34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 3d:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T482,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample bacf590ee11f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample bacf590ee11f…. Malware family: Trojan.Generic. Threat score 100/100. 18/28 AV engines flagged this file. 9 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/bacf590ee11fa7862543d4fb0407101a0840673e4aea88cc7826553d2e8dc526","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","bacf590ee11fa7862543d4fb0407101a0840673e4aea88cc7826553d2e8dc526"],"about":{"@type":"SoftwareApplication","name":"cet.hjn","applicationCategory":["peexe","executable"],"identifier":"bacf590ee11fa7862543d4fb0407101a0840673e4aea88cc7826553d2e8dc526","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":18,"total":28},"behavioralIndicators":{"malicious":9,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T7c1,"explorer.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")37:T723,"explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA"; Key: "BLOB") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135"; Key: "BLOB") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")38:T79b,"" wrote bytes "2b457277f99c717778eb70777989707793977177d3337277a41d7277d0d9717711a671775c39727741cf7177e19c71770e457277b62f72774123717700bf717700000000473f0c7600000000ec22617699e55e7600000000" to virtual address "0x10003000" (part of module "SYSTEM.DLL") "" wrote bytes "08578976047892760000000051c1737694987376ee9c737675dc7576273e7576efb279760000000046ce7177013d727738ed7277cfcd717731237177de2f7277c4ca717780bb717752ba71779fbb717792bb717746ba71770abf717700000000" to virtual address "0x6AA41000" (part of module "SHFOLDER.DLL") "" wrote bytes "d116667700000000a83e71773123717728377277b62f7277cfcd717738ed7277013d727700000000ae150e7600000000" to virtual address "0x01283000" "" wrote bytes "c2000000" to virtual address "0x1000404C" (part of module "SYSTEM.DLL") "explorer.exe" wrote bytes "cc4c3193" to virtual address "0x696A0BA8" (part of module "MSO.DLL") "explorer.exe" wrote bytes "323d7e7c" to virtual address "0x6AA811DC" (part of module "MSMAPI32.DLL") "explorer.exe" wrote bytes "d5f0e593" to virtual address "0x68E09904" (part of module "RICHED20.DLL") "explorer.exe" wrote bytes "4053c5775858c677186ac677653cc7770000000000bf71770000000056cc7177000000007cca7177000000003768e1756a2cc777d62dc777000000002069e1750000000029a6717700000000a48de17500000000f70e717700000000" to virtual address "0x764C1000" (part of module "NSI.DLL") "explorer.exe" wrote bytes "3ba46e7c" to virtual address "0x6A7697BC" (part of module "OLMAPI32.DLL") "explorer.exe" wrote bytes "92e6c27779a8c777be72c777d62dc7771de2c27705a2c777bee3c277616fc7776841c5770050c57700000000ad3707768b2d0776b641077600000000" to virtual address "0x75271000" (part of module "WSHTCPIP.DLL") "explorer.exe" wrote bytes "7739c37779a8c777be72c777d62dc7771de2c27705a2c777c868c67757d1cd77bee3c277616fc7776841c5770050c57700000000ad3707768b2d0776b641077600000000" to virtual address "0x757C1000" (part of module "WSHIP6.DLL")39:T1deb,Found malicious artifacts related to "46.183.218.199" (ASN: 52048, Owner: DataClub S.A.): ... URL: http://46.183.218.199/ (AV positives: 1/64 scanned on 03/17/2017 17:58:38) File SHA256: f23ddbe8a9d30016a51c908657094c77f067c227c8407f1b6971641a41436259 (AV positives: 20/57 scanned on 02/16/2017 12:58:37) File SHA256: 3473db4bd7eb1d44e53d19891508262ce5084ddb949f6d438943c7de13dd4196 (AV positives: 5/55 scanned on 07/25/2016 10:23:48) Found malicious artifacts related to "82.76.177.134" (ASN: 8708, Owner: RCS & RDS SA): ... URL: http://82.76.177.134/ (AV positives: 1/64 scanned on 03/21/2017 22:15:42) File SHA256: f1e2d7175cc28e103dcccb3855448625e5398b7df3714c3368098aa4aa6d0fcd (AV positives: 40/61 scanned on 03/14/2017 11:59:52) File SHA256: 685ff88ea7eebcbe4c9e1bd13bcfefcc278d976a7f6663a8d360270213adceb2 (AV positives: 39/60 scanned on 03/14/2017 11:59:29) File SHA256: 80a5906a6d0d7a4af1da469527fd65f1cb69ebc5c3c5429e8fb3ac2ced1baf4d (AV positives: 32/60 scanned on 03/11/2017 22:15:59) File SHA256: dd9dbf5bf2da41712d9253fcaeae2d95a847a07583fe4bd12cf886c0dd414b6e (AV positives: 39/61 scanned on 03/10/2017 11:42:58) Found malicious artifacts related to "144.76.11.100" (ASN: 24940, Owner: Hetzner Online AG): ... URL: https://144.76.11.100/ (AV positives: 1/68 scanned on 07/19/2016 17:53:17) File SHA256: e4e31e11e847e673034c2d37531269e84c24bafdce67d46c049854aa4781e6fd (AV positives: 37/55 scanned on 11/16/2014 19:08:30) File SHA256: ad746153266d93613bf3486c60b4b5327efb0581a459b7006b7b2327b8dcac1c (AV positives: 39/55 scanned on 09/20/2014 19:13:42) File SHA256: 8feb0e4e16bed47d14b4c05e4703cca9d3017c46eb774a91fd05332c20ea3685 (AV positives: 26/54 scanned on 06/13/2014 10:21:34) File SHA256: c6a5450bacda8981f58cfb70b4a03859eb17c4cf24d599672db159f8b2c7a128 (AV positives: 5/45 scanned on 06/23/2013 18:25:00) File SHA256: 7f380971545b1b72547fabc1d739155b96098ad2418433680bd74779308b8d13 (AV positives: 4/46 scanned on 06/13/2013 19:40:37) Found malicious artifacts related to "95.69.232.24" (ASN: 43266, Owner: LLC AB Ukraine): ... File SHA256: 5497b3548ba22f473b7231383ccab055e49c552b912414087e641220d660c95d (AV positives: 22/58 scanned on 09/12/2016 16:23:57) File SHA256: 00829494bc9aa9a2afa7a94658018319ceb8f709b0d58ac376a857e5304f628d (AV positives: 54/57 scanned on 04/18/2016 12:55:47) File SHA256: 1ff33f424eee88e05db14e8b6da4e8dadbfb143d703c2e8294a96e9714186f09 (AV positives: 51/54 scanned on 02/04/2016 18:18:05) File SHA256: cfea7695f4067ea85cc2f0662419626909df71fb1511f68756436a3f95e7ce95 (AV positives: 40/54 scanned on 01/24/2016 07:41:18) File SHA256: ada376139d91ec885418cedc7ae0acb8c4380722849286255cea1f955306a9e4 (AV positives: 48/54 scanned on 01/13/2016 16:08:09) Found malicious artifacts related to "208.83.223.34" (ASN: 40475, Owner: Applied Operations, LLC): ... URL: http://208.83.223.34/ (AV positives: 3/65 scanned on 03/20/2017 13:45:05) URL: http://208.83.223.34:443/tor/status-vote/current/consensus-microdesc.z/ (AV positives: 3/68 scanned on 10/19/2016 09:57:35) URL: http://208.83.223.34:443/tor/status-vote/current/consensus-microdesc.z (AV positives: 3/68 scanned on 10/16/2016 21:11:03) URL: http://208.83.223.34/tor/status-vote/current/consensus-microdesc.z/ (AV positives: 3/68 scanned on 10/08/2016 09:54:52) URL: http://208.83.223.34/tor/status-vote/current/consensus-microdesc.z (AV positives: 4/68 scanned on 10/05/2016 14:06:18) File SHA256: a9f3321d35f02765a63fec847342c7c78255233e0da6cf41021d69372b1c1172 (AV positives: 10/60 scanned on 03/22/2017 07:55:17) File SHA256: 7e47c08d1a149b09c404861ed39e77031a6f6a2a235d4eb6161010958d27ae40 (AV positives: 14/61 scanned on 03/22/2017 07:19:40) File SHA256: 683df8afb9ca8896473bc55224aa5c0f28fa249f0753fa34ec204eddf6d5ba11 (AV positives: 9/61 scanned on 03/16/2017 09:33:58) File SHA256: dd9dbf5bf2da41712d9253fcaeae2d95a847a07583fe4bd12cf886c0dd414b6e (AV positives: 39/61 scanned on 03/10/2017 11:42:58) File SHA256: f20663ee8fd2afae9a129c5a49bd109b8a8555fa7823c10ee2aaf3732ff8af40 (AV positives: 27/58 scanned on 03/02/2017 11:39:08) Found malicious artifacts related to "67.92.173.227" (ASN: 2828, Owner: XO Communications): ... URL: https://67.92.173.227/ (AV positives: 1/68 scanned on 07/19/2016 19:48:11) File SHA256: e91881528f7fcc3091735b1d4efb7570e60f4b9ba7019a5cc60ce435aeef3560 (AV positives: 4/56 scanned on 12/11/2016 23:11:36) File SHA256: fd006fc100090518d624289e15837bca0e7d1c7bf937f2f1220c7ad323abe847 (AV positives: 52/57 scanned on 11/16/2016 10:59:16) File SHA256: d00f9a076c4357a0138ffc651292c8f6ac4ee0186dc003ac6f6bf6f6b5d294ad (AV positives: 7/56 scanned on 08/31/2016 05:45:18) File SHA256: b30f6ab334d8314b7e96048c797e56bf37c754d148ea17f452ba766d917b317b (AV positives: 26/54 scanned on 08/15/2016 17:52:24) Found malicious artifacts related to "106.185.28.25" (ASN: 2516, Owner: KDDI CORPORATION): ... File SHA256: dd9dbf5bf2da41712d9253fcaeae2d95a847a07583fe4bd12cf886c0dd414b6e (AV positives: 39/61 scanned on 03/10/2017 11:42:58) File SHA256: 97b3a89664c115ce36635156109c24139231e3d5e6ea694b952ba770558e9135 (AV positives: 54/57 scanned on 11/05/2016 09:00:36) Found malicious artifacts related to "37.221.171.236" (ASN: 39743, Owner: Voxility S.R.L.): ... URL: http://37.221.171.236/ (AV positives: 1/52 scanned on 02/05/2014 10:50:41) File SHA256: dc58606e75e0bd750fb0fac267217bf5596616cd515c5b165b1b1df7379a51c4 (AV positives: 24/56 scanned on 06/02/2016 16:49:23) File SHA256: 9f1d2a6e48f68ff174717c8330208815a1dbfe1eaa0651cf26bb49b87d07b384 (AV positives: 4/57 scanned on 05/31/2016 17:53:30) Found malicious artifacts related to "163.172.149.155" (ASN: , Owner: ): ... URL: https://163.172.149.155/ (AV positives: 1/68 scanned on 08/30/2016 14:57:13) File SHA256: e9c6aadad89a3de349fb1efcafd05fa1aa8d830850b322c3a8c18fdf2182c446 (AV positives: 42/57 scanned on 01/06/2017 03:29:33) File SHA256: 58eae44e304290e21757008a9fa32b946a2ff20b5ec7f1ae6fea47e72c556439 (AV positives: 26/56 scanned on 12/09/2016 07:57:40) File SHA256: 74e137e6df979dc3272afe6522935d7ca1fb59c3fb888a80fc5bc4839e846689 (AV positives: 35/57 scanned on 11/27/2016 13:20:38) File SHA256: 24c8b5aec837c2dc18193205250202dedc2249d4e9c0dd8d11911ff3a0707c00 (AV positives: 25/56 scanned on 10/24/2016 14:00:26) File SHA256: b0fa413a226e83b9f3d3a0cc4e2c1b6785c5ead34e089558056efcc5a3501624 (AV positives: 30/58 scanned on 10/02/2016 22:32:16) Found malicious artifacts related to "217.12.203.46" (ASN: 15626, Owner: ITL Company): ... URL: https://217.12.203.46/ (AV positives: 1/68 scanned on 07/21/2016 15:16:05) File SHA256: c7f4d58c00a8d51288c5b2266382be0aa5bc52313a0a0528204480ec55d76609 (AV positives: 20/58 scanned on 08/27/2016 04:34:45) File SHA256: 7cc1302ab0f52410b5e50a852bb41f81a615e6230b9efe78277329ecf2405545 (AV positives: 41/55 scanned on 01/22/2016 02:07:59) File SHA256: 470e428d1b0984ed948e75a9040d3cf147c5ca88ade0ce8fe7a0218f6c2c1a54 (AV positives: 39/55 scanned on 01/22/2016 00:14:09) File SHA256: 5b5dfbc58d595166a41079cbcbbe3ddeb57877ac1c54afda0ce961eb0c0c4492 (AV positives: 41/56 scanned on 07/23/2015 12:16:55) File SHA256: 39009dcfe7a421d7bfa707cd02f63d1e33fdd393412dcdc4735c70daf6080c40 (AV positives: 33/56 scanned on 01/03/2015 20:42:51) Found malicious artifacts related to "88.200.73.100" (ASN: 2107, Owner: ARNES): ... URL: https://88.200.73.100/ (AV positives: 1/68 scanned on 08/10/2016 06:55:04) File SHA256: 4801f48fda585037fdc8f64a1d232ce1bf4b01f5ceb39e2b99e74fabab3d8553 (AV positives: 25/58 scanned on 02/28/2017 11:10:47) File SHA256: b703f7be66dd5d4f031212d44e00692cd632880c2e680f7098b1fb20a5920e0f (AV positives: 27/57 scanned on 02/23/2017 18:57:50)3a:Tf3c,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAsASURBVFhHnZfrT5vpmcaRKlX7pR9W+0fs9ks/7Ha7atWsVHVUVe1uNdqOttOoM9nJTJNMyAQSAoSTOYVDDJhwigFz8BHbmHA0YDABGzAGYxuwDcYnMKdwPmQmM/346/MSTUfdne6ktXRLL/bLc1/39Vz3c19PSsobfj799FN2d3cJhULMz88zPT3N1NQUk5OTOBwOZmdn8Xq9xONxTk5OeMNlv/m109NT1tbWGB0eRlXfQJ0sh/r8NJoK79BW/gnaqnsYFCWo5SW0VspoUVTQbdAKkG729vb+diCvXr1iY2ODEesw9RWPkT+4z9OKe+j19+mzFWCbLWfSV8tsUEUk4icSCrDimWNqyIKh6TFKeSFd2k6Wl5c5Ozv764BIVUt0qpQtFH98l6aye1gGSxj3tuCNDbG+62bzIMDOUZi9kzinZ8eXSU7E/+3v7xONR/DMPmdAU0+zohT7+Nibs3FwcMD4+DhlOUU8Sr3Ds94KZlb0rG3PsHO4ztHZHidnB5yeH4o44uz8mIuLc16+fHkZFyLOz88vdbC7s43HMUR7XTFmo/6S0f9306XKpeSlD4uoyZfRP1yNN9zP1qaXo8MkJ8d7HB1sc3S0w+FOgoPdOEf7m5ydHHG6t8vF2SlnhwKceD4RyU9FMS+EDjyucVpqcjF1aS+F/LUgPvvss0vaywvKqMovZniiHX9UUJfwsdFvZGdqjMNwgG23g80JK/EBI9uL08R6tLxY8RLVtnIUjxLRtLIzM0XMrCXQVC0YOmdHgHFO9KKsycFmG/36LkkkErSp2nn4USZd3ZXMBPQcnGxyEltjVSzkK7hPzKQm2tdFcn6KVa2SVaOKte4OktMTuG6/z65/kXivmUhXJ/7aCpbMerE9F0jMJjfjOMwNNFaV4Pf7+OKLL75iQnphZGSEjFtZNCrL6Hcr8K0Pcv7yBQdBL15lDb1Zdyj98b8w2dGMtTCTvoJ0ZjrrKPv+d5kS35Vc+T4h1wzNb/+MBYuR1hvXyH7ryiWAC8HCYTJBeFRPT30eBtEdOzs7XwFYXV1FUfWEjJsPaB3LpW+xFn98lOOLLfaifryDJsJLbnKuvsNEfzc2QxtNOWmYmipRZKXiGB5Adv19QqKyzuICzPW1KAtyMNTVvgZwuM9J0MPmpAmHrpzWmmJcLtdrAJJyR0dHybiTQ5EQSruriAFfK4sxOy9Ei128OuDVH874/A8XfPbqXOzpIXtHG2wfRtjcXxXtGOLoRAhPsCiF1I5fxrl4PheivIivchaYY3+un6Ctke6mQiFIvRDzESkSFS3Nrdz+6CGllkyUc0WYvA3YV82i3xc4ON3i9OU+Zy+lljti/3hbJF4n8SJE7EWA6N4KB0cvOD4+uRTXl3F6eiK6YI+LWIDzdR+nwRmOfSMkZ9U4LDWomp6wvr5OSjAY5FFxJe/dzuQ33alcsxdwf/oJ1R4DpuA47s0Aod0Ekb0dQlvbLEQTuMIxJldD2II+hkMeJpaWsC+6sXunsfvGGVu0Yp1+RvdQJ/r+dlSWdqo0KgpaWvmkSsnVh3XczXnMzMwMKdJgyc0u4mrGPd4x3+Dd8TxuORXkuTuo9w9gXHMyEltiajOCYzPJeGKboegmfZEY3ZEQxugyOrsdzaCZ9iE1raOdNPSoUXSpeWzQUKLTkN2uJrVJzYd1nbxT3s6Ve628ffsJVquVFGmqZd6XcaswnftDv+cTZy5ZrmrKFttoWLbQEbJiWnfSH/MyFA8wIHrdFEnQFd7AGF5HF/ahsfWjEtU29HVSLVqwQq+mvEvDIxEyvYYstYa0Ng2pKjXX6jp4K6eVt37fQE9PDynSSM1ILyRVfpeMsZvIXHk8XqxGudyBRujALNqxTwhyMOFkIOFiaMNLnwBijkZRrycxRlZoGTdSO6hGbtFQIaJMHE5lz3SU9uiQdWvJNWnJEhPynlbDB8pOfl7YypUPmzCZTKRI8zwjXcZdASDffovHAkCz9wn6FTW9az2MRkeZiD8X9M8wm5zHlfQyt7UsnoM4oquMRTx0LVgwLprQL5rpcJlpmjLSOGmkQbTdE7uRagGwcrQLWb+Ojzs7+Y9HKn5yq+U1AMlMZN4v4EZJOncHbpHtlFHmaaR+SScYGBB0j9MTddAfdTOaWGIsvsZYKM5oIMnwckSIcJnxOQeOxVHsHgujXhNWAcY8Y0DrNKCa1PN0XE+dTU+VVUe2oZNfV7TxqzTl6y2QnMzDzAKupaXzfttNbvcXk2NvpnLGjFIs2uafwrCywLOlFUaDUYYDWzzzxOhfjtO3HKYvEGJgzod1xoHLN8n8yghOfw82j4nBBSOWuS60U3qxTQLAgACg6eS3lW28n1nPsDA5KdIAKiwo5r3r6fy68Aa/ayvhtrmVgpFeFFPPaZ1bEOfCqki2wVhwh4nQDsXGYXoCh5h9+zydOCCz95CfZlajE3sdCC+yGHrO3MqgAGJhzGumf96IftJA3aCOB+2dvFvaRrpMmBlRfEosFkOhUPDh9Ux+mXWT/3xawoeihYpGbDQ6F9C41+j2bWBdERMtvMtMdJu6nnEmNqA/DE1u+HgY/undDEofPWJ1PcjKmgdf0MnC0gjTXgvjHjPPpg00Cg1kNLfzXnEL8lqlcFIRUo6Pjy/FcCf1Pv+d9oBf1VVyQ2+hZHiGJscKhvkYff4kttA2c/FdFjf3aOy1i/MAIVJolABY4R8FgPLySqKJOOtCnMGwF3/AyZzPyqTQRq/DQL1Fy506FTdlTXR1GV8fxdLH7XZTVFjM9ZtZQiA1XO/spaBvjsaJID1ivwcF/c/DW3g2d7HHtqjodYouQWgEUkX1/9wO/3C1mKzqetZEVbFElHBEMBFaYN4/wXN3L91CA3IxBW+WtyErU3w1jCQA0jzQ6XTcuZ3OB3lPuKo0kdU9Sf2Yn17Putj7BI5IEv/WHtcGnfyi/5C3B+F7Gvh2LaQoRNQf8J1sBQ1NSpE8QjgaZmXVj9vvwCaO5c4+LYXKdu7I6tFodX8+jiUQfr+fyspKUu8W8D+PVXys7UduncXsDmAX6p+PJ1nZ3uO5Z5EfVov+fXpMSrNILMXTC77922z+9Qf/xsDAkDClCdZiEaEDPw73BBarCYXo/wx5B4/lNcKQ+P+vLZOmmM1mIyszm9TsR9ys15DXLdpwaoFBf5D52AZrO3skDg6xzy/wE7mOb7Uc8C3lPn/3X2lc+enPRF/3CeO5RTSWYFkMOdfCHEMjfTRr1eTVqMgtrGBsbOwvX1y2t7eF79eT8SCb9IIa7jXrkA/ZMbg8PA+tsSSGUezFPpuHh0wuePj38g7+/jdp/OBHP75MnkzuiZvRFsFgmDm3RxQ0htagp1jRRl5x1aXY/6Ip/dKpSq2h1Wp58CCLNOGOZR1maq1jYisWcKyusZxMEhbONi78//DEBB989BF6g1kk3iYhJuVKYJ05l5eRYTs6QzfF1W3kysowGo3i98SbXVCSIsnQ0BAlJSXcvfeAnJpGqnoH0Did2MTsnxVGwrshaE5uEhCxEojj864zPxdkwu7GYrGjaBRCzpNTUfGa9m+s/H979UNBs+QVVCoVefnCpGTnkq+oo8ZkRi3uDpbZGYYWFxj2ehgcnqe724labRUHjE5ULKeopEz8rcbn8/3tl9XPP//88jYjDSxpsfLycnLy8snKFyErIKeokJziIh7mlogoJV9Wilwux2AwXB6zkqb+zH5/813469+QFpHufNLVXPIPg4ODgmbLpaikkJ4ldyOZG8nn/emEe4OEfwSfLmOEAmgujQAAAABJRU5ErkJggg==3b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAA/4iIiIiI8AAAAAAAAAAA+Id3d3d3d4j/AAAAAAAAD4d3d4iIiId3ePAAAAAAAPh3eIiIiIiIh3ePAAAAAAiHd4iI/4eIiIiHeIAAAAD4d3iIj/hmCPiIiHePAAAPh3d4iI+H5maIiIh3ePAACHd3iIiIbu7mCIiIh3eAAPh3d4iIh+7u5meIiIh3jwCHd3iIiIiIiOZ4iIiId3gPh3d4iIiIiIiGeIiIiHd4+Hd3eIiIiIiIhniIiIiHd4h3d3iIiIh4iIeIiIiIh3eId3d4iIiIiIiIiIiIiHd3iHd3iIiIiIiIiIiIiIiHd4h3d4iIiIiIiIiIiIiId3eId3d4iIiIiIiId3d3d3d2iHd3eIiIiIiIiId3d3d3d4h3d3eIiIiIiIiId3d3d2eId3d4iI+IiIiIiIiIh3d3j3d3iI///4iI////+IiIh4+HeIj/////iP/////4iHjwh3eI+Ih4h3eHh3d/+Ih4APh3iPiHGHeBgYeHP/+HjwAId3j4h4iIiIeIiI/4h48AD4d4iIiIiIiI+IiP+HjwAAD4d4iP/////////4ePAAAAD4d4iP////////h4gAAAAAD4d3eIiP///4iHjwAAAAAAD4h3d4iIiIh3iPAAAAAAAAAPiHd3d3d3iPAAAAAAAAAAAA/4iIiIiPAAAAAAD/gAP//gAAf/wAAD/4AAAf8AAAD+AAAAfAAAADwAAAA4AAAAGAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAYAAAAHAAAABwAAAA+AAAAfwAAAP+AAAH/wAAD//AAD//8AD/w==3c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAABmZmZgAAAAAAZmZmYAAAAGeIiIZgAAAAAGiIiGYAB3d3iIiHd3d3d3dod3hnd3iPiIiIh4iIiIiIaIiIa7t4+IiIiIeIiIiIu2iIiGu7ePiIiIiHiIiIiIhoiIh7u3j4iIiIiId3d3d2eIiIiLt4+IiIiIiIiIiIiIiIj4i7ePiIiP/4iIiIiIiIiI+Iu3j4+P//+IiIiIiIiIiPiLh4+Pj////////4iIiIj4i4eP/4///4iIiIiIiIj/iIiHj//4iI+IiIh3d3d3d4iIh4/////4+IiIiIiIiIiIiIeP////iI+IiIiIiIiIiIiHj/////iI+IiIiIiIiIiIh4//////iIiIiIiIiIiIiIeP//////+IiIiIiIiIiIiHj///////+IiIiIiIiIiIh4/////////4j///////iIeP//////////+IiIiHd3eHiP/////////4iIiIiIiIh4iIiIiIiIiIiIjub///iIeIiIiIiIiIiIiI7u///4iHiIiIiIiImZ//iIh3d3d3dwiIiIiIiJmf///4iIiIiHAIiKov/4iIiIiId3d3d3dwCIiqr///+Ih3AAAAAAAAAACIiIiIiIiHcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwH/gP4A/4BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAYAAAAGAAD//wAB//////////////////w==30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"bacf590ee11fa7862543d4fb0407101a0840673e4aea88cc7826553d2e8dc526","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1794309344931,"unified_at":"2026-11-10T11:15:44.931Z","metadata":{"hashes":{"sha256":"bacf590ee11fa7862543d4fb0407101a0840673e4aea88cc7826553d2e8dc526","sha1":"50382c9aaf29b0b9a7ebddb580e3be5b3fead023","md5":"f5c2c3fd03d89d96fd774ed04bd12856","sha512":"7add19a5d88a541eedf3da4d515b02fb9f0fcf7646f34bf88439945b80860eba746385369eb770e222ebf2b266a65da9ad9b5a3dafc59f8e916a29f9de97c1da","ssdeep":"6144:+wHysEX1CoFkJwoP4R9Qy4j2QL/cCqxMDn2EW1AKuWR/9BIllGhZCR2R:1EX1hFMwTq3jRLUCIMD2MHWR8e4R2R","ssdeep_chunks":["6144:+wHysEX","6144:wHysEX1","6144:HysEX1C","6144:ysEX1Co","6144:sEX1CoF","6144:EX1CoFk","6144:X1CoFkJ","6144:1CoFkJw","6144:CoFkJwo","6144:oFkJwoP","6144:FkJwoP4","6144:kJwoP4R","6144:JwoP4R9","6144:woP4R9Q","6144:oP4R9Qy","6144:P4R9Qy4","6144:4R9Qy4j","6144:R9Qy4j2","6144:9Qy4j2Q","6144:Qy4j2QL","6144:y4j2QL/","6144:4j2QL/c","6144:j2QL/cC","6144:2QL/cCq","6144:QL/cCqx","6144:L/cCqxM","6144:/cCqxMD","6144:cCqxMDn","6144:CqxMDn2","6144:qxMDn2E","6144:xMDn2EW","6144:MDn2EW1","6144:Dn2EW1A","6144:n2EW1AK","6144:2EW1AKu","6144:EW1AKuW","6144:W1AKuWR","6144:1AKuWR/","6144:AKuWR/9","6144:KuWR/9B","6144:uWR/9BI","6144:WR/9BIl","6144:R/9BIll","6144:/9BIllG","6144:9BIllGh","6144:BIllGhZ","6144:IllGhZC","6144:llGhZCR","6144:lGhZCR2","6144:GhZCR2R","12288:+wHysEX","12288:wHysEX1","12288:HysEX1C","12288:ysEX1Co","12288:sEX1CoF","12288:EX1CoFk","12288:X1CoFkJ","12288:1CoFkJw","12288:CoFkJwo","12288:oFkJwoP","12288:FkJwoP4","12288:kJwoP4R","12288:JwoP4R9","12288:woP4R9Q","12288:oP4R9Qy","12288:P4R9Qy4","12288:4R9Qy4j","12288:R9Qy4j2","12288:9Qy4j2Q","12288:Qy4j2QL","12288:y4j2QL/","12288:4j2QL/c","12288:j2QL/cC","12288:2QL/cCq","12288:QL/cCqx","12288:L/cCqxM","12288:/cCqxMD","12288:cCqxMDn","12288:CqxMDn2","12288:qxMDn2E","12288:xMDn2EW","12288:MDn2EW1","12288:Dn2EW1A","12288:n2EW1AK","12288:2EW1AKu","12288:EW1AKuW","12288:W1AKuWR","12288:1AKuWR/","12288:AKuWR/9","12288:KuWR/9B","12288:uWR/9BI","12288:WR/9BIl","12288:R/9BIll","12288:/9BIllG","12288:9BIllGh","12288:BIllGhZ","12288:IllGhZC","12288:llGhZCR","12288:lGhZCR2","12288:GhZCR2R","6144:1EX1hFM","6144:EX1hFMw","6144:X1hFMwT","6144:1hFMwTq","6144:hFMwTq3","6144:FMwTq3j","6144:MwTq3jR","6144:wTq3jRL","6144:Tq3jRLU","6144:q3jRLUC","6144:3jRLUCI","6144:jRLUCIM","6144:RLUCIMD","6144:LUCIMD2","6144:UCIMD2M","6144:CIMD2MH","6144:IMD2MHW","6144:MD2MHWR","6144:D2MHWR8","6144:2MHWR8e","6144:MHWR8e4","6144:HWR8e4R","6144:WR8e4R2","6144:R8e4R2R"],"imphash":"e160ef8e55bb9d162da4e266afd9eef3"},"file_info":{"file_name":"cet.hjn","file_type":["peexe","executable"],"file_type_id":"exe","file_size":367633,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499287448000,"last_seen":1677387706000,"last_multi_scan":1677387706000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["Crypt0l0cker","TorrentLocker","ransomware"]},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":21,"suspicious_count":21,"malicious_count":9,"total":51},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Ransom","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/AD.Teerac.njwvc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.4649256","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Agent.PPJV-9326","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Cryptolocker (A)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Filecoder.TorrentLocker.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004e24c81 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.nezlzv","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic BackDoor.gv","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Inject.eoppya","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/TorrentL-X","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_.C9F99236","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_.C9F99236","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.CryptLocker.KQ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00060922-00002740-52232-16-0040978F\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00060922-00002740-52232-685-0040975E","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00060922-00002740-52232-241-00409EDB","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00059784-00001732-45725-7-00405B87","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@KERNEL32.DLL at 00059784-00001732-45725-70-00404291","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00060922-00002740-52232-163-00405C80\n GetProcessHeap@KERNEL32.DLL at 00060922-00002740-52232-239-0040994F","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$36","origin":"Registry Access","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$37","origin":"Registry Access","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"atyreseqa.firsoel.net\"\n \"aqtcoquwiqi.firsoel.net\"\n \"yqfgywusyhe.firsoel.net\"\n \"idoxomirsqy.firsoel.net\"\n \"ykezy.firsoel.net\"\n \"emalo.firsoel.net\"\n \"ifavom.firsoel.net\"\n \"mnoty.firsoel.net\"\n \"edolup.firsoel.net\"\n \"ochd.firsoel.net\"\n \"uwoqybo.firsoel.net\"\n \"ipecho.net\"\n \"ywaze.firsoel.net\"\n \"hnazfqo.firsoel.net\"\n \"eciqyrag.firsoel.net\"\n \"ofudyk.firsoel.net\"\n \"ufikanym.firsoel.net\"\n \"ulyn.firsoel.net\"\n \"ygic.firsoel.net\"\n \"ocyfi.firsoel.net\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"46.183.218.199:9001\"\n \"194.1.236.218:443\"\n \"82.76.177.134:80\"\n \"144.76.11.100:443\"\n \"95.69.232.24:444\"\n \"208.83.223.34:80\"\n \"81.89.0.198:443\"\n \"162.222.52.134:1940\"\n \"67.92.173.227:443\"\n \"106.185.28.25:3971\"\n \"5.147.7.117:9001\"\n \"37.221.171.236:9006\"\n \"66.215.142.69:443\"\n \"163.172.149.155:443\"\n \"217.12.203.46:443\"\n \"89.35.134.154:9001\"\n \"216.218.222.11:9001\"\n \"88.200.73.100:443\"\n \"84.52.225.99:64646\"\n \"24.148.59.185:8443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\Satire\"\n \"\" created file \"%TEMP%\\modernness.dll\"\n \"\" created file \"%TEMP%\\nsi3629.tmp\\System.dll\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Global\\epifasacizecoxux\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\efyzerywyjuhyzogyreduqy\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\iremenokofyciwyxerynokexivegewi\"\n \"Global\\efyzerywyjuhyzogyreduqy\"\n \"Global\\iremenokofyciwyxerynokexivegewi\"\n \"Global\\epifasacizecoxux\"\n \"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!zgsj9oi!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!zgsj9oi!appdata!roaming!microsoft!windows!cookies!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!zgsj9oi!appdata!local!microsoft!windows!history!history.ie5!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /plain HTTP/1.1\nAccept: */*\nHost: ipecho.net\nCache-Control: no-cache\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"explorer.exe\" loaded module \"%COMMONPROGRAMFILES%\\microsoft shared\\OFFICE14\\RICHED20.DLL\" at 68DC0000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"explorer.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"\" (UID: 00060922-00002740)\n Spawned process \"explorer.exe\" (UID: 00064250-00003256)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"avusukam.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows Nullsoft Installer self-extracting archive\"\n \"modernness.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"Satire\" has type \"data\"\n \"CabF23F.tmp\" has type \"Microsoft Cabinet archive data 50939 bytes 1 file\"\n \"plain[1].txt\" has type \"ASCII text with no line terminators\"\n \"System.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"94308059B57B3142E455B38A6EB92015\" has type \"data\"\n \"Cab6FC.tmp\" has type \"Microsoft Cabinet archive data 52122 bytes 1 file\"\n \"TarF220.tmp\" has type \"data\"\n \"Tar6FD.tmp\" has type \"data\"\n \"TarF240.tmp\" has type \"data\"\n \"94308059B57B3142E455B38A6EB92015\" has type \"Microsoft Cabinet archive data 52122 bytes 1 file\"\n \"CabF21F.tmp\" has type \"Microsoft Cabinet archive data 50939 bytes 1 file\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" touched file \"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db\"\n \"\" touched file \"%WINDIR%\\system32\\rsaenh.dll\"\n \"\" touched file \"%WINDIR%\\Fonts\\staticcache.dat\"\n \"\" touched file \"%WINDIR%\\system32\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://nsis.sf.net/NSIS_Error\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"cet.hjn.exe.bin\" was detected as \"Nullsoft PiMP Stub -> SFX\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00060922-00002740-00000105-137834862","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"explorer.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"explorer.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")\n \"explorer.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"explorer.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)\n \"explorer.exe\" called \"OpenSCManager\" requesting access rights \"0XE0000000L\"","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"explorer.exe\" called \"OpenService\" to access the \"ServicesActive\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"explorer.exe\" called \"OpenService\" to access the \"gpsvc\" service\n \"explorer.exe\" called \"OpenService\" to access the \"WinHttpAutoProxySvc\" service\n \"explorer.exe\" called \"OpenService\" to access the \"CryptSvc\" service\n \"explorer.exe\" called \"OpenService\" to access the \"cryptsvc\" service\n \"explorer.exe\" called \"OpenService\" to access the \"\" service\n \"explorer.exe\" called \"OpenService\" to access the \"ProtectedStorage\" service\n \"explorer.exe\" called \"OpenService\" to access the \"ProtectedStorage\" service requesting \"SERVICE_START\" (0X10) access rights\n \"explorer.exe\" called \"OpenService\" to access the \"rasman\" service\n \"explorer.exe\" called \"OpenService\" to access the \"Sens\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"explorer.exe\" called \"OpenService\" to access the \"RASMAN\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"suspicious","category":"General","name":"Sent a control code to a service","description":"\"explorer.exe\" called \"ControlService\" and sent control code \"0X24\" to the service \"gpsvc\"\n \"explorer.exe\" called \"ControlService\" and sent control code \"0XFC\" to the service \"gpsvc\"\n \"explorer.exe\" called \"ControlService\" and sent control code \"0X400\" to the service \"CryptSvc\"\n \"explorer.exe\" called \"ControlService\" and sent control code \"0X24\" to the service \"cryptsvc\"\n \"explorer.exe\" called \"ControlService\" and sent control code \"0X400\" to the service \"ProtectedStorage\"","origin":"API Call","relevance":10,"id":"api-75","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"avusukam.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows Nullsoft Installer self-extracting archive\"\n \"modernness.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"System.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"explorer.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"explorer.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"UKAJOQFB\"; Value: \"\"%WINDIR%\\avusukam.exe\"\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"82.76.177.134\"\n \"188.138.33.220\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.DLL at 00059784-00001732-45725-79-00404F8E","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\cet.hjn.exe\" marked \"%TEMP%\\nsz35EB.tmp\" for deletion\n \"C:\\cet.hjn.exe\" marked \"%TEMP%\\nsi3629.tmp\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%TEMP%\\nsz35EB.tmp\" with delete access\n \"\" opened \"%TEMP%\\nsi3629.tmp\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to elevate privileges","description":"SetSecurityDescriptorDacl@ADVAPI32.DLL at 00060922-00002740-52232-178-00404E50","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-44","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"suspicious","category":"System Security","name":"Modifies IE Phishing Filter","description":"\"explorer.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\PHISHINGFILTER\")\n \"explorer.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\PHISHINGFILTER\"; Key: \"ENABLEDV9\")\n \"explorer.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\PHISHINGFILTER\"; Key: \"ENABLEDV8\")","origin":"Registry Access","relevance":5,"id":"registry-45","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"explorer.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"explorer.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"explorer.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"explorer.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"explorer.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"explorer.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegDeleteKeyA\n RegCloseKey\n RegOpenKeyExA\n RegDeleteValueA\n RegCreateKeyExA\n RegEnumKeyA\n GetFileAttributesA\n CopyFileA\n GetModuleFileNameA\n LoadLibraryA\n LoadLibraryExA\n GetFileSize\n CreateDirectoryA\n DeleteFileA\n GetCommandLineA\n GetProcAddress\n GetTempPathA\n CreateThread\n GetModuleHandleA\n FindFirstFileA\n WriteFile\n GetTempFileNameA\n FindNextFileA\n CreateProcessA\n Sleep\n CreateFileA\n GetTickCount\n ShellExecuteA\n FindWindowExA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$38","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the windows product ID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"DIGITALPRODUCTID\")\n \"explorer.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"DIGITALPRODUCTID\")","origin":"Registry Access","relevance":6,"id":"registry-5","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"malicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET POLICY TLS possible TOR SSL traffic\" (SID: 2018789, Rev: 2, Severity: 1) categorized as \"A Network Trojan was detected\"\n Detected alert \"ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (TorrentLocker CnC)\" (SID: 2021938, Rev: 2, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)\n Detected alert \"ET POLICY External IP Lookup - ipecho.net\" (SID: 2022351, Rev: 2, Severity: 1) categorized as \"Potential Corporate Privacy Violation\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"6/61 Antivirus vendors marked sample as malicious (9% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"1/87 Antivirus vendors marked dropped file \"System.dll\" as malicious (classified as \"W32.eHeur\" with 1% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into explorer","description":"Injected into \"explorer.exe\" (UID: 00064250-00003256)","origin":"Monitored Target","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$39","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"ipecho.net\"","origin":"Network Traffic","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Scans for artifacts that may help identify the target","description":"\"explorer.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET ACCOUNT MANAGER\\ACCOUNTS\\00000001\")\n \"explorer.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\OUTLOOK\\OMI ACCOUNT MANAGER\\ACCOUNTS\")","origin":"Registry Access","relevance":3,"id":"registry-37","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.DLL at 00059784-00001732-45725-1-004030B6","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]}],"incidents":[{"name":"Remote Access","details_count":2,"details":[{"detail":"Uses network protocols on unusual ports"},{"detail":"Tries to identify its external IP address"}],"sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"name":"Credential Stealer","details_count":1,"details":[{"detail":"Scans for artifacts that may help identify the target"}],"sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Injects into explorer"}],"sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"name":"Fingerprint","details_count":6,"details":[{"detail":"Tries to identify its external IP address"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the windows product ID"},{"detail":"Reads the windows installation date"},{"detail":"Reads the active computer name"},{"detail":"Scans for artifacts that may help identify the target"}],"sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 28 domains and 28 hosts"}],"sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":24,"imported_dlls_count":98,"dropped_files_count":0,"extracted_files_count":12,"files_written_count":47,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":29,"dns_resolutions_count":28,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["Crypt0l0cker","TorrentLocker","ransomware"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"sandbox_reports":[{"id":"58d27d65aac2eda020c0731d","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":".ml.Generic","contacted_countries":["BEL","DEU","FIN","FRA","GBR","JPN","LVA","NLD","NOR","ROU","RUS","SVN","UKR","USA"],"submit_name":"cet.hjn","analysis_start_time":"2017-03-22T14:36:05+00:00","indicators_count":{"informative":21,"suspicious":26,"malicious":12},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"46.183.218.199","port":9001,"protocol":"TCP","country":"Latvia","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"address":"194.1.236.218","port":443,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"address":"82.76.177.134","port":80,"protocol":"TCP","country":"Romania","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"address":"144.76.11.100","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"address":"95.69.232.24","port":444,"protocol":"TCP","country":"Ukraine","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"address":"208.83.223.34","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"address":"81.89.0.198","port":443,"protocol":"TCP","country":"Romania","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"address":"162.222.52.134","port":1940,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"address":"67.92.173.227","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"address":"106.185.28.25","port":3971,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"address":"5.147.7.117","port":9001,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"address":"37.221.171.236","port":9006,"protocol":"TCP","country":"Romania","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"address":"66.215.142.69","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"address":"163.172.149.155","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"address":"217.12.203.46","port":443,"protocol":"TCP","country":"Ukraine","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"address":"89.35.134.154","port":9001,"protocol":"TCP","country":"Romania","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"address":"216.218.222.11","port":9001,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"address":"88.200.73.100","port":443,"protocol":"TCP","country":"Slovenia","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"address":"84.52.225.99","port":64646,"protocol":"TCP","country":"Norway","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"address":"24.148.59.185","port":8443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"address":"193.190.168.51","port":9001,"protocol":"TCP","country":"Belgium","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"address":"46.101.142.174","port":9001,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"address":"92.255.176.138","port":59001,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"address":"51.255.40.227","port":443,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"address":"130.230.113.232","port":443,"protocol":"TCP","country":"Finland","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"address":"51.15.128.190","port":9001,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"address":"89.33.246.114","port":443,"protocol":"TCP","country":"Romania","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"address":"91.233.106.145","port":1111,"protocol":"TCP","country":"Romania","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"address":"81.97.143.247","port":9001,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]}],"dns_resolutions":[{"domain":"atyreseqa.firsoel.net","address":"194.1.236.218","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"domain":"aqtcoquwiqi.firsoel.net","address":"194.1.236.218","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"domain":"yqfgywusyhe.firsoel.net","address":"194.1.236.218","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"domain":"idoxomirsqy.firsoel.net","address":"194.1.236.218","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"domain":"ykezy.firsoel.net","address":"194.1.236.218","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"domain":"emalo.firsoel.net","address":"194.1.236.218","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"domain":"ifavom.firsoel.net","address":"194.1.236.218","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"domain":"mnoty.firsoel.net","address":"194.1.236.218","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"domain":"edolup.firsoel.net","address":"194.1.236.218","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"domain":"ochd.firsoel.net","address":"194.1.236.218","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"domain":"uwoqybo.firsoel.net","address":"194.1.236.218","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"domain":"ipecho.net","address":"82.76.177.134","country":"Romania","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"domain":"ywaze.firsoel.net","address":"194.1.236.218","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"domain":"hnazfqo.firsoel.net","address":"194.1.236.218","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"domain":"eciqyrag.firsoel.net","address":"194.1.236.218","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"domain":"ofudyk.firsoel.net","address":"194.1.236.218","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"domain":"ufikanym.firsoel.net","address":"194.1.236.218","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"domain":"ulyn.firsoel.net","address":"194.1.236.218","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"domain":"ygic.firsoel.net","address":"194.1.236.218","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"domain":"ocyfi.firsoel.net","address":"194.1.236.218","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"domain":"alezyfej.firsoel.net","address":"194.1.236.218","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"domain":"icupijerjty.firsoel.net","address":"194.1.236.218","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"domain":"ofenih.firsoel.net","address":"194.1.236.218","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"domain":"abileffhe.firsoel.net","address":"194.1.236.218","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"domain":"elasacucek.firsoel.net","address":"194.1.236.218","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"domain":"eriwux.firsoel.net","address":"194.1.236.218","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"domain":"idipiz.firsoel.net","address":"194.1.236.218","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"domain":"yqbjijecuxu.firsoel.net","address":"194.1.236.218","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]}],"http_requests":[{"host":"82.76.177.134","host_ip":"82.76.177.134:80","url":"/plain","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /plain HTTP/1.1\nAccept: */*\nHost: ipecho.net\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}],"processes":[{"pid":1732,"ppid":0,"name":"cet.hjn.exe","command_line":"","normalized_path":"C:\\cet.hjn.exe","uid":"00059784-00001732","icon":"$3a"},{"pid":2740,"ppid":1732,"name":"cet.hjn.exe","command_line":"","normalized_path":"C:\\cet.hjn.exe","parent_uid":"00059784-00001732","uid":"00060922-00002740","icon":"$3b"},{"pid":3256,"ppid":2740,"name":"explorer.exe","command_line":"","normalized_path":"%WINDIR%\\explorer.exe","parent_uid":"00060922-00002740","uid":"00064250-00003256","icon":"$3c"}],"all_imported_dlls":["dui70.dll","ws2_32.dll","iertutil.dll","usp10.dll","cryptsp.dll","crypt32.dll","msasn1.dll","mswsock.dll","credssp.dll","sechost.dll","comctl32.dll","cfgmgr32.dll","msxml3.dll","bcrypt.dll","propsys.dll","cryptbase.dll","uxtheme.dll","sspicli.dll","rasman.dll","OLMAPI32.DLL","msvcp90.dll","msxml3r.dll","shlwapi.dll","advapi32.dll","mapi32.dll","sfc.dll","winnsi.dll","wintrust.dll","ncrypt.dll","cabinet.dll","user32.dll","msvcrt.dll","imm32.dll","normaliz.dll","schannel.dll","nlaapi.dll","devrtl.dll","dhcpcsvc6.dll","ole32.dll","rsaenh.dll","ExplorerFrame.dll","slc.dll","rasapi32.dll","msi.dll","MAPIR.DLL","RICHED20.DLL","ntdll.dll","gdi32.dll","rasadhlp.dll","pnrpnsp.dll","MSO.DLL","gpapi.dll","dhcpcsvc.dll","shell32.dll","nsi.dll","rtutils.dll","MSMAPI32.DLL","lpk.dll","ntmarta.dll","wininet.dll","atl.dll","IPHLPAPI.DLL","version.dll","oleaut32.dll","Wldap32.dll","duser.dll","GdiPlus.dll","WSHTCPIP.DLL","sfc_os.dll","FWPUCLNT.DLL","rpcrt4.dll","KernelBase.dll","msctf.dll","clbcatq.dll","profapi.dll","userenv.dll","SensApi.dll","msvcr90.dll","devobj.dll","apphelp.dll","dwmapi.dll","urlmon.dll","NapiNSP.dll","bcryptprimitives.dll","cryptnet.dll","webio.dll","kernel32.dll","rpcss.dll","setupapi.dll","System.dll","winhttp.dll","shfolder.dll","dnsapi.dll","winrnr.dll","wship6.dll","powrprof.dll","secur32.dll","pstorec.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"System.dll","sha256":"75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"name":"TarF240.tmp","sha256":"7e58975a4e1e86940f84e744709426939b85ae174dbbf020da3c893a54fd1da2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"name":"plain[1].txt","sha256":"e38ee7ad0d45a01a4d35a323398574a53313d96a76b8d763cc444bf7624a0576","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"name":"94308059B57B3142E455B38A6EB92015","sha256":"3e05951301c78caa5038603782f35949663cdb335d25f5587b627e15253631d5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"name":"Cab6FC.tmp","sha256":"3e05951301c78caa5038603782f35949663cdb335d25f5587b627e15253631d5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"name":"CabF21F.tmp","sha256":"c929701c67a05f90827563eedccf5eba8e65b2da970189a0371f28cd896708b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"name":"CabF23F.tmp","sha256":"c929701c67a05f90827563eedccf5eba8e65b2da970189a0371f28cd896708b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"name":"Satire","sha256":"7c324732685bc2e4e70713727a4f5dc25eb0b0bf4a4411b19e133e5f5d40ab8b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"name":"Tar6FD.tmp","sha256":"69df9ff9aff398c9fad1555b1734c3874098314443d6672b4f5e5d5cf45d4a44","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"name":"TarF220.tmp","sha256":"7e58975a4e1e86940f84e744709426939b85ae174dbbf020da3c893a54fd1da2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"name":"modernness.dll","sha256":"a9173300eb0307adc0a5f45e0f70c0628eb6c6796dc296ca1176e41ece555f32","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"name":"avusukam.exe","sha256":"bacf590ee11fa7862543d4fb0407101a0840673e4aea88cc7826553d2e8dc526","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"%TEMP%\\modernness.dll","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"C:\\Users\\zGSJ9OI","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"%TEMP%\\nsi3629.tmp","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"%TEMP%\\Satire","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"C:\\cet.hjn.exe","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"%ALLUSERSPROFILE%\\uwupefovygigylih","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"%WINDIR%\\en-US\\explorer.exe.mui","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"%WINDIR%\\system32","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"%ALLUSERSPROFILE%\\uwupefovygigylih\\asiwahiz","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"%WINDIR%\\avusukam.exe","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"%ALLUSERSPROFILE%\\uwupefovygigylih\\ebiwewiz","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"%ALLUSERSPROFILE%\\uwupefovygigylih\\ewiwobiz","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\office14\\MSO.DLL","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"%WINDIR%\\system32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"%WINDIR%\\system32\\en-US\\CRYPT32.DLL.mui","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"%WINDIR%\\system32\\en-US\\WINHTTP.dll.mui","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\PHISHINGFILTER\\","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\epifasacizecoxux","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\efyzerywyjuhyzogyreduqy","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\iremenokofyciwyxerynokexivegewi","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"name":"Global\\efyzerywyjuhyzogyreduqy","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"name":"Global\\iremenokofyciwyxerynokexivegewi","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"name":"Global\\epifasacizecoxux","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!zgsj9oi!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!zgsj9oi!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!zgsj9oi!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!zgsj9oi!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\OfficeSharedLocks_Heap_00_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\4D4150494C6F676F6E0070B872C47FD7101B8BEA00AA0038C699_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\OfficeSharedLocks_BootMutex_00_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"58d27d65aac2eda020c0731d"}]}]}},"report_ids":{"sandbox_job_ids":["58d27d65aac2eda020c0731d"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious Trojan.Generic Sample bacf590ee11f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample bacf590ee11f…. Malware family: Trojan.Generic. Threat score 100/100. 18/28 AV engines flagged this file. 9 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/bacf590ee11fa7862543d4fb0407101a0840673e4aea88cc7826553d2e8dc526"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample bacf590ee11f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample bacf590ee11f…. Malware family: Trojan.Generic. Threat score 100/100. 18/28 AV engines flagged this file. 9 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/bacf590ee11fa7862543d4fb0407101a0840673e4aea88cc7826553d2e8dc526"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample bacf590ee11f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample bacf590ee11f…. Malware family: Trojan.Generic. Threat score 100/100. 18/28 AV engines flagged this file. 9 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3d","11",{}]] 32:null