26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T49a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom_.D1B0399C Sample afc319403803… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample afc319403803…. Malware family: Ransom_.D1B0399C. Threat score 100/100. 20/28 AV engines flagged this file. 11 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/afc31940380359380f27cd0cbcc18f9eb67027107d434d190a725f124b1b554e","keywords":["Malicious","Ransom_.D1B0399C","malware analysis","sandbox report","threat intelligence","afc31940380359380f27cd0cbcc18f9eb67027107d434d190a725f124b1b554e"],"about":{"@type":"SoftwareApplication","name":"shoppinwithus-mal.bin","applicationCategory":["peexe","executable"],"identifier":"afc31940380359380f27cd0cbcc18f9eb67027107d434d190a725f124b1b554e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom_.D1B0399C","antivirusDetections":{"malicious":20,"total":28},"behavioralIndicators":{"malicious":11,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4ac,GetVersionExA@KERNEL32.DLL at 00013792-00002500-35243-13-00401B54 GetVersionExA@KERNEL32.DLL at 00013792-00002500-35243-6-00401BB4 GetVersionExA@KERNEL32.DLL at 00013792-00002500-35243-3-00402465 GetVersionExA@KERNEL32.DLL at 00013792-00002500-35243-15-004018F7 GetVersionExA@KERNEL32.DLL at 00013792-00002500-35243-10-00401D89 GetVersionExA@KERNEL32.DLL at 00013792-00002500-35243-9-00402057 GetVersionExA@KERNEL32.DLL at 00013792-00002500-35243-34-00401987 GetVersionExA@KERNEL32.DLL at 00013792-00002500-35243-2-0040281A GetVersionExA@KERNEL32.DLL at 00013792-00002500-35243-12-00401CEC GetVersionExA@KERNEL32.DLL at 00024233-00000808-37810-15-004018F7 GetVersionExA@KERNEL32.DLL at 00024233-00000808-37810-12-00401CEC GetVersionExA@KERNEL32.DLL at 00024233-00000808-37810-6-00401BB4 GetVersionExA@KERNEL32.DLL at 00024233-00000808-37810-13-00401B54 GetVersionExA@KERNEL32.DLL at 00024233-00000808-37810-3-00402465 GetVersionExA@KERNEL32.DLL at 00024233-00000808-37810-2-0040281A GetVersionExA@KERNEL32.DLL at 00024233-00000808-37810-9-00402057 GetVersionExA@KERNEL32.DLL at 00024233-00000808-37810-34-00401987 GetVersionExA@KERNEL32.DLL at 00024233-00000808-37810-10-00401D8928:T407,"" wrote bytes "4053267758582777186a2777653c28770000000000bf3c770000000056cc3c77000000007cca3c7700000000376843756a2c2877d62d287700000000206943750000000029a63c7700000000a48d437500000000f70e3c7700000000" to virtual address "0x76B61000" (part of module "NSI.DLL") "msiexec.exe" wrote bytes "4053267758582777186a2777653c28770000000000bf3c770000000056cc3c77000000007cca3c7700000000376843756a2c2877d62d287700000000206943750000000029a63c7700000000a48d437500000000f70e3c7700000000" to virtual address "0x76B61000" (part of module "NSI.DLL") "msiexec.exe" wrote bytes "92e6237779a82877be722877d62d28771de2237705a22877bee32377616f2877684126770050267700000000ad378b758b2d8b75b6418b7500000000" to virtual address "0x74881000" (part of module "WSHTCPIP.DLL") "yMSBuild" wrote bytes "4053267758582777186a2777653c28770000000000bf3c770000000056cc3c77000000007cca3c7700000000376843756a2c2877d62d287700000000206943750000000029a63c7700000000a48d437500000000f70e3c7700000000" to virtual address "0x76B61000" (part of module "NSI.DLL")29:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAHeIj/+Ph4cAAAAAAAB3eIiIj/////+IiId3d2eIiIiIiIj/////eHd3d2SIiIiIiIiI/////3d3d2Z4iIiIiIiIj/////93d3Z4iIiIiIiIiP//////d3dniIiIiIiIiIiP/////3d2iIiIiIiIiIiIiIiIj/93aIiIiIiHiIiId3dEiIh3d3iIiId3d3d2AERmSIiIcHeIiHdnd2ZkREAARHiIiHB4iId3d0AABGd3iI/4iIh3eIhmd3eIiI//////eIiICHiGiIiI/////////3iIiIh4Znd4j/////////h4iIiAeGZmZmaP///////3eHiIcHdmZmd3Z4//////93d4iHB3ZmZmZmZEj///j4d3d3hwZ2ZkRERERAj/+I93d3d4cGdGZmZAREdG/4iId3d3eHBnZmZ3eI/4Rm+IiHd3d3hwZ3eP////92do+Id3d3d3cGZERo+I//RmZ/iHd3d3d3BnRERH/4+EZmaIhnd3d3dwZ0RmRG//dGZmeHZ3d3d3cGdERERH+EZmZn9mZ3d3d3BnRERERPhGZmZ4ZmZ3d3dgZkRERESHRmZmd2ZmZnd3YGZEREREhkRGZmZmZmZnd2BmRERERGRERERERmZmZmZAd3d3d3d3d3d3d3d3d3d4cIh3d3d3d3d3d3d3d3eIiIYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==2a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAd3AAAAAAAAAAAAAAAAAAd4iI5gAAAAAAAAePjwAAB4iIiOZoAAAAAAAH+PgHAHiIiI5miIAAAAAAB4+PCHB4iIiGaI/wAAAAAAf4+AeHiIiIho///wAAAAAHj48Id4iIiAD/+IgAAAAAB/j4B4eIiIAAB3eIAAAAAAePjwh3d3dwAAiHdwAAAAAH+PgHh/+I7gCI+IgAAAAAB///CHf47md4iI+IAAAAAAf//weHfuZ3iIiI8AAAAAAH//8IeH5meIiIiICIiIAAB///CIiHZ3iIiIgAAAiHAAf//wiIgHd4iIgAd3d4hwAH//8IiID/d3d3//////cAB3d3CIiAd3d3d3d3d3eHAAd3dwiIgAAAAAAAAAAACAB///9wiIB4iIiIiIiIiHAHd3d3dwiAf/////////hwAAAAd3dwgH9ERERERET4cAAAAAd3dwB/TohmZszE+HAAAAAAf//wf0/ohmZsxPhwAAAAAAd3dw9O/ohmZsT4cAAAAAAAAAB/T+/ohmZk+HAAAAAAAAAAf07+/ohmZPhwAAAAAAAAAH9I7+/ohmT4cAAAAAAAAAB/SI7+/ohk+HAAAAAAAAAAf0iI7+/ohPhwAAAAAAAAAH9ERERERET4cAAAAAAAAAB/////////+HAAAAAAAAAAB3d3d3d3d3dwD//gf/wPgB/8BwAP/AIAB/wAAAf8AAAD/AAAA/wABgP8AAYD/AAAA/wAAAP8AAAAPAAAABwAAAAMAAAADAAAAAwAAAAMAAAACAAAABAAAAAfgAAAH8AAAB/gAAAf8AAAH/+AAB//gAAf/4AAH/+AAB//gAAf/4AAH/+AAB//wAAw==2b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAHeIj/+Ph4cAAAAAAAB3eIiIj/////+IiId3d2eIiIiIiIj/////eHd3d2SIiIiIiIiI/////3d3d2Z4iIiIiIiIj/////93d3Z4iIiIiIiIiP//////d3dniIiIiIiIiIiP/////3d2iIiIiIiIiIiIiIiIj/93aIiIiIiHiIiId3dEiIh3d3iIiId3d3d2AERmSIiIcHeIiHdnd2ZkREAARHiIiHB4iId3d0AABGd3iI/4iIh3eIhmd3eIiI//////eIiICHiGiIiI/////////3iIiIh4Znd4j/////////h4iIiAeGZmZmaP///////3eHiIcHdmZmd3Z4//////93d4iHB3ZmZmZmZEj///j4d3d3hwZ2ZkRERERAj/+I93d3d4cGdGZmZAREdG/4iId3d3eHBnZmZ3eI/4Rm+IiHd3d3hwZ3eP////92do+Id3d3d3cGZERo+I//RmZ/iHd3d3d3BnRERH/4+EZmaIhnd3d3dwZ0RmRG//dGZmeHZ3d3d3cGdERERH+EZmZn9mZ3d3d3BnRERERPhGZmZ4ZmZ3d3dgZkRERESHRmZmd2ZmZnd3YGZEREREhkRGZmZmZmZnd2BmRERERGRERERERmZmZmZAd3d3d3d3d3d3d3d3d3d4cIh3d3d3d3d3d3d3d3eIiIYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==2c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAd3AAAAAAAAAAAAAAAAAAd4iI5gAAAAAAAAePjwAAB4iIiOZoAAAAAAAH+PgHAHiIiI5miIAAAAAAB4+PCHB4iIiGaI/wAAAAAAf4+AeHiIiIho///wAAAAAHj48Id4iIiAD/+IgAAAAAB/j4B4eIiIAAB3eIAAAAAAePjwh3d3dwAAiHdwAAAAAH+PgHh/+I7gCI+IgAAAAAB///CHf47md4iI+IAAAAAAf//weHfuZ3iIiI8AAAAAAH//8IeH5meIiIiICIiIAAB///CIiHZ3iIiIgAAAiHAAf//wiIgHd4iIgAd3d4hwAH//8IiID/d3d3//////cAB3d3CIiAd3d3d3d3d3eHAAd3dwiIgAAAAAAAAAAACAB///9wiIB4iIiIiIiIiHAHd3d3dwiAf/////////hwAAAAd3dwgH9ERERERET4cAAAAAd3dwB/TohmZszE+HAAAAAAf//wf0/ohmZsxPhwAAAAAAd3dw9O/ohmZsT4cAAAAAAAAAB/T+/ohmZk+HAAAAAAAAAAf07+/ohmZPhwAAAAAAAAAH9I7+/ohmT4cAAAAAAAAAB/SI7+/ohk+HAAAAAAAAAAf0iI7+/ohPhwAAAAAAAAAH9ERERERET4cAAAAAAAAAB/////////+HAAAAAAAAAAB3d3d3d3d3dwD//gf/wPgB/8BwAP/AIAB/wAAAf8AAAD/AAAA/wABgP8AAYD/AAAA/wAAAP8AAAAPAAAABwAAAAMAAAADAAAAAwAAAAMAAAACAAAABAAAAAfgAAAH8AAAB/gAAAf8AAAH/+AAB//gAAf/4AAH/+AAB//gAAf/4AAH/+AAB//wAAw==2d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAABmZmZgAAAAAAZmZmYAAAAGeIiIZgAAAAAGiIiGYAB3d3iIiHd3d3d3dod3hnd3iPiIiIh4iIiIiIaIiIa7t4+IiIiIeIiIiIu2iIiGu7ePiIiIiHiIiIiIhoiIh7u3j4iIiIiId3d3d2eIiIiLt4+IiIiIiIiIiIiIiIj4i7ePiIiP/4iIiIiIiIiI+Iu3j4+P//+IiIiIiIiIiPiLh4+Pj////////4iIiIj4i4eP/4///4iIiIiIiIj/iIiHj//4iI+IiIh3d3d3d4iIh4/////4+IiIiIiIiIiIiIeP////iI+IiIiIiIiIiIiHj/////iI+IiIiIiIiIiIh4//////iIiIiIiIiIiIiIeP//////+IiIiIiIiIiIiHj///////+IiIiIiIiIiIh4/////////4j///////iIeP//////////+IiIiHd3eHiP/////////4iIiIiIiIh4iIiIiIiIiIiIjub///iIeIiIiIiIiIiIiI7u///4iHiIiIiIiImZ//iIh3d3d3dwiIiIiIiJmf///4iIiIiHAIiKov/4iIiIiId3d3d3dwCIiqr///+Ih3AAAAAAAAAACIiIiIiIiHcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwH/gP4A/4BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAYAAAAGAAD//wAB//////////////////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"afc31940380359380f27cd0cbcc18f9eb67027107d434d190a725f124b1b554e","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790312232333,"unified_at":"2026-09-25T04:57:12.333Z","metadata":{"hashes":{"sha256":"afc31940380359380f27cd0cbcc18f9eb67027107d434d190a725f124b1b554e","sha1":"bd9ef4d37e58cbd4d0f120762c9106ff7622435a","md5":"f2c483d4f3fcb85dcaa303e5d1512c63","sha512":"bbb18b404fd9733552d2ff73031a5a37443b1283ecba0414b037c8ed134a3d3e3662354c8744f3b0fb7c87b6d121f8a72b69f39b7f8ca1904f2d67cb4e7fa4b3","ssdeep":"3072:N+Qf2mOWASsbGC+DfLq8tvAqaz7rKHL0+PNqgVecTX:N5UbRAb9uz7gNqgg","ssdeep_chunks":["3072:N+Qf2mO","3072:+Qf2mOW","3072:Qf2mOWA","3072:f2mOWAS","3072:2mOWASs","3072:mOWASsb","3072:OWASsbG","3072:WASsbGC","3072:ASsbGC+","3072:SsbGC+D","3072:sbGC+Df","3072:bGC+DfL","3072:GC+DfLq","3072:C+DfLq8","3072:+DfLq8t","3072:DfLq8tv","3072:fLq8tvA","3072:Lq8tvAq","3072:q8tvAqa","3072:8tvAqaz","3072:tvAqaz7","3072:vAqaz7r","3072:Aqaz7rK","3072:qaz7rKH","3072:az7rKHL","3072:z7rKHL0","3072:7rKHL0+","3072:rKHL0+P","3072:KHL0+PN","3072:HL0+PNq","3072:L0+PNqg","3072:0+PNqgV","3072:+PNqgVe","3072:PNqgVec","3072:NqgVecT","3072:qgVecTX","6144:N+Qf2mO","6144:+Qf2mOW","6144:Qf2mOWA","6144:f2mOWAS","6144:2mOWASs","6144:mOWASsb","6144:OWASsbG","6144:WASsbGC","6144:ASsbGC+","6144:SsbGC+D","6144:sbGC+Df","6144:bGC+DfL","6144:GC+DfLq","6144:C+DfLq8","6144:+DfLq8t","6144:DfLq8tv","6144:fLq8tvA","6144:Lq8tvAq","6144:q8tvAqa","6144:8tvAqaz","6144:tvAqaz7","6144:vAqaz7r","6144:Aqaz7rK","6144:qaz7rKH","6144:az7rKHL","6144:z7rKHL0","6144:7rKHL0+","6144:rKHL0+P","6144:KHL0+PN","6144:HL0+PNq","6144:L0+PNqg","6144:0+PNqgV","6144:+PNqgVe","6144:PNqgVec","6144:NqgVecT","6144:qgVecTX","3072:N5UbRAb","3072:5UbRAb9","3072:UbRAb9u","3072:bRAb9uz","3072:RAb9uz7","3072:Ab9uz7g","3072:b9uz7gN","3072:9uz7gNq","3072:uz7gNqg","3072:z7gNqgg"],"imphash":"4ec8517c810a7c326d3097900109b19e"},"file_info":{"file_name":"shoppinwithus-mal.bin","file_type":["peexe","executable"],"file_type_id":"exe","file_size":214528,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499286599000,"last_seen":1678628258000,"last_multi_scan":1678628258000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["banker","chthonic","zeus"]},"stats":{"av":{"malicious_count":20,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":8,"suspicious_count":10,"malicious_count":11,"total":29},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Win-Trojan/Cerber.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/Win32.Blocker","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1207837","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Cerbu.96634","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Malware.Razy-7665618-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.Ransom.Cerber.FTV","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Kryptik.CUI.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Cerbu.96634 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.FTJG trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HEUR:VirTool/Obfuscator.gen!B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005224381 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Ransomware-GBN!F2C483D4F3FC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Kryptik.eqapfk","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Cerber-K","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_.D1B0399C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_.D1B0399C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Worm.Gamarue","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Kryptik.Win32.1226099","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom_.D1B0399C","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"$27","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"letit2.bit\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"45.63.99.180:53\"\n \"45.32.28.232:53\"\n \"108.61.164.218:53\"\n \"45.56.117.118:53\"\n \"23.94.5.133:53\"\n \"47.91.124.165:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\{0AC140EE-5257-04A2-0A57-CCDBE577D2BD}\"\n \"\\Sessions\\1\\BaseNamedObjects\\{492F4B09-6AFD-C1F1-7241-D45861E75FB4}\"\n \"\\Sessions\\1\\BaseNamedObjects\\{DD3B203F-DC34-5776-2021-796758D1345A}\"\n \"\\Sessions\\1\\BaseNamedObjects\\{1D1343A4-052D-F03E-B897-EA8F65B7EC33}\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\{AF78DD85-60DA-8ECB-7AEF-93911D816F5C}\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\{64D4A589-F027-EBF0-4F6B-30187CAF7D3D}\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\{1AF0FC67-7CD4-B794-90CB-63EE02F20D12}\"\n \"\\Sessions\\1\\BaseNamedObjects\\{E9F4C391-E567-3F41-192A-76FCBE1E01F1}\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"msiexec.exe\" (UID: 00014043-00002856) was launched with new environment variables: \"__COMPAT_LAYER=\"VistaSetup\"\"\n Process \"yMSBuild\" (UID: 00024233-00000808) was launched with missing environment variables: \"__COMPAT_LAYER\"\n Process \"msiexec.exe\" (UID: 00024461-00003888) was launched with new environment variables: \"__COMPAT_LAYER=\"VistaSetup\"\"\n Process \"explorer.exe\" (UID: 00026746-00001264) was launched with new environment variables: \"SESSIONNAME=\"Console\"\"\n Process \"explorer.exe\" (UID: 00026746-00001264) was launched with missing environment variables: \"PROMPT, MpConfig_ProductUserAppDataPath, MpConfig_ProductAppDataPath, MpConfig_ProductPath, __COMPAT_LAYER, MpConfig_ProductCodeName, MpConfig_ReportingGUID\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"msiexec.exe\" (UID: 00014043-00002856)\n Spawned process \"yMSBuild\" (UID: 00024233-00000808)\n Spawned process \"msiexec.exe\" (UID: 00024461-00003888)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"YMSBuild.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"yMSBuild\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\AppPatch\\AcSpecfc.DLL\"\n \"\" touched file \"%WINDIR%\\AppPatch\\AcLayers.DLL\"\n \"\" touched file \"%WINDIR%\\AppPatch\\AcGenral.DLL\"\n \"\" touched file \"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui\"\n \"yMSBuild\" touched file \"%WINDIR%\\AppPatch\\AcSpecfc.DLL\"\n \"yMSBuild\" touched file \"%WINDIR%\\AppPatch\\AcLayers.DLL\"\n \"yMSBuild\" touched file \"%WINDIR%\\AppPatch\\AcGenral.DLL\"\n \"yMSBuild\" touched file \"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"msiexec.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"yMSBuild\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"msiexec.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_ALL_ACCESS\" (0xf003f)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"\"POST /home/ HTTP/1.0\nHost: letit2.bit\nContent-Length: 896\" with no payload\n \"POST /home/ HTTP/1.0\nHost: letit2.bit\nContent-Length: 880\" with no payload\n \"POST /home/www/ HTTP/1.0\nHost: letit2.bit\nContent-Length: 240\" with no payload\n \"POST /home/ HTTP/1.0\nHost: letit2.bit\nContent-Length: 928\" with no payload\n \"POST /home/ HTTP/1.0\nHost: letit2.bit\nContent-Length: 944\" with no payload","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"msiexec.exe\" called \"OpenService\" to access the \"wscsvc\" service\n \"msiexec.exe\" called \"OpenService\" to access the \"\" service\n \"msiexec.exe\" called \"OpenService\" to access the \"SharedAccess\" service\n \"msiexec.exe\" called \"OpenService\" to access the \"MpsSvc\" service\n \"msiexec.exe\" called \"OpenService\" to access the \"WinDefend\" service\n \"msiexec.exe\" called \"OpenService\" to access the \"wuauserv\" service\n \"msiexec.exe\" called \"OpenService\" to access the \"WdNisSvc\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"level":"suspicious","category":"General","name":"Sent a control code to a service","description":"\"msiexec.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"wscsvc\"\n \"msiexec.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"SharedAccess\"\n \"msiexec.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"MpsSvc\"\n \"msiexec.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"WinDefend\"\n \"msiexec.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"wuauserv\"","origin":"API Call","relevance":10,"id":"api-75","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"YMSBuild.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"yMSBuild\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"level":"suspicious","category":"System Security","name":"Modifies IE Phishing Filter","description":"\"msiexec.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\PHISHINGFILTER\")\n \"msiexec.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\PHISHINGFILTER\"; Key: \"ENABLEDV8\")\n \"msiexec.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\PHISHINGFILTER\"; Key: \"ENABLEDV9\")\n \"msiexec.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\PHISHINGFILTER\")\n \"msiexec.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\PHISHINGFILTER\"; Key: \"ENABLEDV8\")\n \"msiexec.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\PHISHINGFILTER\"; Key: \"ENABLEDV9\")","origin":"Registry Access","relevance":5,"id":"registry-45","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegDeleteKeyA\n RegCloseKey\n RegCreateKeyExA\n RegCreateKeyA\n SetSecurityDescriptorDacl\n RegOpenKeyA\n OpenProcessToken\n RegOpenKeyExW\n RegOpenKeyExA\n RegDeleteValueA\n RegEnumKeyA\n RegEnumKeyExA\n VirtualAllocEx\n GetModuleHandleA\n GetModuleFileNameW\n CreateFileW\n GetTempPathW\n GetStartupInfoW\n ShellExecuteExA\n ShellExecuteA\n FindWindowA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$28","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the windows product ID","description":"\"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"DIGITALPRODUCTID\")","origin":"Registry Access","relevance":6,"id":"registry-5","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"level":"malicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ETPRO TROJAN Possible Chthonic DNS Lookup\" (SID: 2826593, Rev: 4, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)\n Detected alert \"ET TROJAN Chthonic Checkin\" (SID: 2017584, Rev: 7, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into explorer","description":"Injected into \"explorer.exe\" (UID: 00026746-00001264)","origin":"Monitored Target","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into remote processes","description":"Injected into \"explorer.exe\" at 2017-6-16.22:57:37.003 (UID: 00026746-00001264)","origin":"Monitored Target","relevance":6,"id":"target-0","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 1500 bytes to a remote process \"%WINDIR%\\System32\\msiexec.exe\" (Handle: 73388)\n \"\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\msiexec.exe\" (Handle: 73388)\n \"\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\msiexec.exe\" (Handle: 73388)\n \"\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\msiexec.exe\" (Handle: 73388)\n \"\" wrote 290 bytes to a remote process \"%WINDIR%\\System32\\msiexec.exe\" (Handle: 73388)\n \"yMSBuild\" wrote 1500 bytes to a remote process \"%WINDIR%\\System32\\msiexec.exe\" (Handle: 73388)\n \"yMSBuild\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\msiexec.exe\" (Handle: 73388)\n \"yMSBuild\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\msiexec.exe\" (Handle: 73388)\n \"yMSBuild\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\msiexec.exe\" (Handle: 73388)\n \"yMSBuild\" wrote 290 bytes to a remote process \"%WINDIR%\\System32\\msiexec.exe\" (Handle: 73388)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"Found malicious artifacts related to \"108.61.164.218\" (ASN: 20473, Owner: Choopa, LLC): ...\nFile SHA256: 1f376d4c4febcafa6bdcf8877121c20697046c15f71983a9210762fbf3b5455e (AV positives: 4/56 scanned on 11/24/2016 08:29:58)\n File SHA256: b01756a3f4b8d687a9fce4301f5f56b4dfb7befe29550096b262935f63f02cc4 (AV positives: 6/56 scanned on 11/18/2016 07:52:59)\n File SHA256: 829797843357a5417f4de7b7f8f970ccfaccf30ecc80ed9c15e796897012d3e5 (AV positives: 6/56 scanned on 11/17/2016 18:26:46)\n File SHA256: 35f636b1876b17b923486924ebe629a98465b480f6635c9db09a16814a5eada3 (AV positives: 24/56 scanned on 10/28/2016 13:40:30)","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"level":"malicious","category":"System Security","name":"Modifies the UAC/LUA settings (Account Control)","description":"\"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\SYSTEM\"; Key: \"ENABLELUA\"; Value: \"00000000\")","origin":"Registry Access","relevance":8,"id":"registry-10","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"level":"malicious","category":"System Security","name":"References security related windows services","description":"\"wscsvc\" (Indicator: \"wscsvc\")\n \"wuauserv\" (Indicator: \"wuauserv\")","origin":"File/Memory","relevance":7,"id":"string-43","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"level":"malicious","category":"System Security","name":"Requested access to a critical system service","description":"\"msiexec.exe\" called \"OpenService\" to access the \"wscsvc\" service (\"Windows Security Center\")\n \"msiexec.exe\" called \"OpenService\" to access the \"MpsSvc\" service (\"Windows Firewall\")\n \"msiexec.exe\" called \"OpenService\" to access the \"WinDefend\" service (\"Windows Defender\")\n \"msiexec.exe\" called \"OpenService\" to access the \"wuauserv\" service (\"Windows Update\")","origin":"API Call","relevance":10,"id":"api-79","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"level":"malicious","category":"System Security","name":"Sent a control code to a critical system service","description":"\"msiexec.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"wscsvc\" (\"Windows Security Center\")\n \"msiexec.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"MpsSvc\" (\"Windows Firewall\")\n \"msiexec.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"WinDefend\" (\"Windows Defender\")\n \"msiexec.exe\" called \"ControlService\" and sent control code \"SERVICE_CONTROL_STOP\" (0X1) to the service \"wuauserv\" (\"Windows Update\")","origin":"API Call","relevance":10,"id":"api-78","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"level":"malicious","category":"System Security","name":"Sets IE security related settings","description":"\"msiexec.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\PHISHINGFILTER\"; Key: \"ENABLEDV8\"; Value: \"00000000\")\n \"msiexec.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\PHISHINGFILTER\"; Key: \"ENABLEDV9\"; Value: \"00000000\")\n \"msiexec.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\PHISHINGFILTER\"; Key: \"ENABLEDV8\"; Value: \"00000000\")\n \"msiexec.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\PHISHINGFILTER\"; Key: \"ENABLEDV9\"; Value: \"00000000\")","origin":"Registry Access","relevance":3,"id":"registry-63","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Persists itself using auto-execute at a hidden registry location"},{"detail":"Injects into remote processes"},{"detail":"Injects into explorer"}],"sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Reads the windows product ID"},{"detail":"Reads the windows installation date"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"References security related windows services"}],"sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":60,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":12,"files_deleted_count":0,"registry_keys_created_count":16,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":16,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":6,"dns_resolutions_count":1,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["banker","chthonic","zeus"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample not shared"],"sandbox_reports":[{"id":"5944501caac2ed4131d45af4","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"shoppinwithus-mal.bin","analysis_start_time":"2017-06-16T22:40:02+00:00","indicators_count":{"informative":8,"suspicious":14,"malicious":12},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample not shared"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"45.63.99.180","port":53,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"address":"45.32.28.232","port":53,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"address":"108.61.164.218","port":53,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"address":"45.56.117.118","port":53,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"address":"23.94.5.133","port":53,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"address":"47.91.124.165","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]}],"dns_resolutions":[{"domain":"letit2.bit","address":"47.91.124.165","country":"United States","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]}],"http_requests":[{"host":"letit2.bit","host_ip":"47.91.124.165:80","url":"/home/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /home/ HTTP/1.0\nHost: letit2.bit\nContent-Length: 896","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"host":"letit2.bit","host_ip":"47.91.124.165:80","url":"/home/www/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /home/www/ HTTP/1.0\nHost: letit2.bit\nContent-Length: 240","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}],"processes":[{"pid":2500,"ppid":0,"name":"shoppinwithus-mal.bin.exe","command_line":"","sha256":"afc31940380359380f27cd0cbcc18f9eb67027107d434d190a725f124b1b554e","normalized_path":"C:\\shoppinwithus-mal.bin.exe","uid":"00013792-00002500","icon":"$29"},{"pid":2856,"ppid":2500,"name":"msiexec.exe","command_line":"","sha256":"78617ddf9a0067a32cb5d87a796c93a9618ac006ccdcb3c7c824fdeb6ec5fd59","normalized_path":"%WINDIR%\\System32\\msiexec.exe","parent_uid":"00013792-00002500","uid":"00014043-00002856","icon":"$2a"},{"pid":808,"ppid":2856,"name":"yMSBuild","command_line":"","sha256":"871979edba575833ede9f5eee7ccfe9b8a0af60bc33e90035ef02d67203c05d8","normalized_path":"%ALLUSERSPROFILE%\\MSBuild\\yMSBuild","parent_uid":"00014043-00002856","uid":"00024233-00000808","icon":"$2b"},{"pid":3888,"ppid":808,"name":"msiexec.exe","command_line":"","sha256":"78617ddf9a0067a32cb5d87a796c93a9618ac006ccdcb3c7c824fdeb6ec5fd59","normalized_path":"%WINDIR%\\System32\\msiexec.exe","parent_uid":"00024233-00000808","uid":"00024461-00003888","icon":"$2c"},{"pid":1264,"ppid":3888,"name":"explorer.exe","command_line":"%WINDIR%\\Explorer.EXE","sha256":"0a8ce026714e03e72c619307bd598add5f9b639cfd91437cb8d9c847bf9f6894","normalized_path":"%WINDIR%\\explorer.exe","parent_uid":"00024461-00003888","uid":"00026746-00001264","icon":"$2d"}],"all_imported_dlls":["AcLayers.dll","user32.dll","msvcrt.dll","ddraw.dll","urlmon.dll","advapi32.dll","msacm32.dll","sfc.dll","sechost.dll","cfgmgr32.dll","msi.dll","samcli.dll","sfc_os.dll","rpcss.dll","mswsock.dll","nsi.dll","uxtheme.dll","KernelBase.dll","sspicli.dll","mscms.dll","comdlg32.dll","shlwapi.dll","version.dll","IPHLPAPI.DLL","WSHTCPIP.DLL","usp10.dll","userenv.dll","dwmapi.dll","msasn1.dll","secur32.dll","Wldap32.dll","lpk.dll","apphelp.dll","dciman32.dll","mpr.dll","kernel32.dll","comctl32.dll","setupapi.dll","msctf.dll","dnsapi.dll","ntmarta.dll","rpcrt4.dll","AcGenral.dll","cryptbase.dll","psapi.dll","profapi.dll","winmm.dll","oleaut32.dll","ws2_32.dll","ntdll.dll","ole32.dll","crypt32.dll","gdi32.dll","AcSpecfc.dll","iertutil.dll","wininet.dll","shell32.dll","devobj.dll","winnsi.dll","imm32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"yMSBuild","sha256":"871979edba575833ede9f5eee7ccfe9b8a0af60bc33e90035ef02d67203c05d8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"name":"YMSBuild.exe","sha256":"871979edba575833ede9f5eee7ccfe9b8a0af60bc33e90035ef02d67203c05d8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]}],"files_written":[{"path":"C:\\44","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"path":"C:\\shoppinwithus-mal.bin.exe","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"path":"%ALLUSERSPROFILE%\\MSBuild","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"path":"C:\\f","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"path":"%WINDIR%\\AppPatch\\AcGenral.DLL","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"path":"%WINDIR%\\system32\\en-US\\msiexec.exe.mui","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"path":"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"path":"pipe\\{B499ABCF-5257-04A2-2BBC-9465C49C8A03}","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"path":"%ALLUSERSPROFILE%\\MSBuild\\YMSBuild.exe","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"path":"%WINDIR%\\system32\\drivers\\etc\\hosts","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"key":"HKLM\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\RUN\\","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\PHISHINGFILTER\\","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\PHISHINGFILTER\\","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\SYSTEM\\","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\\","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\\REAL-TIME PROTECTION\\","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\YMSBUILD\\","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WIRESHARKT\\","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\{0AC140EE-5257-04A2-0A57-CCDBE577D2BD}","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{492F4B09-6AFD-C1F1-7241-D45861E75FB4}","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{DD3B203F-DC34-5776-2021-796758D1345A}","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{1D1343A4-052D-F03E-B897-EA8F65B7EC33}","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\{AF78DD85-60DA-8ECB-7AEF-93911D816F5C}","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{64D4A589-F027-EBF0-4F6B-30187CAF7D3D}","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\{1AF0FC67-7CD4-B794-90CB-63EE02F20D12}","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{E9F4C391-E567-3F41-192A-76FCBE1E01F1}","sources":[{"report_type":"sandbox","report_id":"5944501caac2ed4131d45af4"}]}]}},"report_ids":{"sandbox_job_ids":["5944501caac2ed4131d45af4"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Ransom_.D1B0399C Sample afc319403803… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample afc319403803…. Malware family: Ransom_.D1B0399C. Threat score 100/100. 20/28 AV engines flagged this file. 11 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/afc31940380359380f27cd0cbcc18f9eb67027107d434d190a725f124b1b554e"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom_.D1B0399C Sample afc319403803… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample afc319403803…. Malware family: Ransom_.D1B0399C. Threat score 100/100. 20/28 AV engines flagged this file. 11 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/afc31940380359380f27cd0cbcc18f9eb67027107d434d190a725f124b1b554e"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom_.D1B0399C Sample afc319403803… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample afc319403803…. Malware family: Ransom_.D1B0399C. Threat score 100/100. 20/28 AV engines flagged this file. 11 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2e","11",{}]]