc\" service\n \"\" called \"OpenService\" to access the \"RASMAN\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"level":"suspicious","category":"General","name":"Sent a control code to a service","description":"\"\" called \"ControlService\" and sent control code \"0X24\" to the service \"gpsvc\"\n \"\" called \"ControlService\" and sent control code \"0XFC\" to the service \"gpsvc\"","origin":"API Call","relevance":10,"id":"api-75","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"$2c","origin":"API Call","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"level":"suspicious","category":"Network Related","name":"Detected ARP broadcast requests (network device lookup)","description":"Attempt to find devices in networks: \"192.168.56.1/32, 192.168.56.22/32, ...\"","origin":"Network Traffic","relevance":10,"id":"network-32","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"Please visit http://127.0.0.1:8080 in your web browser and login with the ID below to decrypt your files\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"$2d","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Modifies file/console tracing settings (often used to hide footprints on system)","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLEFILETRACING\"; Value: \"00000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLECONSOLETRACING\"; Value: \"00000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"FILETRACINGMASK\"; Value: \"0000FFFF\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"CONSOLETRACINGMASK\"; Value: \"0000FFFF\")","origin":"Registry Access","relevance":5,"id":"registry-30","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"36/61 Antivirus vendors marked sample as malicious (59% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"36/61 Antivirus vendors marked sample as malicious (59% detection rate)\n 4/39 Antivirus vendors marked sample as malicious (10% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"30/84 Antivirus vendors marked spawned process \"\" (PID: 3256) as malicious (classified as \"Gen:Heur.Ransom.HiddenTears\" with 35% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"Found malicious artifacts related to \"178.17.173.18\" (ASN: 43289, Owner: I.C.S. Trabia-Network S.R.L.): ...\nFile SHA256: 8f667cf246538d401b16eba6d525e04b3e4863b79e67c58887fb29ac9d33050b (AV positives: 10/61 scanned on 06/02/2017 03:51:44)","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":67,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":32,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ransomware"],"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"593d2e2caac2edaa72456096","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Heur.Ransom.HiddenTears","contacted_countries":["MDA"],"submit_name":"8f667cf246538d401b16eba6d525e04b3e4863b79e67c58887fb29ac9d33050b","analysis_start_time":"2017-06-11T12:48:32+00:00","indicators_count":{"informative":13,"suspicious":12,"malicious":6},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"178.17.173.18","port":443,"protocol":"TCP","country":"Moldova Republic of","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]}],"dns_resolutions":[{"domain":"soltec6d5qinsppi.hiddenservice.net","address":"178.17.173.18","country":"Moldova Republic of","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}],"processes":[{"pid":3256,"ppid":0,"name":"8f667cf246538d401b16eba6d525e04b3e4863b79e67c58887fb29ac9d33050b.exe","command_line":"","sha256":"8f667cf246538d401b16eba6d525e04b3e4863b79e67c58887fb29ac9d33050b","normalized_path":"C:\\8f667cf246538d401b16eba6d525e04b3e4863b79e67c58887fb29ac9d33050b.exe","uid":"00014338-00003256","icon":"$2e"}],"all_imported_dlls":["user32.dll","psapi.dll","shfolder.dll","dhcpcsvc.dll","System.dll","shlwapi.dll","security.dll","schannel.dll","ntdll.dll","mscorjit.dll","ws2_32.dll","rtutils.dll","winnsi.dll","rsaenh.dll","IPHLPAPI.DLL","dnsapi.dll","profapi.dll","cryptbase.dll","sspicli.dll","rasadhlp.dll","KernelBase.dll","advapi32.dll","imm32.dll","RpcRtRemote.dll","sechost.dll","gdi32.dll","msctf.dll","WSHTCPIP.DLL","webio.dll","credssp.dll","mscoree.dll","version.dll","rasman.dll","mswsock.dll","wship6.dll","dhcpcsvc6.dll","crypt32.dll","ncrypt.dll","msvcrt.dll","usp10.dll","mscorwks.dll","msvcr80.dll","cryptsp.dll","bcrypt.dll","bcryptprimitives.dll","userenv.dll","nsi.dll","kernel32.dll","rpcrt4.dll","lpk.dll","System.XML.dll","secur32.dll","msasn1.dll","mscoreei.dll","rpcss.dll","System.Windows.Forms.dll","rasapi32.dll","gpapi.dll","shell32.dll","ole32.dll","mscorlib.dll","uxtheme.dll","System.Drawing.dll","System.configuration.dll","winhttp.dll","cfgmgr32.dll","FWPUCLNT.DLL"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"path":"C:\\8f667cf246538d401b16eba6d525e04b3e4863b79e67c58887fb29ac9d33050b.exe.config","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"path":"%WINDIR%\\system32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"path":"C:\\8f667cf246538d401b16eba6d525e04b3e4863b79e67c58887fb29ac9d33050b.exe","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index23b.dat","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\Config\\machine.config","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"path":"%WINDIR%\\system32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"path":"%WINDIR%\\system32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"path":"%WINDIR%\\system32\\en-US\\CRYPT32.dll.mui","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\ENVIRONMENT\\SAVETHETREES\\","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"name":"Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"593d2e2caac2edaa72456096"}]}]}},"report_ids":{"sandbox_job_ids":["593d2e2caac2edaa72456096"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Ransom.HiddenTears.Generic Sample 8f667cf24653… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 8f667cf24653…. Malware family: Ransom.HiddenTears.Generic. Threat score 100/100. 18/27 AV engines flagged this file. 5 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/8f667cf246538d401b16eba6d525e04b3e4863b79e67c58887fb29ac9d33050b"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom.HiddenTears.Generic Sample 8f667cf24653… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 8f667cf24653…. Malware family: Ransom.HiddenTears.Generic. Threat score 100/100. 18/27 AV engines flagged this file. 5 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/8f667cf246538d401b16eba6d525e04b3e4863b79e67c58887fb29ac9d33050b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom.HiddenTears.Generic Sample 8f667cf24653… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 8f667cf24653…. Malware family: Ransom.HiddenTears.Generic. Threat score 100/100. 18/27 AV engines flagged this file. 5 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2f","11",{}]]