21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 28:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T497,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Cryptolocky Sample bdcd2446361b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample bdcd2446361b…. Malware family: Trojan.Cryptolocky. Threat score 100/100. 24/29 AV engines flagged this file. 8 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/bdcd2446361be70ac12a6756029dee6dedbf0dfdd04f6ef9f97b578e9424c336","keywords":["Malicious","Trojan.Cryptolocky","malware analysis","sandbox report","threat intelligence","bdcd2446361be70ac12a6756029dee6dedbf0dfdd04f6ef9f97b578e9424c336"],"about":{"@type":"SoftwareApplication","name":"malware2.exe","applicationCategory":["peexe","executable"],"identifier":"bdcd2446361be70ac12a6756029dee6dedbf0dfdd04f6ef9f97b578e9424c336","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Cryptolocky","antivirusDetections":{"malicious":24,"total":29},"behavioralIndicators":{"malicious":8,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T415,"" loaded module "KERNEL32.DLL" at base 77430000 "" loaded module "USER32.DLL" at base 75E70000 "" loaded module "GDI32.DLL" at base 76240000 "" loaded module "ADVAPI32.DLL" at base 77080000 "" loaded module "SHELL32.DLL" at base 76290000 "" loaded module "WININET.DLL" at base 76090000 "" loaded module "MPR.DLL" at base 72720000 "" loaded module "NETAPI32.DLL" at base 74170000 "" loaded module "URLMON.DLL" at base 76EE0000 "" loaded module "CRYPTSP.DLL" at base 75560000 "" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 75300000 "" loaded module "CRYPTBASE.DLL" at base 75A30000 "" loaded module "COMCTL32.DLL" at base 74960000 "" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77B10000 "" loaded module "PROFAPI.DLL" at base 75AE0000 "" loaded module "NTMARTA.DLL" at base 7507000023:T595,"32C0D883E1644D0AF3C34DE03F32DDB0.locky" has type "data" "32C0D883E1644D0A68491046E65449C3.locky" has type "XML document text" "_HELP_instructions.txt" has type "UTF-8 Unicode (with BOM) text, with CRLF line terminators" "32C0D883E1644D0AA67298E0F37BD353.locky" has type "XML document text" "32C0D883E1644D0A3BF7E72CDAD2FF4D.locky" has type "XML document text" "32C0D883E1644D0A73C52C376D8E423A.locky" has type "XML document text" "32C0D883E1644D0A82488DC0F0F0E831.locky" has type "XML document text" "32C0D883E1644D0A6E85A759B0308733.locky" has type "XML document text" "32C0D883E1644D0AD1A950F196287AF7.locky" has type "XML document text" "32C0D883E1644D0A3E1278D175A0D63D.locky" has type "XML document text" "32C0D883E1644D0A1803A83C5F20BBB9.locky" has type "XML document text" "32C0D883E1644D0A55FA7DA299E30FCF.locky" has type "XML document text" "32C0D883E1644D0AB096205524FA0B9C.locky" has type "XML document text" "32C0D883E1644D0ADFF4FA2A3663E6DA.locky" has type "XML document text" "32C0D883E1644D0A034B58C686B1EA28.locky" has type "XML document text" "32C0D883E1644D0A28A4369477C54EBC.locky" has type "XML document text" "32C0D883E1644D0A2CDA90B9A718368A.locky" has type "XML document text" "32C0D883E1644D0A4A55AF68E5232EBB.locky" has type "XML document text" "32C0D883E1644D0A8BF52EED1DE51D0B.locky" has type "XML document text" "32C0D883E1644D0AB81FF6D3356E78E6.locky" has type "XML document text"24:T598,"POST /main.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 46.8.44.39 Content-Length: 100 Connection: Keep-Alive Cache-Control: no-cache" with no payload "POST /main.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 46.8.44.39 Content-Length: 55 Connection: Keep-Alive Cache-Control: no-cache" with no payload "POST /main.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 46.8.44.39 Content-Length: 124 Connection: Keep-Alive Cache-Control: no-cache" with no payload "POST /main.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 46.8.44.39 Content-Length: 93 Connection: Keep-Alive Cache-Control: no-cache" with no payload25:T636,"" opened "UNC\USLOFT4112\VxAnalysisData\VM14\VxStream\libs\spring-beans-4.0.5.RELEASE.jar" with delete access "" opened "UNC\USLOFT4112\VxAnalysisData\VM11\VxStream\libs\commons-io-2.4.jar" with delete access "" opened "UNC\USLOFT4112\VxAnalysisData\VM11\VxStream\libs\spring-core-4.0.5.RELEASE.jar" with delete access "" opened "UNC\USLOFT4112\VxAnalysisData\VM11\VxStream\libs\spring-beans-4.0.5.RELEASE.jar" with delete access "" opened "UNC\USLOFT4112\VxAnalysisData\VM11\VxStream\libs\commons-logging-1.1.3.jar" with delete access "" opened "UNC\USLOFT4112\VxAnalysisData\VM11\VxStream\libs\jcommander-1.35.jar" with delete access "" opened "UNC\USLOFT4112\VxAnalysisData\VM11\VxStream\libs\log4j-1.2.17.jar" with delete access "" opened "UNC\USLOFT4112\VxAnalysisData\VM11\VxStream\libs\spring-context-4.0.5.RELEASE.jar" with delete access "" opened "UNC\USLOFT4112\VxAnalysisData\VM11\VxStream\libs\VxUtils.jar" with delete access "" opened "UNC\USLOFT4112\VxAnalysisData\VM11\VxStream\libs\spring-expression-4.0.5.RELEASE.jar" with delete access "" opened "UNC\USLOFT4112\VxAnalysisData\VM11\VxStream\libs\spring-context-support-4.0.5.RELEASE.jar" with delete access "" opened "UNC\USLOFT4112\VxAnalysisData\VM13\VxStream\libs\spring-core-4.0.5.RELEASE.jar" with delete access "" opened "UNC\USLOFT4112\VxAnalysisData\VM13\VxStream\libs\spring-beans-4.0.5.RELEASE.jar" with delete access26:T8fa,Found dropped filename "32C0D883E1644D0AF3C34DE03F32DDB0.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A68491046E65449C3.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0AA67298E0F37BD353.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A3BF7E72CDAD2FF4D.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A73C52C376D8E423A.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A82488DC0F0F0E831.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A6E85A759B0308733.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0AD1A950F196287AF7.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A3E1278D175A0D63D.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A1803A83C5F20BBB9.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A55FA7DA299E30FCF.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0AB096205524FA0B9C.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0ADFF4FA2A3663E6DA.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A034B58C686B1EA28.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A28A4369477C54EBC.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A2CDA90B9A718368A.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A4A55AF68E5232EBB.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A8BF52EED1DE51D0B.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0AB81FF6D3356E78E6.locky" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0AA58EBE2A4DC35206.locky" which has been seen in the context of ransomware27:T948,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAaLSURBVFhH7ZZ5U1NnFMb9NC1al6qtte7roAguWHGrdSuL7KssirKDQEADhMUEAiEQEpJAFsKWkJtAAihVauuCex3HTr/E03OuTQgiasv0n04z885N7ty8v+ec95zn3CVL/v8sMgPDvQ3wjlqg1ebBt9W42wxBsMPj0PvvLRKz8N9ve+2Ynp7GuGD2w0adg3C5XBi1G/59AZMuM6ampuAZc8Pe04T+7lrYh4dgt9vhGuz2CxixNMNsUEMwKxcnytOnxARBHRqJuJFgVcLr9WJsbAzDBB4aGqLrMAYGBmCzGOEwNcNpVqBbq4FGo0G/Xr44AZNjg2LKPWMCPEM6uBx9YroFQYDD4cDg4CBsNhssFgt6e3uh1+vR1aVBZ2cnOlXN0MpLFyfA21uHcY8bExMT8Hg8cLvdcDqd/qj7+vpgNpvR09MjwrVaLTo6OqBSqWBW1ywO7itFp0kBt0sQIx8ZGRHT3t/fD6vVKkZtMBig0+nElKvVarS1taGlpQWqm7Vor8mBrbUEvYpSGBWF/0yQ0C0TwVxovpT39hhg0ynQ3y6BSVkOi1qG9rZmtLa2QqFQoKmpCfX19aiVVqOqqgoSiQSdspJPFyBYO+G292HUYYM1KRGuS5dglErBKe8x6DGsfluUvo/+eiEGm4sx0NCAwagoGL4/BSk9X11djYqKCsgkRRiQz3rHR33CbtGJRWZNSsIzSuebri6MkghlQQFMHQ3vjaQlNBSOuDi8oMifSmugO3Yc5eXl0Egvoyol5dOjZ3WNmVGwJsSJ8NdUUC/r6sSrOysLrWnR8zbTHDjoh8+QyJniYsxQ9PqIozBI0/8enAVYY2Nn4bW1eEHpfHHjBl4plRDS01EZEuLf9F34g0uXcT87Gw/zC/CoohK6w99BUZIOc3Xyx4XwGfOyUcpGr13DzPXrIvw5XZ9JqmhJ8JtcDmdyCiqCg6HYN5t2jtwH/zUzE3dS0zAQnwBd+GFk0u/czHeOgfvZZDLNUSU6GhmLPCUZ1vh4OPPy8KiyUoQ/pWiekiheLxsa4UhImJP2d+F9UdHoCg1D6u4dqMiOQ93lmFkW9y2bC1sq9zOnne8xnHtbLSuD/MoVmGNi4LiciwdlZSL4SWkZHtP58npeJxMLLjDye5SZWxdi4YNnBW9fOO1sp289fVgUwdlgS2VjaayXQld7FQ1J0TBFRsJOZ3q/qEgEzxQW4VF+vrgeksifY+Pw06kfcOtIBFxUjKptO9C6ZSvSwsKQnx4LQ8G594tgELcaOxtHzpZqNBpFV2tvb4eczppXTVoaes+ew9DFi/gl7y9w7hXcI/DUiZO4ffTYPPhVasEkauE4asvi5DPQ5h2ZL4JhbKlcdCyGbZQXw32O1tjYiBtU/dLI0zBSlCximrJx99z5heHHT0CbcwS1aSeQfOE8kqLOQp8X8VYA26lvmPimGA8RHh5i+9FRMNRnpdep+qV5VEDJiRAys/AHFelMUfEc+CRVuYdabZIyYqEjyKTlczpt+iG0ZYTPRs/n7Iuav3PkHHGgNfJEYxvlyNlGO8+EQ8jIwO8Wq2gwgWln+MSBQxgP24+JQ+G4SyJM1JrxK1YuXHycXh6Z3d3d4gRrbm6e93AltR6vG8nJcFI/vzH2ELxkDtxLQCF0vwj3hoTCs2cvvNR2d6j9eoL3InfFqoVFyGQy/+i8efMmcnJy/A8XU5TXqOVs9MwICXhNc+ApGVBg5AzX7NiFNqr2EQIzfGx3MEZ37sJY8B5MUY0Yd+5G/hcr5otgoJIslTPBVc5nXlNTI0J5eJSWlqKL+t6RmIhXrW14UinBPXI0X7X74Nxqyk2bodywEXYCM9y1bTsEuu8mcbdPnYZ+63ZcDVo6K4LPlaH8wsCFVks+z3AemwwvKSlBYWEhbD9GYqa+AY/JeNjhfH0eCM+NiED8lm1oWf8tWtZ9g6HNWyHQcm7chJH1G8Tvo9SOHSTQX2PZ1EL8olBH040jDlyc+nwyl0s0dtsPHoIlOgau1FRxsLDJBMILTp70b5q6chUUX62DYs1aDBCY4Q4SZFy1GrLPg1D3WdCHhxBHzOsKuVoamU4ipT6FhpGKCspEmRihyRgIz6Cie/eFIp9EyL9cAzldbWu//nQ4b8Tg3NxcZNGsD9w4lsCqkH0wkLGo6Gz5zBNXr1kwGi64puUr0bT0i0+L3AdjMI/LdJrz73tVatm6Taz2pA/A+X9ly5aLBdcYtOzjaf/oO9l/9YE/AV3hAPFYegrXAAAAAElFTkSuQmCC18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"bdcd2446361be70ac12a6756029dee6dedbf0dfdd04f6ef9f97b578e9424c336","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790555348362,"unified_at":"2026-09-28T00:29:08.362Z","metadata":{"hashes":{"sha256":"bdcd2446361be70ac12a6756029dee6dedbf0dfdd04f6ef9f97b578e9424c336","sha1":"ae2c77498fd7fd89955950b344406d8987670bd5","md5":"f5d668c551cecb12f6404214fb0c8251","sha512":"e911d6bd7211088dda98b5c5a66fd552438379381b12c86bd69ce03df52ee3ad908960a3293bbf76df3c90584ebcd9d7fc32a92bd0ea23cb9a3d7afa34c1195c","ssdeep":"3072:U/t5WEwWQObXiTm8vikffKUl7xixJS1/yJ4KsyAL2E3:0eEwWPXi3vFE","ssdeep_chunks":["3072:U/t5WEw","3072:/t5WEwW","3072:t5WEwWQ","3072:5WEwWQO","3072:WEwWQOb","3072:EwWQObX","3072:wWQObXi","3072:WQObXiT","3072:QObXiTm","3072:ObXiTm8","3072:bXiTm8v","3072:XiTm8vi","3072:iTm8vik","3072:Tm8vikf","3072:m8vikff","3072:8vikffK","3072:vikffKU","3072:ikffKUl","3072:kffKUl7","3072:ffKUl7x","3072:fKUl7xi","3072:KUl7xix","3072:Ul7xixJ","3072:l7xixJS","3072:7xixJS1","3072:xixJS1/","3072:ixJS1/y","3072:xJS1/yJ","3072:JS1/yJ4","3072:S1/yJ4K","3072:1/yJ4Ks","3072:/yJ4Ksy","3072:yJ4KsyA","3072:J4KsyAL","3072:4KsyAL2","3072:KsyAL2E","3072:syAL2E3","6144:U/t5WEw","6144:/t5WEwW","6144:t5WEwWQ","6144:5WEwWQO","6144:WEwWQOb","6144:EwWQObX","6144:wWQObXi","6144:WQObXiT","6144:QObXiTm","6144:ObXiTm8","6144:bXiTm8v","6144:XiTm8vi","6144:iTm8vik","6144:Tm8vikf","6144:m8vikff","6144:8vikffK","6144:vikffKU","6144:ikffKUl","6144:kffKUl7","6144:ffKUl7x","6144:fKUl7xi","6144:KUl7xix","6144:Ul7xixJ","6144:l7xixJS","6144:7xixJS1","6144:xixJS1/","6144:ixJS1/y","6144:xJS1/yJ","6144:JS1/yJ4","6144:S1/yJ4K","6144:1/yJ4Ks","6144:/yJ4Ksy","6144:yJ4KsyA","6144:J4KsyAL","6144:4KsyAL2","6144:KsyAL2E","6144:syAL2E3","3072:0eEwWPX","3072:eEwWPXi","3072:EwWPXi3","3072:wWPXi3v","3072:WPXi3vF","3072:PXi3vFE"],"imphash":"efccceb56e253f9f8801721ff25a0ee0"},"file_info":{"file_name":"malware2.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":163328,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499295483000,"last_seen":1665488726000,"last_multi_scan":1665488726000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":24,"suspicious_count":0,"total_engines":29},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":12,"suspicious_count":20,"malicious_count":8,"total":40},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Win-Trojan/Lockycrypt.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/Win32.Locky.gena","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1229366","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Razy.33834","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.Ransom.Locky.DN","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Locky.G.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Razy.33834 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.ESGK trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Locky","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004e13411 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Ransomware-FHC!F5D668C551CE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.ebetax","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Ransom.Locky.ME5","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Ransom-CPT","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Ransom.TeslaCrypt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.Locky.163328.D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_.6CFC37B1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_.6CFC37B1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Cryptolocky.X","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Hoax.Locky","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.CryptGen.Win32.3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Cryptolocky","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTime@KERNEL32.DLL at 00124765-00002896-779F228D-130104\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00124765-00002896-779F228D-130138","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceExW@KERNEL32.DLL at 00124765-00002896-779F228D-130101","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"46.8.44.39:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"Y:\\4nf1gg\\4qeu\\l2\\e87eg\\3rrfa6sr\\cf\\sjd\\z0ga3\\ekz9ibclh.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"DBWinMutex\"\n \"Local\\_!MSFTHISTORY!_\"\n \"Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!\"\n \"Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!\"\n \"Local\\WininetStartupMutex\"\n \"Local\\WininetConnectionMutex\"\n \"Local\\WininetProxyRegistryMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$22","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"RtlCompressBuffer@ntdll.dll\"\n \"RtlDecompressBuffer@ntdll.dll\"\n \"CryptCreateHash@ADVAPI32.dll\"\n \"AccessCheck@ADVAPI32.dll\"\n \"MapGenericMask@ADVAPI32.dll\"\n \"DuplicateToken@ADVAPI32.dll\"\n \"OpenThreadToken@ADVAPI32.dll\"\n \"GetFileSecurityW@ADVAPI32.dll\"\n \"CryptHashData@ADVAPI32.dll\"\n \"SetTokenInformation@ADVAPI32.dll\"\n \"OpenProcessToken@ADVAPI32.dll\"\n \"CryptDestroyHash@ADVAPI32.dll\"\n \"CryptGetHashParam@ADVAPI32.dll\"\n \"RegSetValueExW@ADVAPI32.dll\"\n \"RegQueryValueExA@ADVAPI32.dll\"\n \"RegSetValueExA@ADVAPI32.dll\"\n \"RegDeleteValueA@ADVAPI32.dll\"\n \"RegCreateKeyExA@ADVAPI32.dll\"\n \"RegOpenKeyExA@ADVAPI32.dll\"\n \"RegCloseKey@ADVAPI32.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/C del /Q /F \"%TEMP%\\sys1F31.tmp\"\" on 2016-03-24.05:06:02","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"NOTEPAD.EXE\" with commandline \"%USERPROFILE%\\Desktop\\_HELP_instructions.txt\" (UID: 00202437-00001436)\n Spawned process \"cmd.exe\" with commandline \"/C del /Q /F \"%TEMP%\\sys1F31.tmp\"\" (UID: 00204640-00003396)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"LookupAccountNameLocalW@SECHOST.DLL at 00124765-00002896-779F228D-152161","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$23","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"Southsoftware.com\"\n Heuristic match: \"ware.com\"\n Pattern match: \"http://en.wikipedia.org/wiki/R\"\n Heuristic match: \"#T6L)F/U261[l^R[PxP7X^>.jp\"\n Pattern match: \"http://en.wikipedia.org/wiki/RSA_(cryptosystem)\"\n Pattern match: \"http://en.wikipedia.org/wiki/Advanced_Encryption_Standard\"\n Pattern match: \"http://32kl2rwsjvqjeui7.tor2web.org/32C0D883E1644D0A\"\n Pattern match: \"http://32kl2rwsjvqjeui7.onion.to/32C0D883E1644D0A\"\n Pattern match: \"http://32kl2rwsjvqjeui7.onion.cab/32C0D883E1644D0A\"\n Pattern match: \"https://www.torproject.org/download/download-easy.html\"\n Pattern match: \"2rwsJvqJeui7.0ni0n.cab/32cODBB3E1644DOA_\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00124765-00002896-779F228D-130129","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".data with unusual entropies 7.14948462462","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@KERNEL32.DLL at 00124765-00002896-779F228D-130132\n RasRpcGetVersion@RASMAN.DLL at 00124765-00002896-779F228D-151622\n GetVersion@KERNEL32.DLL at 00124765-00002896-32243-4-00402443","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"g$,ug%I7`d4=/x 0V~-~(6vQ4T_?M/G8?Svp^y$.6T(&E@C)(Ii)Jw4EH{vboxy>JAdI`Y}!0~?v^l=RL+8@XZeV09vm[m,/4)'Ur3TCx#\" (Indicator: \"vbox\")","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")\n \"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"$24","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"\" created file \"C:\\Windows\\\"\n \"\" created file \"C:\\Windows\\system32\\rsaenh.dll\"\n \"\" created file \"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" created file \"%APPDATA%\\Microsoft\\Windows\\Cookies\"\n \"\" created file \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\"\n \"\" created file \"C:\\Windows\\system32\\vssadmin.exe\"\n \"\" created file \"C:\\Windows\\Fonts\\staticcache.dat\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db\"\n \"\" created file \"C:\\Windows\\system32\\NOTEPAD.EXE\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"46.8.44.39\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Changes the desktop background picture","description":"\"\" (Access type: \"SETVAL\", Path: \"HKCU\\CONTROL PANEL\\DESKTOP\", Key: \"WALLPAPERSTYLE\", Value: \"30000000\")\n \"\" (Access type: \"SETVAL\", Path: \"HKCU\\CONTROL PANEL\\DESKTOP\", Key: \"TILEWALLPAPER\", Value: \"30000000\")","origin":"Registry Access","relevance":10,"id":"registry-22","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"\"~*_=*=.|=-~-.|*~\n$~+~-*|_=-.=$$=$\n.-_--_+~==\n !!! IMPORTANT INFORMATION !!!!\n\nAll of your files are encrypted with RSA-2048 and AES-128 ciphers.\nMore information about the RSA and AES can be found here:\n http://en.wikipedia.org/wiki/R\" (Source: 00124765-00002896-779D6A68-188693, Indicator: \"files are encrypted\")\n \"All of your files are encrypted with RSA-2048 and AES-128 ciphers.\" (Source: _HELP_instructions.txt, Indicator: \"files are encrypted\")\n \"Decrypting of your files is only possible with the private key and decrypt program, which is on our secret server.\" (Source: _HELP_instructions.txt, Indicator: \"private key and decrypt program\")","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$25","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to elevate privileges","description":"SetEntriesInAclW@ADVAPI32.DLL at 00124765-00002896-779F228D-202339\n SetSecurityDescriptorDacl@ADVAPI32.DLL at 00124765-00002896-779F228D-202343","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-44","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"SETVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYENABLE\", Value: \"00000000\")\n \"\" (Access type: \"DELETEVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYSERVER\")\n \"\" (Access type: \"DELETEVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYOVERRIDE\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"level":"suspicious","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"NOTEPAD.EXE\" (Access type: \"QUERYVAL\", Path: \"HKCR\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.TXT\", Key: \"ALWAYSSHOWEXT\")\n \"NOTEPAD.EXE\" (Access type: \"QUERYVAL\", Path: \"HKCR\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\TEXT\", Key: \"ALWAYSSHOWEXT\")\n \"NOTEPAD.EXE\" (Access type: \"QUERYVAL\", Path: \"HKCR\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.TXT\", Key: \"NEVERSHOWEXT\")\n \"NOTEPAD.EXE\" (Access type: \"QUERYVAL\", Path: \"HKCR\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\TEXT\", Key: \"NEVERSHOWEXT\")","origin":"Registry Access","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"DeviceIoControl\n GetCommandLineW\n FindFirstFileW\n WriteFile\n GetFileAttributesW\n UnhandledExceptionFilter\n GetModuleFileNameA\n VirtualAlloc\n GetTickCount\n CreateProcessW\n LoadLibraryA\n GetProcAddress\n GetFileSizeEx\n GetStartupInfoW\n TerminateProcess\n LockResource\n FindNextFileW\n ExitThread\n CreateFileW\n LoadLibraryW\n FindResourceExW\n CreateDirectoryW\n OpenFileMappingW\n Sleep\n DeleteFileW\n IsDebuggerPresent\n Process32NextW\n CreateFileMappingW\n GetFileSize\n GetModuleHandleA\n OutputDebugStringW\n VirtualProtectEx\n MapViewOfFile\n ReadProcessMemory\n FindResourceW\n OpenProcess\n GetModuleFileNameW\n GetVersionExW\n Process32FirstW\n GetStartupInfoA\n GetTempPathW\n CreateToolhelp32Snapshot\n CreateThread\n GetTempFileNameW\n GetDriveTypeW\n LoadLibraryExW\n GetModuleHandleW\n CreateFileA\n GetWindowThreadProcessId\n RegDeleteKeyW\n RegOpenKeyW\n RegEnumKeyExW\n OpenProcessToken\n RegDeleteValueW\n RegCreateKeyExW\n RegCloseKey\n RegOpenKeyExW\n CreateServiceW\n StartServiceW\n CreateProcessAsUserW\n GetModuleFileNameExW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"NOTEPAD.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\", Key: \"00000409\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\", Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"4/56 Antivirus vendors marked sample as malicious (7% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated 00000088 bytes of memory in \"notepad.exe\" (Protection: \"read/write\")\n \"\" allocated 00000088 bytes of memory in \"cmd.exe\" (Protection: \"read/write\")","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a foreign process \"vssadmin.exe\" (PID: 00003524)\n \"\" wrote 52 bytes to a foreign process \"vssadmin.exe\" (PID: 00003524)\n \"\" wrote 4 bytes to a foreign process \"vssadmin.exe\" (PID: 00003524)\n \"\" wrote 32 bytes to a foreign process \"notepad.exe\" (PID: 00001436)\n \"\" wrote 52 bytes to a foreign process \"notepad.exe\" (PID: 00001436)\n \"\" wrote 4 bytes to a foreign process \"notepad.exe\" (PID: 00001436)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by Ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00186046-00003524)","origin":"Monitored Target","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Detected text artifact in screenshot that indicate file is ransomware","description":"\"decrypT\" (Source: screen_2.png, Indicator: \"decrypt\")\n \"DecrypTing\" (Source: screen_2.png, Indicator: \"decrypt\")\n \"(crypT0sysTem7\" (Source: screen_2.png, Indicator: \"crypt0\")","origin":"File/Memory","relevance":8,"id":"string-12","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"level":"malicious","category":"Ransomware/Banking","name":"The input sample dropped a known ransomware file","description":"$26","origin":"Binary File","relevance":5,"id":"binary-9","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\" (Type: \"FileHandle\", Context: \"NtSetInformationFile\")","origin":"Touched Handle","relevance":5,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtQueryVirtualMemory@NTDLL.DLL at 00124765-00002896-779F228D-130269\n NtSetSystemInformation@NTDLL.DLL at 00124765-00002896-779F228D-201887","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"name":"Spyware/Leak","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"name":"Ransomware","details_count":2,"details":[{"detail":"The input sample dropped a known ransomware file"},{"detail":"Deletes volume snapshots (often used by Ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":76,"dropped_files_count":0,"extracted_files_count":19,"files_written_count":47,"files_deleted_count":0,"registry_keys_created_count":6,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":6,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"56f3d356aac2ed151c0b443f","environment_id":4,"environment_description":"Windows 7 32 bit - Kernelmode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":96,"malware_family":"Lockycrypt.Gen","contacted_countries":["RUS"],"submit_name":"malware2.exe","analysis_start_time":"2016-03-24T06:54:16+00:00","indicators_count":{"informative":8,"suspicious":23,"malicious":7},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"56f3d356aac2ed151c0b443d","environment_id":1,"environment_description":"Windows 7 32 bit - Usermode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Lockycrypt.Gen","contacted_countries":["RUS"],"submit_name":"malware2.exe","analysis_start_time":"2016-03-24T07:01:21+00:00","indicators_count":{"informative":12,"suspicious":27,"malicious":9},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"46.8.44.39","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]}],"dns_resolutions":null,"http_requests":[{"host":"46.8.44.39","host_ip":"46.8.44.39:80","url":"/main.php","method":"POST","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}],"processes":[{"pid":2896,"ppid":0,"name":"malware2.exe","command_line":"","normalized_path":"Z:\\malware2.exe","uid":"00124765-00002896","icon":"$27"},{"pid":3524,"ppid":0,"name":"vssadmin.exe","command_line":"Delete Shadows /All /Quiet","normalized_path":"%WINDIR%\\system32\\vssadmin.exe","uid":"00186046-00003524"},{"pid":1436,"ppid":0,"name":"NOTEPAD.EXE","command_line":"%USERPROFILE%\\Desktop\\_HELP_instructions.txt","normalized_path":"%WINDIR%\\system32\\NOTEPAD.EXE","uid":"00202437-00001436"},{"pid":3396,"ppid":0,"name":"cmd.exe","command_line":"/C del /Q /F \"%TEMP%\\sys1F31.tmp\"","normalized_path":"%WINDIR%\\system32\\cmd.exe","uid":"00204640-00003396"}],"all_imported_dlls":["COMCTL32.dll","GDI32.dll","USERENV.dll","NLAapi.dll","mswsock.dll","davclnt.dll","cscapi.dll","ADVAPI32.dll","NETMSG.DLL","MSIMG32.dll","uxtheme.dll","CLBCatQ.DLL","WINBRAND.dll","WINNSI.DLL","KERNELBASE.dll","PSAPI.DLL","ATL.DLL","VssTrace.DLL","IPHLPAPI.DLL","rsaenh.dll","RASAPI32.dll","sensapi.dll","srvcli.dll","msvcrt.dll","SHELL32.dll","MSCTF.dll","SspiCli.dll","RpcRtRemote.dll","webio.dll","oledlg.dll","ntdll.dll","netutils.dll","DEVOBJ.dll","NSI.dll","RPCRT4.dll","WindowsCodecs.dll","kernel32.dll","MPR.dll","IconCodecService.dll","PhotoViewer.dll","rasman.dll","wshtcpip.DLL","LPK.dll","OLEAUT32.dll","VERSION.dll","SHLWAPI.dll","CRYPTBASE.dll","rtutils.dll","WINHTTP.dll","CFGMGR32.dll","CRYPTSP.dll","rasadhlp.dll","drprov.dll","browcli.dll","PROPSYS.dll","ieproxy.dll","urlmon.dll","VSSAPI.DLL","COMDLG32.dll","dwmapi.dll","SETUPAPI.dll","IMM32.DLL","profapi.dll","WININET.dll","wshqos.dll","ntlanman.dll","vss_ps.dll","USER32.dll","sechost.dll","ntmarta.dll","apphelp.dll","ole32.dll","USP10.dll","WTSAPI32.dll","NETAPI32.dll","wkscli.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"32C0D883E1644D0AF3C34DE03F32DDB0.locky","sha256":"994fe242368dbb16a16f7e5ac55d98b9f6366f7c305d853c18d2755431bc4cd9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"name":"32C0D883E1644D0A68491046E65449C3.locky","sha256":"155899dbdbabd1f8a59a7e55c0f790d19400f6b34dea76d91470a40801f4b3a3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"name":"_HELP_instructions.txt","sha256":"8be3a684378bf8a91c9b8cffdb650f7f4c9d2e84f3f4006b3b5e25f08ef6d74c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"name":"32C0D883E1644D0AA67298E0F37BD353.locky","sha256":"f555fc2fa84acec9f1a24e324c9d52c3803120898982663385617ce9888702a1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"name":"32C0D883E1644D0A3BF7E72CDAD2FF4D.locky","sha256":"abece1a665fa984dc90cdfa109d14acf85e17063302672fae32d54fcd9926a82","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"name":"32C0D883E1644D0A73C52C376D8E423A.locky","sha256":"5651c3a796cb36bae59c7b814d1b250ce28c346bc188fa311f74388048ea08f9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"name":"32C0D883E1644D0A82488DC0F0F0E831.locky","sha256":"a860b531c52869416a5f883a0e2350dee9fba60c996d40fd157f8062a53fd27f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"name":"32C0D883E1644D0A6E85A759B0308733.locky","sha256":"46e7a79c301b31a3bddae25e565a8397be42633fe9e3ad6140073ddf77a22766","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"name":"32C0D883E1644D0AD1A950F196287AF7.locky","sha256":"c6688e14e2fb1b67e5e3b3c79a020b07006202881a68d2874cdd13b53db9cf15","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"name":"32C0D883E1644D0A3E1278D175A0D63D.locky","sha256":"d7d5ec9a9247410c0dd9e7c9034661c6c024f5d6aae7b331c6b9ac255920a007","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"name":"32C0D883E1644D0A1803A83C5F20BBB9.locky","sha256":"baf802e4ea2975fa3753c1980c4fa9f986d05cadc553778435875262b66fa0a9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"name":"32C0D883E1644D0A55FA7DA299E30FCF.locky","sha256":"2e5cc4dec46bf59fd9d52c1ec56b3aafdd5979a7433e513e4da35f944ee29ce3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"name":"32C0D883E1644D0AB096205524FA0B9C.locky","sha256":"936756871567877eed970787f7c322cb14c81d685cd9c01d234132efca8a5fc5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"name":"32C0D883E1644D0ADFF4FA2A3663E6DA.locky","sha256":"b07412ce6f255c6255093397446f7f082c29c240f9661f4e014128e5b8a60a53","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"name":"32C0D883E1644D0A034B58C686B1EA28.locky","sha256":"1ac7f79aff06534ba5b4c8c16232f24e096c0c3ee42401b798a62373af6b73af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"name":"32C0D883E1644D0A28A4369477C54EBC.locky","sha256":"cbab38b4f7e95d701eb11b7320ae17c8a8a913aff7274f885c5ff0e46e363125","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"name":"32C0D883E1644D0A2CDA90B9A718368A.locky","sha256":"e6fd070da8bc2be85db06aeee94eabc67a78c6af425afe7ac3c77ff331d4e7f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"name":"32C0D883E1644D0A4A55AF68E5232EBB.locky","sha256":"63fa347b3b3ce0dbfd664f2c52d7153a1a9d4ebf01aee6d4fd01c0eec23141fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"name":"32C0D883E1644D0A8BF52EED1DE51D0B.locky","sha256":"6c790c0b84f3f1495fc1b52adba79b823fe6d286ce06bb3166ecbb13b8b1f8fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]}],"files_written":[{"path":"MountPointManager","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"%WINDIR%\\system32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"PIPE\\lsarpc","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"\\Device\\Afd\\AsyncConnectHlp","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"UNC\\%OSUSER%-PC\\PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"\\USLOFT4112\\IPC$","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"UNC\\USLOFT4072\\PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"UNC\\USLOFT4112\\PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"\\Device\\Csc\\.\\.","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"PIPE\\DAV RPC SERVICE","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"%WINDIR%\\system32\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"UNC\\USLOFT4112\\VxAnalysisData\\VM18\\_HELP_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"UNC\\USLOFT4112\\VxAnalysisData\\VM18\\analysis\\0\\_HELP_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"UNC\\USLOFT4112\\VxAnalysisData\\VM15\\analysis\\0\\_HELP_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"UNC\\USLOFT4112\\VxAnalysisData\\VM16\\analysis\\0\\_HELP_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"UNC\\USLOFT4112\\VxAnalysisData\\VM17\\analysis\\0\\_HELP_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"UNC\\USLOFT4112\\VxAnalysisData\\VM11\\_HELP_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"UNC\\USLOFT4112\\VxAnalysisData\\VM13\\analysis\\0\\_HELP_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"UNC\\USLOFT4112\\VxAnalysisData\\VM19\\_HELP_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"UNC\\USLOFT4112\\VxAnalysisData\\VM14\\_HELP_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"%USERPROFILE%\\Desktop\\_HELP_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"%USERPROFILE%\\Desktop\\_HELP_instructions.bmp","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"%WINDIR%\\system32\\NOTEPAD.EXE","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"%SAMPLEDIR%\\","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"%PROGRAMFILES%\\Windows Photo Viewer\\en-US\\PhotoViewer.dll.mui","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"%PROGRAMFILES%\\Windows Photo Viewer\\PhotoViewer.dll","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"%USERPROFILE%\\","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"path":"C:\\Users\\","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\MALWARE2_RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\SHELL EXTENSIONS\\CACHED\\","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"key":"HKCU\\SOFTWARE\\1BSSQX05U34CRZ0\\","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"name":"Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"56f3d356aac2ed151c0b443d"}]}]}},"report_ids":{"sandbox_job_ids":["56f3d356aac2ed151c0b443d","56f3d356aac2ed151c0b443f"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Trojan.Cryptolocky Sample bdcd2446361b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample bdcd2446361b…. Malware family: Trojan.Cryptolocky. Threat score 100/100. 24/29 AV engines flagged this file. 8 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/bdcd2446361be70ac12a6756029dee6dedbf0dfdd04f6ef9f97b578e9424c336"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Cryptolocky Sample bdcd2446361b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample bdcd2446361b…. Malware family: Trojan.Cryptolocky. Threat score 100/100. 24/29 AV engines flagged this file. 8 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/bdcd2446361be70ac12a6756029dee6dedbf0dfdd04f6ef9f97b578e9424c336"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Cryptolocky Sample bdcd2446361b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample bdcd2446361b…. Malware family: Trojan.Cryptolocky. Threat score 100/100. 24/29 AV engines flagged this file. 8 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L28","11",{}]]