26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T4c9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.GarrantDecrypt.B.Generic Sample a64dd2f21a42… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a64dd2f21a42…. Malware family: Ransom.GarrantDecrypt.B.Generic. Threat score 100/100. 22/27 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a64dd2f21a42713131f555bea9d0a76918342d696ef6731608a9dbc57b79b32f","keywords":["Malicious","Ransom.GarrantDecrypt.B.Generic","malware analysis","sandbox report","threat intelligence","a64dd2f21a42713131f555bea9d0a76918342d696ef6731608a9dbc57b79b32f"],"about":{"@type":"SoftwareApplication","name":"av2018.exe","applicationCategory":["peexe","executable"],"identifier":"a64dd2f21a42713131f555bea9d0a76918342d696ef6731608a9dbc57b79b32f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom.GarrantDecrypt.B.Generic","antivirusDetections":{"malicious":22,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T452,"/C REG DELETE "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /f" on 2018-3-24.16:46:09.531 "/C REG DELETE "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableRegistryTools" /f" on 2018-3-24.16:46:09.551 "/C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Winmgmt" /v Start /t REG_DWORD /d 2 /f" on 2018-3-24.16:46:09.571 "/C net start Winmgmt" on 2018-3-24.16:46:09.591 "/C reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f" on 2018-3-24.16:46:09.611 "/C reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowInfoTip /t REG_DWORD /d 0 /f" on 2018-3-24.16:46:09.631 "/C reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v FolderContentsInfoTip /t REG_DWORD /d 0 /f" on 2018-3-24.16:46:09.661 "/C reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v StartButtonBalloonTip /t REG_DWORD /d 0 /f" on 2018-3-24.16:46:09.67128:Tba4,Spawned process "cmd.exe" with commandline "/C REG DELETE "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /f" (UID: 00020205-00002236) Spawned process "cmd.exe" with commandline "/C REG DELETE "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableRegistryTools" /f" (UID: 00020206-00002436) Spawned process "cmd.exe" with commandline "/C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Winmgmt" /v Start /t REG_DWORD /d 2 /f" (UID: 00020209-00002540) Spawned process "cmd.exe" with commandline "/C net start Winmgmt" (UID: 00020211-00003980) Spawned process "cmd.exe" with commandline "/C reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f" (UID: 00020213-00002956) Spawned process "cmd.exe" with commandline "/C reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowInfoTip /t REG_DWORD /d 0 /f" (UID: 00020215-00003116) Spawned process "cmd.exe" with commandline "/C reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v FolderContentsInfoTip /t REG_DWORD /d 0 /f" (UID: 00020217-00002456) Spawned process "cmd.exe" with commandline "/C reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v StartButtonBalloonTip /t REG_DWORD /d 0 /f" (UID: 00020219-00001824) Spawned process "reg.exe" with commandline "REG DELETE "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /f" (UID: 00020229-00000348) Spawned process "reg.exe" with commandline "REG DELETE "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableRegistryTools" /f" (UID: 00020231-00001996) Spawned process "reg.exe" with commandline "reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Winmgmt" /v Start /t REG_DWORD /d 2 /f" (UID: 00020235-00002032) Spawned process "net.exe" with commandline "net start Winmgmt" (UID: 00020238-00001988) Spawned process "reg.exe" with commandline "reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f" (UID: 00020240-00001032) Spawned process "reg.exe" with commandline "reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowInfoTip /t REG_DWORD /d 0 /f" (UID: 00020243-00001980) Spawned process "reg.exe" with commandline "reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v FolderContentsInfoTip /t REG_DWORD /d 0 /f" (UID: 00020247-00001120) Spawned process "reg.exe" with commandline "reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v StartButtonBalloonTip /t REG_DWORD /d 0 /f" (UID: 00020250-00001984) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 start Winmgmt" (UID: 00020284-00002596)29:Tbdf,Spawned process "" (UID: 00016919-00002060) Spawned process "cmd.exe" with commandline "/C REG DELETE "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /f" (UID: 00020205-00002236) Spawned process "cmd.exe" with commandline "/C REG DELETE "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableRegistryTools" /f" (UID: 00020206-00002436) Spawned process "cmd.exe" with commandline "/C reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Winmgmt" /v Start /t REG_DWORD /d 2 /f" (UID: 00020209-00002540) Spawned process "cmd.exe" with commandline "/C net start Winmgmt" (UID: 00020211-00003980) Spawned process "cmd.exe" with commandline "/C reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f" (UID: 00020213-00002956) Spawned process "cmd.exe" with commandline "/C reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowInfoTip /t REG_DWORD /d 0 /f" (UID: 00020215-00003116) Spawned process "cmd.exe" with commandline "/C reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v FolderContentsInfoTip /t REG_DWORD /d 0 /f" (UID: 00020217-00002456) Spawned process "cmd.exe" with commandline "/C reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v StartButtonBalloonTip /t REG_DWORD /d 0 /f" (UID: 00020219-00001824) Spawned process "reg.exe" with commandline "REG DELETE "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /f" (UID: 00020229-00000348) Spawned process "reg.exe" with commandline "REG DELETE "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableRegistryTools" /f" (UID: 00020231-00001996) Spawned process "reg.exe" with commandline "reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Winmgmt" /v Start /t REG_DWORD /d 2 /f" (UID: 00020235-00002032) Spawned process "net.exe" with commandline "net start Winmgmt" (UID: 00020238-00001988) Spawned process "reg.exe" with commandline "reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v EnableBalloonTips /t REG_DWORD /d 0 /f" (UID: 00020240-00001032) Spawned process "reg.exe" with commandline "reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowInfoTip /t REG_DWORD /d 0 /f" (UID: 00020243-00001980) Spawned process "reg.exe" with commandline "reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v FolderContentsInfoTip /t REG_DWORD /d 0 /f" (UID: 00020247-00001120) Spawned process "reg.exe" with commandline "reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v StartButtonBalloonTip /t REG_DWORD /d 0 /f" (UID: 00020250-00001984) Spawned process "net1.exe" with commandline "%WINDIR%\system32\net1 start Winmgmt" (UID: 00020284-00002596)2a:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"a64dd2f21a42713131f555bea9d0a76918342d696ef6731608a9dbc57b79b32f","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790717556539,"unified_at":"2026-09-29T21:32:36.539Z","metadata":{"hashes":{"sha256":"a64dd2f21a42713131f555bea9d0a76918342d696ef6731608a9dbc57b79b32f","sha1":"ca99a0cad332fbd5346dc17cef334f741af2f007","md5":"bd20d8afabe658816d06301b8f367c7e","sha512":"f9068ca38b1af6990cef61f8a83c50484e1085fa1a0f102a8bc7e225e580444d1373cef78e8a03f22a85a665c89c59542a9f0e5d8c21c055df49e4a5a16f5ae2","ssdeep":"49152:KOUH1Xq5DXAo3Q/lchXnmF69YH9dIrbU/zuaVJGBgzUgQ7x3fR2CzjUxCl+fnIfk:fGYb3Q/GoF66H9d+Yua9zUgoj7A4GILw","ssdeep_chunks":["49152:KOUH1Xq","49152:OUH1Xq5","49152:UH1Xq5D","49152:H1Xq5DX","49152:1Xq5DXA","49152:Xq5DXAo","49152:q5DXAo3","49152:5DXAo3Q","49152:DXAo3Q/","49152:XAo3Q/l","49152:Ao3Q/lc","49152:o3Q/lch","49152:3Q/lchX","49152:Q/lchXn","49152:/lchXnm","49152:lchXnmF","49152:chXnmF6","49152:hXnmF69","49152:XnmF69Y","49152:nmF69YH","49152:mF69YH9","49152:F69YH9d","49152:69YH9dI","49152:9YH9dIr","49152:YH9dIrb","49152:H9dIrbU","49152:9dIrbU/","49152:dIrbU/z","49152:IrbU/zu","49152:rbU/zua","49152:bU/zuaV","49152:U/zuaVJ","49152:/zuaVJG","49152:zuaVJGB","49152:uaVJGBg","49152:aVJGBgz","49152:VJGBgzU","49152:JGBgzUg","49152:GBgzUgQ","49152:BgzUgQ7","49152:gzUgQ7x","49152:zUgQ7x3","49152:UgQ7x3f","49152:gQ7x3fR","49152:Q7x3fR2","49152:7x3fR2C","49152:x3fR2Cz","49152:3fR2Czj","49152:fR2CzjU","49152:R2CzjUx","49152:2CzjUxC","49152:CzjUxCl","49152:zjUxCl+","49152:jUxCl+f","49152:UxCl+fn","49152:xCl+fnI","49152:Cl+fnIf","49152:l+fnIfk","98304:KOUH1Xq","98304:OUH1Xq5","98304:UH1Xq5D","98304:H1Xq5DX","98304:1Xq5DXA","98304:Xq5DXAo","98304:q5DXAo3","98304:5DXAo3Q","98304:DXAo3Q/","98304:XAo3Q/l","98304:Ao3Q/lc","98304:o3Q/lch","98304:3Q/lchX","98304:Q/lchXn","98304:/lchXnm","98304:lchXnmF","98304:chXnmF6","98304:hXnmF69","98304:XnmF69Y","98304:nmF69YH","98304:mF69YH9","98304:F69YH9d","98304:69YH9dI","98304:9YH9dIr","98304:YH9dIrb","98304:H9dIrbU","98304:9dIrbU/","98304:dIrbU/z","98304:IrbU/zu","98304:rbU/zua","98304:bU/zuaV","98304:U/zuaVJ","98304:/zuaVJG","98304:zuaVJGB","98304:uaVJGBg","98304:aVJGBgz","98304:VJGBgzU","98304:JGBgzUg","98304:GBgzUgQ","98304:BgzUgQ7","98304:gzUgQ7x","98304:zUgQ7x3","98304:UgQ7x3f","98304:gQ7x3fR","98304:Q7x3fR2","98304:7x3fR2C","98304:x3fR2Cz","98304:3fR2Czj","98304:fR2CzjU","98304:R2CzjUx","98304:2CzjUxC","98304:CzjUxCl","98304:zjUxCl+","98304:jUxCl+f","98304:UxCl+fn","98304:xCl+fnI","98304:Cl+fnIf","98304:l+fnIfk","49152:fGYb3Q/","49152:GYb3Q/G","49152:Yb3Q/Go","49152:b3Q/GoF","49152:3Q/GoF6","49152:Q/GoF66","49152:/GoF66H","49152:GoF66H9","49152:oF66H9d","49152:F66H9d+","49152:66H9d+Y","49152:6H9d+Yu","49152:H9d+Yua","49152:9d+Yua9","49152:d+Yua9z","49152:+Yua9zU","49152:Yua9zUg","49152:ua9zUgo","49152:a9zUgoj","49152:9zUgoj7","49152:zUgoj7A","49152:Ugoj7A4","49152:goj7A4G","49152:oj7A4GI","49152:j7A4GIL","49152:7A4GILw"],"imphash":"bf4be44f55bb0802873331a55bb9bc59"},"file_info":{"file_name":"av2018.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":3052032,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1521906209000,"last_seen":1687455957000,"last_multi_scan":1687455957000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive"]},"stats":{"av":{"malicious_count":22,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":18,"suspicious_count":15,"malicious_count":4,"total":37},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Blocker","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/Win32.Blocker","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1319042","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.GarrantDecrypt.B.15F7894C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Ransomware.AVCrypt-6492432-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.GarrantDecrypt.B.15F7894C (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Filecoder.NPZ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/Pactelung.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0052b4561 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Blocker.kwyx","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Ransomware-GKP!BD20D8AFABE6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Blocker.ezhyvs","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/AVCrypt-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_AVCRYPT.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_AVCRYPT.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.BKXF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanRansom.Blocker","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Blocker.Win32.39783","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom.GarrantDecrypt.B.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 22552-1230-00412D66\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00016919-00002060-27480-16-00412D97\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00016919-00002060-27480-785-00412D66","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00016919-00002060-27480-544-0041C673\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00016919-00002060-27480-363-0040FFC6","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00016919-00002060-27480-378-0041E629","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.DLL at 00016919-00002060-27480-491-00403489\n GetVersionExW@KERNEL32.DLL at 00016919-00002060-27480-453-00402742","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"EnumSystemLocalesW@KERNEL32.DLL at 00016919-00002060-27480-185-00414B10\n GetUserDefaultLCID@KERNEL32.DLL at 00016919-00002060-27480-186-00414B7C\n EnumSystemLocalesW@KERNEL32.DLL at 00016919-00002060-27480-215-00421C34\n GetUserDefaultLCID@KERNEL32.DLL at 00016919-00002060-27480-214-004221AA\n EnumSystemLocalesW@KERNEL32.DLL at 00016919-00002060-27480-218-00421C74\n EnumSystemLocalesW@KERNEL32.DLL at 00016919-00002060-27480-216-00421CF1","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersionExW@KERNEL32.DLL (Target: \"av2018.exe\"; Stream UID: \"00016919-00002060-27480-491-00403489\")\n which is directly followed by \"cmp byte ptr [ebp-0Eh], 03h\" and \"jne 0040351Ch\". See related instructions: \"...+101 call 004128B0h+106 add esp, 0Ch+109 mov dword ptr [ebp-00000128h], 0000011Ch+119 lea eax, dword ptr [ebp-00000128h]+125 push eax+126 call dword ptr [0042A074h] ;GetVersionExW+132 cmp byte ptr [ebp-0Eh], 03h+136 jne 0040351Ch\" ... at 00016919-00002060-27480-491-00403489","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00016919-00002060-27480-289-00427579\n GetProcessHeap@KERNEL32.DLL at 00016919-00002060-27480-180-004180C6\n GetProcessHeap@KERNEL32.DLL at 00016919-00002060-27480-481-00402072","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\ADOBE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\.$\"\n \"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\"\n \"DBWinMutex\"\n \".$\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"$27","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$28","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Fonts\\StaticCache.dat\"\n \"\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\msctf.dll.mui\"\n \"cmd.exe\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"cmd.exe\" touched file \"%WINDIR%\\System32\\reg.exe\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"bxp44w3qwwrmuupc.onion\"\n Heuristic match: \"e<@FHn.SE\"\n Pattern match: \"https://www.microsoft.com\"\n Pattern match: \"www.microsoft.com\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"reg.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\WINMGMT\")\n \"reg.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINMGMT\"; Key: \"START\"; Value: \"02000000\")","origin":"Registry Access","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"reg.exe\" wrote bytes \"4053be775858bf77186abf77653cc0770000000000bf5e760000000056cc5e76000000007cca5e76000000003768f3756a2cc077d62dc077000000002069f3750000000029a65e7600000000a48df37500000000f70e5e7600000000\" to virtual address \"0x76051000\" (part of module \"NSI.DLL\")\n \"net.exe\" wrote bytes \"4053be775858bf77186abf77653cc0770000000000bf5e760000000056cc5e76000000007cca5e76000000003768f3756a2cc077d62dc077000000002069f3750000000029a65e7600000000a48df37500000000f70e5e7600000000\" to virtual address \"0x76051000\" (part of module \"NSI.DLL\")\n \"net1.exe\" wrote bytes \"4053be775858bf77186abf77653cc0770000000000bf5e760000000056cc5e76000000007cca5e76000000003768f3756a2cc077d62dc077000000002069f3750000000029a65e7600000000a48df37500000000f70e5e7600000000\" to virtual address \"0x76051000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"av2018.exe.bin\" was detected as \"Microsoft visual C++ 8\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Possibly checks for the presence of an Antivirus engine","description":"\"Malwarebytes\" (Indicator: \"malwarebytes\")","origin":"File/Memory","relevance":3,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.99850790361","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00016919-00002060-27480-792-004162DF","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"WMIC /OUTPUT:CLIPBOARD /Node: \"%userdomain%\" path WIN32_NetworkAdapter where (NetConnectionID=\"Wi-Fi\") get NetConnectionStatus\" (Indicator: \"win32_networkadapter\"; File: \"av2018.exe.bin\")","origin":"File/Memory","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"net1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceExW@KERNEL32.DLL at 00016919-00002060-27480-474-0040A6DA\n FindResourceW@KERNEL32.DLL at 00016919-00002060-27480-475-0040AC01\n LockResource@KERNEL32.DLL at 00016919-00002060-27480-478-00401F5F\n FindResourceW@KERNEL32.DLL at 00016919-00002060-27480-489-00406DD9","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Name: \"%WINDIR%\\System32\\cmd.exe\", Handle: 292)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"taskkill /F /IM \"%s1%\" & ping -n 3 127.0.0.1 > nulattrib -S -H -R \"%s2%\"TYPE nul > \"%s2%\"del /F /Q \"%s2%\"(goto) 2>nul & del \"%~f0\"\"\n \"127.0.0.1\"\n Heuristic match: \"taskkill /F /IM \"%n%\" & ping -n 3 127.0.0.1 > nulattrib -S -H -R \"%p%\"TYPE nul > \"%p%\"del /F /Q \"%p%\"taskkill /F /IM \"%s1%\" & ping -n 3 127.0.0.1 > nulattrib -S -H -R \"%s2%\"TYPE nul > \"%s2%\"del /F /Q \"%s2%\"REG DELETE \"HKEY_LOCAL_MACHINE\\SOFTWA\", Heuristic match: \"ll /F /IM \"%s1%\" & ping -n 3 127.0.0.1 > nulattrib -S -H -R \"%s2%\"TYPE nul > \"%s2%\"del /F /Q \"%s2%\"(goto) 2>nul & del \"%~f0\"\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"WMIC /OUTPUT:CLIPBOARD /Node: \"%userdomain%\" path WIN32_NetworkAdapter where (NetConnectionID=\"Wi-Fi\") get NetConnectionStatus\" (Indicator: \"/node:\")","origin":"File/Memory","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00016919-00002060-27480-490-00407043","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.DLL at 00016919-00002060-27480-451-00402309","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"level":"suspicious","category":"System Security","name":"Tries to delete registry keys using reg.exe","description":"Process \"cmd.exe\" with commandline \"/C REG DELETE \"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System\" /v \"DisableCMD\" /f\" (UID: 00020205-00002236)\n Process \"cmd.exe\" with commandline \"/C REG DELETE \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" /v \"DisableRegistryTools\" /f\" (UID: 00020206-00002436)\n Process \"reg.exe\" with commandline \"REG DELETE \"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System\" /v \"DisableCMD\" /f\" (UID: 00020229-00000348)\n Process \"reg.exe\" with commandline \"REG DELETE \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" /v \"DisableRegistryTools\" /f\" (UID: 00020231-00001996)","origin":"Monitored Target","relevance":5,"id":"target-24","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n OpenProcessToken\n RegOpenKeyExW\n CryptEncrypt\n GetDriveTypeW\n GetFileAttributesW\n FindResourceExW\n OutputDebugStringW\n OutputDebugStringA\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n LoadLibraryExW\n CreateThread\n TerminateProcess\n GetModuleHandleExW\n GetProcAddress\n CreateToolhelp32Snapshot\n LoadLibraryW\n GetVersionExW\n GetStartupInfoW\n WriteFile\n FindNextFileW\n FindFirstFileExW\n CreateFileW\n FindResourceW\n Process32NextW\n LockResource\n GetCommandLineA\n Process32FirstW\n UnhandledExceptionFilter\n GetModuleHandleW\n GetTempPathW\n CreateProcessW\n Sleep\n ShellExecuteExW\n FindWindowW\n socket\n send\n WSAStartup\n connect","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"net.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"net1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$29","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"38/66 Antivirus vendors marked sample as malicious (57% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"38/66 Antivirus vendors marked sample as malicious (57% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"level":"malicious","category":"System Security","name":"References security related windows services","description":"\"wscsvc\" (Indicator: \"wscsvc\")\n \"wuauserv\" (Indicator: \"wuauserv\")","origin":"File/Memory","relevance":7,"id":"string-43","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"level":"malicious","category":"Unusual Characteristics","name":"References BIOS/BOOT related strings","description":"\"ntldr\"","origin":"File/Memory","relevance":9,"id":"string-0","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]}],"incidents":[{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Possibly checks for the presence of an Antivirus engine"},{"detail":"References security related windows services"}],"sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]}]},"activity":{"stats":{"process_count":18,"spawned_processes_count":18,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":45,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":9,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":1,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["evasive"],"sandbox_reports":[{"id":"5ab672207ca3e134ad482306","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"av2018.exe","analysis_start_time":"2018-03-24T16:43:39+00:00","indicators_count":{"informative":18,"suspicious":19,"malicious":5},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}],"processes":[{"pid":2060,"ppid":0,"name":"av2018.exe","command_line":"","sha256":"a64dd2f21a42713131f555bea9d0a76918342d696ef6731608a9dbc57b79b32f","normalized_path":"C:\\av2018.exe","uid":"00016919-00002060","icon":"$2a"},{"pid":2236,"ppid":2060,"name":"cmd.exe","command_line":"/C REG DELETE \"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System\" /v \"DisableCMD\" /f","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00016919-00002060","uid":"00020205-00002236"},{"pid":348,"ppid":2236,"name":"reg.exe","command_line":"REG DELETE \"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System\" /v \"DisableCMD\" /f","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00020205-00002236","uid":"00020229-00000348"},{"pid":2436,"ppid":2060,"name":"cmd.exe","command_line":"/C REG DELETE \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" /v \"DisableRegistryTools\" /f","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00016919-00002060","uid":"00020206-00002436"},{"pid":1996,"ppid":2436,"name":"reg.exe","command_line":"REG DELETE \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" /v \"DisableRegistryTools\" /f","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00020206-00002436","uid":"00020231-00001996"},{"pid":2540,"ppid":2060,"name":"cmd.exe","command_line":"/C reg add \"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\services\\Winmgmt\" /v Start /t REG_DWORD /d 2 /f","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00016919-00002060","uid":"00020209-00002540"},{"pid":2032,"ppid":2540,"name":"reg.exe","command_line":"reg add \"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\services\\Winmgmt\" /v Start /t REG_DWORD /d 2 /f","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00020209-00002540","uid":"00020235-00002032"},{"pid":3980,"ppid":2060,"name":"cmd.exe","command_line":"/C net start Winmgmt","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00016919-00002060","uid":"00020211-00003980"},{"pid":1988,"ppid":3980,"name":"net.exe","command_line":"net start Winmgmt","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","normalized_path":"%WINDIR%\\System32\\net.exe","parent_uid":"00020211-00003980","uid":"00020238-00001988"},{"pid":2596,"ppid":1988,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 start Winmgmt","sha256":"a0be13ac9443acc6d2eea474cc82a727bdb7e1009f573dba34d269f9a6aaa347","normalized_path":"%WINDIR%\\System32\\net1.exe","parent_uid":"00020238-00001988","uid":"00020284-00002596"},{"pid":2956,"ppid":2060,"name":"cmd.exe","command_line":"/C reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\" /v EnableBalloonTips /t REG_DWORD /d 0 /f","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00016919-00002060","uid":"00020213-00002956"},{"pid":1032,"ppid":2956,"name":"reg.exe","command_line":"reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\" /v EnableBalloonTips /t REG_DWORD /d 0 /f","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00020213-00002956","uid":"00020240-00001032"},{"pid":3116,"ppid":2060,"name":"cmd.exe","command_line":"/C reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\" /v ShowInfoTip /t REG_DWORD /d 0 /f","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00016919-00002060","uid":"00020215-00003116"},{"pid":1980,"ppid":3116,"name":"reg.exe","command_line":"reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\" /v ShowInfoTip /t REG_DWORD /d 0 /f","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00020215-00003116","uid":"00020243-00001980"},{"pid":2456,"ppid":2060,"name":"cmd.exe","command_line":"/C reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\" /v FolderContentsInfoTip /t REG_DWORD /d 0 /f","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00016919-00002060","uid":"00020217-00002456"},{"pid":1120,"ppid":2456,"name":"reg.exe","command_line":"reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\" /v FolderContentsInfoTip /t REG_DWORD /d 0 /f","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00020217-00002456","uid":"00020247-00001120"},{"pid":1824,"ppid":2060,"name":"cmd.exe","command_line":"/C reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\" /v StartButtonBalloonTip /t REG_DWORD /d 0 /f","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00016919-00002060","uid":"00020219-00001824"},{"pid":1984,"ppid":1824,"name":"reg.exe","command_line":"reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\" /v StartButtonBalloonTip /t REG_DWORD /d 0 /f","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00020219-00001824","uid":"00020250-00001984"}],"all_imported_dlls":["usp10.dll","advapi32.dll","rpcrt4.dll","shlwapi.dll","netutils.dll","wkscli.dll","netapi32.dll","KernelBase.dll","ole32.dll","iertutil.dll","dwmapi.dll","clbcatq.dll","samcli.dll","IPHLPAPI.DLL","ntdsapi.dll","ntdll.dll","msasn1.dll","crypt32.dll","msctf.dll","cryptbase.dll","srvcli.dll","kernel32.dll","browcli.dll","netmsg.dll","shell32.dll","oleaut32.dll","uxtheme.dll","apphelp.dll","mpr.dll","winnsi.dll","msvcrt.dll","sechost.dll","urlmon.dll","dsrole.dll","logoncli.dll","samlib.dll","user32.dll","gdi32.dll","comctl32.dll","wininet.dll","ws2_32.dll","nsi.dll","imm32.dll","winbrand.dll","lpk.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"path":"%WINDIR%\\System32\\reg.exe","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"path":"%WINDIR%\\System32\\en-US\\reg.exe.mui","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"path":"%WINDIR%\\System32\\en-US\\netmsg.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\WINMGMT\\","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\ADVANCED\\","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SYSTEM\\DISABLECMD\\DISABLECMD","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\.$","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]},{"name":".$","sources":[{"report_type":"sandbox","report_id":"5ab672207ca3e134ad482306"}]}]}},"report_ids":{"sandbox_job_ids":["5ab672207ca3e134ad482306"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Ransom.GarrantDecrypt.B.Generic Sample a64dd2f21a42… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample a64dd2f21a42…. Malware family: Ransom.GarrantDecrypt.B.Generic. Threat score 100/100. 22/27 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/a64dd2f21a42713131f555bea9d0a76918342d696ef6731608a9dbc57b79b32f"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom.GarrantDecrypt.B.Generic Sample a64dd2f21a42… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample a64dd2f21a42…. Malware family: Ransom.GarrantDecrypt.B.Generic. Threat score 100/100. 22/27 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/a64dd2f21a42713131f555bea9d0a76918342d696ef6731608a9dbc57b79b32f"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom.GarrantDecrypt.B.Generic Sample a64dd2f21a42… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample a64dd2f21a42…. Malware family: Ransom.GarrantDecrypt.B.Generic. Threat score 100/100. 22/27 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]