26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T483,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 9dd899408f47… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 9dd899408f47…. Malware family: Trojan.Generic. Threat score 100/100. 22/28 AV engines flagged this file. 4 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9dd899408f4797694dc31702da664bf046b4a9bee3616477f324b8c89d0768b3","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","9dd899408f4797694dc31702da664bf046b4a9bee3616477f324b8c89d0768b3"],"about":{"@type":"SoftwareApplication","name":"stub.exe","applicationCategory":["peexe","executable"],"identifier":"9dd899408f4797694dc31702da664bf046b4a9bee3616477f324b8c89d0768b3","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":22,"total":28},"behavioralIndicators":{"malicious":4,"suspicious":24},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T593,"" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Users\8wbC1OF\AppData\Local\Microsoft\Windows\Caches" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4p49trrw.lnk" "" touched file "C:\Windows\System32\rsaenh.dll" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "cmd.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "cmd.exe" touched file "C:\Windows\System32\vssadmin.exe" "cmd.exe" touched file "C:\Windows\System32\wbem\WMIC.exe" "cmd.exe" touched file "C:\Windows\System32\bcdedit.exe" "cmd.exe" touched file "C:\Windows\System32\wbadmin.exe" "vssadmin.exe" touched file "C:\Windows\System32\rsaenh.dll" "vssadmin.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "WMIC.exe" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui"28:T797,"S A T U R NAll of your files have been encrypted!To Decrypt your files follow these steps:#---------------------------------------------#1. Download and install the "Tor Browser" from https://www.torproject.org2. Run it.3. In the Tor Browser, open website: http://su34pwhpcafeiztt.onion4. Follow the instructions on the page#---------------------------------------------#" (Source: #DECRYPT_MY_FILES#.txt, Indicator: "decrypt your files") "All of your files have been encrypted!" (Source: #DECRYPT_MY_FILES#.txt, Indicator: "files have been encrypted") "To Decrypt your files follow these steps:" (Source: #DECRYPT_MY_FILES#.txt, Indicator: "decrypt your files") "S A T U R N

S A T U R N

Your documents, photos, databases, and other important files have been encrypted!

To Decrypt your files follow these instructions:

1. Download and Install Tor Browser from https://www.torproject.org/

2. Run the browser

3. In the Tor Browser, open website:

http://su34pwhpcafeiztt.onion

4. Follow the instructions at this website

" (Source: #DECRYPT_MY_FILES#.html, Indicator: "decrypt your files") "

Your documents, photos, databases, and other important files have been encrypted!

" (Source: #DECRYPT_MY_FILES#.html, Indicator: "files have been encrypted") "
To Decrypt your files follow these instructions:" (Source: #DECRYPT_MY_FILES#.html, Indicator: "decrypt your files")29:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"9dd899408f4797694dc31702da664bf046b4a9bee3616477f324b8c89d0768b3","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791146343651,"unified_at":"2026-10-04T20:39:03.651Z","metadata":{"hashes":{"sha256":"9dd899408f4797694dc31702da664bf046b4a9bee3616477f324b8c89d0768b3","sha1":"ea661104726cc821b7fb854df1397d02b36a0446","md5":"25ae4685b010bec599fb7d03a76654fe","sha512":"6c63ab670c419ac6b63371c99ae9ad1f38e4c8fe95e6ecb8ae1abb34bc514d7202aadeaafb5ca74e926f3c6c5847eea6a315e49221b758f92454a3cb5091c266","ssdeep":"3072:p04G+bJEHpItSe/XyRz4/zlhfWhhn/NJRq+4/gTlloB751KykFge+Wpyzv:+X+PC4pZWhHq+4IRMVgBSe+Wpyz","ssdeep_chunks":["3072:p04G+bJ","3072:04G+bJE","3072:4G+bJEH","3072:G+bJEHp","3072:+bJEHpI","3072:bJEHpIt","3072:JEHpItS","3072:EHpItSe","3072:HpItSe/","3072:pItSe/X","3072:ItSe/Xy","3072:tSe/XyR","3072:Se/XyRz","3072:e/XyRz4","3072:/XyRz4/","3072:XyRz4/z","3072:yRz4/zl","3072:Rz4/zlh","3072:z4/zlhf","3072:4/zlhfW","3072:/zlhfWh","3072:zlhfWhh","3072:lhfWhhn","3072:hfWhhn/","3072:fWhhn/N","3072:Whhn/NJ","3072:hhn/NJR","3072:hn/NJRq","3072:n/NJRq+","3072:/NJRq+4","3072:NJRq+4/","3072:JRq+4/g","3072:Rq+4/gT","3072:q+4/gTl","3072:+4/gTll","3072:4/gTllo","3072:/gTlloB","3072:gTlloB7","3072:TlloB75","3072:lloB751","3072:loB751K","3072:oB751Ky","3072:B751Kyk","3072:751KykF","3072:51KykFg","3072:1KykFge","3072:KykFge+","3072:ykFge+W","3072:kFge+Wp","3072:Fge+Wpy","3072:ge+Wpyz","3072:e+Wpyzv","6144:p04G+bJ","6144:04G+bJE","6144:4G+bJEH","6144:G+bJEHp","6144:+bJEHpI","6144:bJEHpIt","6144:JEHpItS","6144:EHpItSe","6144:HpItSe/","6144:pItSe/X","6144:ItSe/Xy","6144:tSe/XyR","6144:Se/XyRz","6144:e/XyRz4","6144:/XyRz4/","6144:XyRz4/z","6144:yRz4/zl","6144:Rz4/zlh","6144:z4/zlhf","6144:4/zlhfW","6144:/zlhfWh","6144:zlhfWhh","6144:lhfWhhn","6144:hfWhhn/","6144:fWhhn/N","6144:Whhn/NJ","6144:hhn/NJR","6144:hn/NJRq","6144:n/NJRq+","6144:/NJRq+4","6144:NJRq+4/","6144:JRq+4/g","6144:Rq+4/gT","6144:q+4/gTl","6144:+4/gTll","6144:4/gTllo","6144:/gTlloB","6144:gTlloB7","6144:TlloB75","6144:lloB751","6144:loB751K","6144:oB751Ky","6144:B751Kyk","6144:751KykF","6144:51KykFg","6144:1KykFge","6144:KykFge+","6144:ykFge+W","6144:kFge+Wp","6144:Fge+Wpy","6144:ge+Wpyz","6144:e+Wpyzv","3072:+X+PC4p","3072:X+PC4pZ","3072:+PC4pZW","3072:PC4pZWh","3072:C4pZWhH","3072:4pZWhHq","3072:pZWhHq+","3072:ZWhHq+4","3072:WhHq+4I","3072:hHq+4IR","3072:Hq+4IRM","3072:q+4IRMV","3072:+4IRMVg","3072:4IRMVgB","3072:IRMVgBS","3072:RMVgBSe","3072:MVgBSe+","3072:VgBSe+W","3072:gBSe+Wp","3072:BSe+Wpy","3072:Se+Wpyz"],"imphash":"19a73581854e051ad461f44c65dbb789"},"file_info":{"file_name":"stub.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":174592,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1519021327000,"last_seen":1607438727000,"last_multi_scan":1607438727000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ransomware"]},"stats":{"av":{"malicious_count":22,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":24,"suspicious_count":24,"malicious_count":4,"total":52},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"Ahnlab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Khalesi","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.TSGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1122976","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"BitDefender","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.Saturn.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Saturn.C.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.Saturn.A (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Filecoder.Saturn.B trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:TrojanDropper/Sloader.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"Ikarus","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Saturn","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Ransom-Saturn","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.eyeged","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Threat-Generic://Suspicious-Confidence_86","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Satran-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Trojan.Gen.2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"TrendMicro","success":true,"verdict":"malicious","threat_name":"Ransom_SATURN.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"TrendMicro House Call","success":true,"verdict":"malicious","threat_name":"Ransom_SATURN.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.BKLZ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Encoder","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xviruspersonalguard":{"name":"Xvirus Personal Guard","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Khalesi.Win32.709","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"WMIC.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00014406-00003904-41940-1276-0041BC6A\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00014406-00003904-41940-1776-00416DA2\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00014406-00003904-41940-3426-004176E9\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00014406-00003904-41940-2278-0041759A","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"UPX0\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00014406-00003904-41940-2302-0041773E","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00014406-00003904-41940-2008-0042BB91","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"EnumSystemLocalesW@KERNEL32.DLL at 00014406-00003904-41940-1735-00425A37\n EnumSystemLocalesW@KERNEL32.DLL at 00014406-00003904-41940-1764-0042EAE6\n GetUserDefaultLCID@KERNEL32.DLL at 00014406-00003904-41940-1763-0042F1AE\n EnumSystemLocalesW@KERNEL32.DLL at 00014406-00003904-41940-1765-0042EBCC\n EnumSystemLocalesW@KERNEL32.DLL at 00014406-00003904-41940-1768-0042EB31\n GetUserDefaultLCID@KERNEL32.DLL at 00014406-00003904-41940-1728-00426089","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00014406-00003904-41940-3380-00429B46","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"\" queries volume information of \"C:\\\" at 00014406-00003904-0000010C-40249826\n \"\" queries volume information of \"C:\\\" at 00014406-00003904-0000010C-40317354\n \"\" queries volume information of \"C:\\9dd899408f4797694dc31702da664bf046b4a9bee3616477f324b8c89d0768b3.exe\" at 00014406-00003904-0000010C-40320087","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"\" queries volume information of \"C:\\\" at 00014406-00003904-0000010C-40249826\n \"\" queries volume information of \"C:\\\" at 00014406-00003904-0000010C-40317354","origin":"API Call","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\9DD899408F4797694DC31702DA664BF046B4A9BEE3616477F324B8C89D0768B3.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\9DD899408F4797694DC31702DA664BF046B4A9BEE3616477F324B8C89D0768B3.EXE\")\n \"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"WMIC.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\669d6008cfd39e47cf2156d415f70ef1\"\n \"669d6008cfd39e47cf2156d415f70ef1\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!8wbc1of!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!8wbc1of!appdata!roaming!microsoft!windows!cookies!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!8wbc1of!appdata!local!microsoft!windows!history!history.ie5!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/C vssadmin.exe delete shadows /all /quiet & wmic.exe shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet\" on 2018-2-19.07:13:37.722","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/C vssadmin.exe delete shadows /all /quiet & wmic.exe shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet\" (UID: 00014646-00003884)\n Spawned process \"vssadmin.exe\" with commandline \"delete shadows /all /quiet\" (UID: 00014655-00004024)\n Spawned process \"WMIC.exe\" with commandline \"shadowcopy delete\" (UID: 00014681-00001776)\n Spawned process \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00016153-00002244)\n Spawned process \"bcdedit.exe\" with commandline \"bcdedit /set {default} recoveryenabled no\" (UID: 00016174-00002256)\n Spawned process \"wbadmin.exe\" with commandline \"wbadmin delete catalog -quiet\" (UID: 00016194-00002264)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"WMIC.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"4p49trrw.lnk\" has type \"MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Mon Feb 19 14:13:18 2018 mtime=Mon Feb 19 14:13:18 2018 atime=Mon Feb 19 14:13:30 2018 length=174592 window=hide\"\n \"1N1A3vlRdYRii5C.mp3.Lrcy\" has type \"data\"\n \"OfficeMUI.xml.Lrcy\" has type \"data\"\n \"4Pmmh3HlYKPz20b.doc.Lrcy\" has type \"data\"\n \"#DECRYPT_MY_FILES#.html\" has type \"HTML document ASCII text with CRLF CR line terminators\"\n \"blocklist.xml.Lrcy\" has type \"data\"\n \"webappsstore.sqlite.Lrcy\" has type \"data\"\n \"Setup.xml.Lrcy\" has type \"data\"\n \"Office64WW.xml.Lrcy\" has type \"data\"\n \"#DECRYPT_MY_FILES#.txt\" has type \"ASCII text with CRLF line terminators\"\n \"Proof.xml.Lrcy\" has type \"data\"\n \"8Uu9ETpS.avi.Lrcy\" has type \"data\"\n \"0zIG0D.doc.Lrcy\" has type \"data\"\n \"SiteSecurityServiceState.txt.Lrcy\" has type \"data\"\n \"services_rdrk.dat.Lrcy\" has type \"data\"\n \"5L9Wjn.txt.Lrcy\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$27","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"HEAD /edgedl/release2/Hcq1Yqsih2A/57.0.2987.133_56.0.2924.87_chrome_updater.exe HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityUser-Agent: Microsoft BITS/7.5X-Old-UID: cnt=0X-Last-HR: 0x80042194X-Last-HTTP-Status-Code: 404\"\n Pattern match: \"https://www.torproject.org\"\n Pattern match: \"http://su34pwhpcafeiztt.onion\"\n Pattern match: \"https://www.torproject.org/\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"WMIC.exe\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"WMIC.exe\" had access to \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":7,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system information using Windows Management Instrumentation Commandline (WMIC)","description":"Process \"WMIC.exe\" with commandline \"shadowcopy delete\" (UID: 00014681-00001776)","origin":"Monitored Target","relevance":3,"id":"target-10","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"vssadmin.exe\" opened \"\\Device\\KsecDD\"\n \"WMIC.exe\" opened \"\\Device\\KsecDD\"\n \"wbadmin.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"WMIC.exe\" wrote bytes \"4053ed765858ee76186aee76653cef760000000000bf36750000000056cc3675000000007cca36750000000037682a756a2cef76d62def760000000020692a750000000029a6367500000000a48d2a7500000000f70e367500000000\" to virtual address \"0x76FE1000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"9dd899408f4797694dc31702da664bf046b4a9bee3616477f324b8c89d0768b3.exe.bin\" was detected as \"UPX v1.25 (Delphi) Stub\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"bcdedit.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"wbadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00014406-00003904-00000105-40427105\n \"vssadmin.exe\" at 00014655-00004024-00000105-40465836\n \"WMIC.exe\" at 00014681-00001776-00000105-42361999\n \"wbadmin.exe\" at 00016194-00002264-00000105-44832222","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Tries to suppress failures during boot (often used to hide system changes)","description":"Tries to suppress failures during boot \"cmd.exe\" with commandline \"/C vssadmin.exe delete shadows /all /quiet & wmic.exe shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet\" (UID: 00014646-00003884)\n Tries to suppress failures during boot \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00016153-00002244)","origin":"Monitored Target","relevance":8,"id":"target-6","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 20 calls to GetProcAddress@KERNEL32.DLL at 00014406-00003904-41940-2709-00416102","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"UPX1 with unusual entropies 7.93884727181","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"\"9dd899408f4797694dc31702da664bf046b4a9bee3616477f324b8c89d0768b3.exe.bin\" has a section named \"UPX0\"\n \"9dd899408f4797694dc31702da664bf046b4a9bee3616477f324b8c89d0768b3.exe.bin\" has a section named \"UPX1\"","origin":"Static Parser","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"SOFTWARE\\Oracle\\VirtualBox Guest Additions\" (Indicator: \"virtualbox\")\n \"QEMU\" (Indicator: \"qemu\")\n \"SYSTEM\\ControlSet001\\Services\\VBoxGuest\" (Indicator: \"vbox\")\n \"SYSTEM\\ControlSet001\\Services\\VBoxGuest\" (Indicator: \"vboxguest\")\n \"SYSTEM\\ControlSet001\\Services\\VBoxMouse\" (Indicator: \"vbox\")\n \"SYSTEM\\ControlSet001\\Services\\VBoxMouse\" (Indicator: \"vboxmouse\")\n \"SYSTEM\\ControlSet001\\Services\\VBoxService\" (Indicator: \"vbox\")\n \"SYSTEM\\ControlSet001\\Services\\VBoxService\" (Indicator: \"vboxservice\")\n \"SYSTEM\\ControlSet001\\Services\\VBoxSF\" (Indicator: \"vbox\")\n \"SYSTEM\\ControlSet001\\Services\\VBoxSF\" (Indicator: \"vboxsf\")\n \"SYSTEM\\ControlSet001\\Services\\VBoxVideo\" (Indicator: \"vbox\")\n \"vbox\" (Indicator: \"vbox\")","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"WMIC.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"wbadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/67 reputation engines marked \"https://www.torproject.org\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Disables startup repair","description":"Disables startup repair \"cmd.exe\" with commandline \"/C vssadmin.exe delete shadows /all /quiet & wmic.exe shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet\" (UID: 00014646-00003884)\n Disables startup repair \"bcdedit.exe\" with commandline \"bcdedit /set {default} recoveryenabled no\" (UID: 00016174-00002256)","origin":"Monitored Target","relevance":8,"id":"target-5","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Writes to a start menu file","description":"\"\" wrote to file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\4p49trrw.lnk\"","origin":"API Call","relevance":3,"id":"api-53","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del \"%s\"\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Deletes backup catalog","description":"Deletes backup catalog files using \"wbadmin.exe\" with commandline \"wbadmin delete catalog -quiet\" (UID: 00016194-00002264)","origin":"Monitored Target","relevance":10,"id":"target-80","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"delete shadows /all /quiet\" (UID: 00014655-00004024)\n Deletes volume snapshots files \"WMIC.exe\" with commandline \"shadowcopy delete\" (UID: 00014681-00001776)","origin":"Monitored Target","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"$28","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"/C vssadmin.exe delete shadows /all /quiet & wmic.exe shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet\" (Indicator: \"wmic.exe\")\n \"root\\cimv2\" (Indicator: \"root\\cimv2\")","origin":"File/Memory","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to elevate privileges","description":"BuildExplicitAccessWithNameA@ADVAPI32.DLL at 00014406-00003904-41940-2085-0040F97E","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-44","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"9dd899408f4797694dc31702da664bf046b4a9bee3616477f324b8c89d0768b3.exe.bin\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n VirtualProtect\n GetProcAddress\n LoadLibraryA\n ShellExecuteA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00014406-00003904)\n Spawned process \"cmd.exe\" with commandline \"/C vssadmin.exe delete shadows /all /quiet & wmic.exe shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet\" (UID: 00014646-00003884)\n Spawned process \"vssadmin.exe\" with commandline \"delete shadows /all /quiet\" (UID: 00014655-00004024)\n Spawned process \"WMIC.exe\" with commandline \"shadowcopy delete\" (UID: 00014681-00001776)\n Spawned process \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00016153-00002244)\n Spawned process \"bcdedit.exe\" with commandline \"bcdedit /set {default} recoveryenabled no\" (UID: 00016174-00002256)\n Spawned process \"wbadmin.exe\" with commandline \"wbadmin delete catalog -quiet\" (UID: 00016194-00002264)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the system/video BIOS version","description":"\"\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")","origin":"Registry Access","relevance":9,"id":"registry-6","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the windows product ID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTID\")","origin":"Registry Access","relevance":6,"id":"registry-5","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"21/68 Antivirus vendors marked sample as malicious (30% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"21/68 Antivirus vendors marked sample as malicious (30% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the windows product ID"},{"detail":"Reads the system/video BIOS version"},{"detail":"Reads the windows installation date"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]}]},"activity":{"stats":{"process_count":7,"spawned_processes_count":7,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":13,"imported_dlls_count":75,"dropped_files_count":0,"extracted_files_count":16,"files_written_count":37,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ransomware"],"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"5a8a6af27ca3e14e140b0d04","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Ransom.BTCWare","submit_name":"stub.exe","analysis_start_time":"2018-02-19T07:13:11+00:00","indicators_count":{"informative":24,"suspicious":29,"malicious":5},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}],"processes":[{"pid":3904,"ppid":0,"name":"9dd899408f4797694dc31702da664bf046b4a9bee3616477f324b8c89d0768b3.exe","command_line":"","sha256":"9dd899408f4797694dc31702da664bf046b4a9bee3616477f324b8c89d0768b3","normalized_path":"C:\\9dd899408f4797694dc31702da664bf046b4a9bee3616477f324b8c89d0768b3.exe","uid":"00014406-00003904","icon":"$29"},{"pid":3884,"ppid":3904,"name":"cmd.exe","command_line":"/C vssadmin.exe delete shadows /all /quiet & wmic.exe shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014406-00003904","uid":"00014646-00003884"},{"pid":4024,"ppid":3884,"name":"vssadmin.exe","command_line":"delete shadows /all /quiet","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","parent_uid":"00014646-00003884","uid":"00014655-00004024"},{"pid":1776,"ppid":3884,"name":"WMIC.exe","command_line":"shadowcopy delete","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\System32\\wbem\\WMIC.exe","parent_uid":"00014646-00003884","uid":"00014681-00001776"},{"pid":2244,"ppid":3884,"name":"bcdedit.exe","command_line":"bcdedit /set {default} bootstatuspolicy ignoreallfailures","sha256":"aa501dc5b621527b0e3dd2787d4969647631c4904d3ae9fc06d177251bc760e3","normalized_path":"%WINDIR%\\System32\\bcdedit.exe","parent_uid":"00014646-00003884","uid":"00016153-00002244"},{"pid":2256,"ppid":3884,"name":"bcdedit.exe","command_line":"bcdedit /set {default} recoveryenabled no","sha256":"aa501dc5b621527b0e3dd2787d4969647631c4904d3ae9fc06d177251bc760e3","normalized_path":"%WINDIR%\\System32\\bcdedit.exe","parent_uid":"00014646-00003884","uid":"00016174-00002256"},{"pid":2264,"ppid":3884,"name":"wbadmin.exe","command_line":"wbadmin delete catalog -quiet","sha256":"be527c6085cd944097de35b9740fc4dd24d455567bec596e9cc300d70c5a392d","normalized_path":"%WINDIR%\\System32\\wbadmin.exe","parent_uid":"00014646-00003884","uid":"00016194-00002264"}],"all_imported_dlls":["shell32.dll","imm32.dll","apphelp.dll","vssapi.dll","blb_ps.dll","user32.dll","ntmarta.dll","sfc.dll","tzres.dll","framedynos.dll","nsi.dll","dnsapi.dll","wbemsvc.dll","propsys.dll","ieframe.dll","cryptsp.dll","winbrand.dll","gdi32.dll","clbcatq.dll","cfgmgr32.dll","wbemprox.dll","credui.dll","vsstrace.dll","fastprox.dll","oleaut32.dll","profapi.dll","ntshrui.dll","urlmon.dll","secur32.dll","KernelBase.dll","crypt32.dll","ole32.dll","oleacc.dll","wininet.dll","winnsi.dll","MSOXMLMF.DLL","ntdll.dll","msvcrt.dll","psapi.dll","atl.dll","msxml3r.dll","advapi32.dll","rpcss.dll","comctl32.dll","linkinfo.dll","slc.dll","wbemcomn.dll","ntdsapi.dll","ws2_32.dll","kernel32.dll","msasn1.dll","usp10.dll","cscapi.dll","oleaccrc.dll","msxml3.dll","msvcr90.dll","rpcrt4.dll","msctf.dll","setupapi.dll","sspicli.dll","rsaenh.dll","vss_ps.dll","IPHLPAPI.DLL","sechost.dll","shlwapi.dll","cryptbase.dll","uxtheme.dll","wtsapi32.dll","lpk.dll","devobj.dll","Wldap32.dll","srvcli.dll","sfc_os.dll","RpcRtRemote.dll","iertutil.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"5L9Wjn.txt.Lrcy","sha256":"133007cebef208e7af5071ac6bcf66fb4c2f50ee62eba53e7593120b70fcb1e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"name":"4p49trrw.lnk","sha256":"c0edff3a59c6b956b12a7c0fa13da0c18af51b9f112c3d4e85b4dadf3d5b015c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"name":"1N1A3vlRdYRii5C.mp3.Lrcy","sha256":"219e4d14e3cb57b7256b919ed68473be7405e1adc59609b2c63781ad7bb2e9bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"name":"OfficeMUI.xml.Lrcy","sha256":"4c6580b9cf2e259fd09e558135999b8f981f50e3f82bc44183be1f03f4ea1c27","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"name":"4Pmmh3HlYKPz20b.doc.Lrcy","sha256":"133007cebef208e7af5071ac6bcf66fb4c2f50ee62eba53e7593120b70fcb1e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"name":"#DECRYPT_MY_FILES#.html","sha256":"d78768bd7f9aed423e88d603cf63aea117fb331e9103b8d65c1c1e59457f9404","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"name":"blocklist.xml.Lrcy","sha256":"c1409e9608c9706b1ced26f88b77873590967571972faffacf47f8bd1f161da6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"name":"webappsstore.sqlite.Lrcy","sha256":"8972212ad64375de437ed01efeeadd43b1d6120aee1c5296b03cf003db23a388","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"name":"Setup.xml.Lrcy","sha256":"2ab39ba0500262e335e805ea70c0c453d14f234156a6ca26ac7d5bd808155852","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"name":"Office64WW.xml.Lrcy","sha256":"acd198f29db7c012b716a4f4fdb96418ae453366cc70daa4d01116d3ec6eeea6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"name":"#DECRYPT_MY_FILES#.txt","sha256":"b660c9236f4d6d9b62eb04b40599e852f979dd3dbfd1d03e545a287fe8e5d32b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"name":"Proof.xml.Lrcy","sha256":"1ec7cddce1b28f98ee85c1add8a0727ddbf9163b6e69bd6102450a4c974fd696","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"name":"8Uu9ETpS.avi.Lrcy","sha256":"a6e05b01fb394c7613d608dcbb1077e2e13076379b76de0497b1812d39530e26","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"name":"0zIG0D.doc.Lrcy","sha256":"18af8b52934fe53ef7c09f5edb6fce9c94e66d8a81f36160f9a02e3bc263bc5b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"name":"SiteSecurityServiceState.txt.Lrcy","sha256":"226ba991cbf3c4d437f46e25ff51867655f5456d2e454517bc2a6055f516c01c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"name":"services_rdrk.dat.Lrcy","sha256":"2205bf677eaacdf4b42965d25a9ac69cba82e68c160f7c3634b5332ed4418e98","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"path":"C:\\9dd899408f4797694dc31702da664bf046b4a9bee3616477f324b8c89d0768b3.exe","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\4p49trrw.lnk","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"path":"%WINDIR%\\System32\\en-US\\propsys.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"path":"%WINDIR%\\System32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"path":"%WINDIR%\\System32\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"path":"%WINDIR%\\System32\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"path":"%WINDIR%\\System32\\wbem\\WMIC.exe","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"path":"%WINDIR%\\System32\\wbem\\en-US\\WMIC.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"path":"%WINDIR%\\System32\\wbem\\xsl-mappings.xml","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"path":"%WINDIR%\\System32\\bcdedit.exe","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"path":"%WINDIR%\\System32\\wbadmin.exe","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"path":"%WINDIR%\\System32\\en-US\\wbadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"path":"%WINDIR%\\Logs","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"key":"HKLM\\BCD00000000\\OBJECTS\\{72D3F4C1-B53F-11E4-B6D9-9157CA704B30}\\ELEMENTS\\250000E0\\","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"key":"HKLM\\BCD00000000\\OBJECTS\\{72D3F4C1-B53F-11E4-B6D9-9157CA704B30}\\ELEMENTS\\16000009\\","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\669d6008cfd39e47cf2156d415f70ef1","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"name":"669d6008cfd39e47cf2156d415f70ef1","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!8wbc1of!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!8wbc1of!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!8wbc1of!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5a8a6af27ca3e14e140b0d04"}]}]}},"report_ids":{"sandbox_job_ids":["5a8a6af27ca3e14e140b0d04"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 9dd899408f47… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 9dd899408f47…. Malware family: Trojan.Generic. Threat score 100/100. 22/28 AV engines flagged this file. 4 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9dd899408f4797694dc31702da664bf046b4a9bee3616477f324b8c89d0768b3"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 9dd899408f47… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 9dd899408f47…. Malware family: Trojan.Generic. Threat score 100/100. 22/28 AV engines flagged this file. 4 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9dd899408f4797694dc31702da664bf046b4a9bee3616477f324b8c89d0768b3"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 9dd899408f47… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 9dd899408f47…. Malware family: Trojan.Generic. Threat score 100/100. 22/28 AV engines flagged this file. 4 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]