23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T4d9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample bee14206aa3e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample bee14206aa3e…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 3/26 AV engines flagged this file. 9 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/bee14206aa3e443af592a6946671d191f878f2cb7ca04013704b8fd4014a4c3a","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","bee14206aa3e443af592a6946671d191f878f2cb7ca04013704b8fd4014a4c3a"],"about":{"@type":"SoftwareApplication","name":"5e9dd617618f153db503f965abeaf479.exe","applicationCategory":["peexe","executable"],"identifier":"bee14206aa3e443af592a6946671d191f878f2cb7ca04013704b8fd4014a4c3a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":3,"total":26},"behavioralIndicators":{"malicious":9,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T62a,"32C0D883E1644D0A7FF89F2D400B480E.locky.208828" has type "data" "_Locky_recover_instructions.txt.208843" has type "UTF-8 Unicode (with BOM) text, with CRLF line terminators" "32C0D883E1644D0A1FA8AD6517B22CAD.locky.208859" has type "XML document text" "32C0D883E1644D0A7C85FDBA71AB9BE2.locky.208906" has type "XML document text" "32C0D883E1644D0AA6D4C156AAF1E58A.locky.208953" has type "XML document text" "32C0D883E1644D0A2AF7827824E06628.locky.208984" has type "XML document text" "32C0D883E1644D0A915CDFAE0FA1C900.locky.209000" has type "XML document text" "32C0D883E1644D0AA1B677B5810B84FA.locky.209031" has type "XML document text" "32C0D883E1644D0A1FECF517F88C3CDC.locky.209078" has type "XML document text" "32C0D883E1644D0AE45DE98A888D5D1C.locky.209125" has type "XML document text" "32C0D883E1644D0AC6E48BD898A92D4A.locky.209171" has type "XML document text" "32C0D883E1644D0A7BB64EEE049D47F3.locky.209437" has type "XML document text" "32C0D883E1644D0AE65C45937C8D0B12.locky.209546" has type "XML document text" "32C0D883E1644D0A7C265C23D561D5C3.locky.209640" has type "XML document text" "32C0D883E1644D0AF6EFD32F4EC896A8.locky.209687" has type "XML document text" "32C0D883E1644D0A90D50FC299DC6A39.locky.209796" has type "XML document text" "32C0D883E1644D0A936BF44A61E3D83F.locky.210078" has type "XML document text" "32C0D883E1644D0A08A56E9687A39227.locky.210890" has type "XML document text" "32C0D883E1644D0A5EC0A159F5531732.locky.210984" has type "XML document text" "32C0D883E1644D0A15794591ED4CB82E.locky.211015" has type "XML document text"25:T423,"" created file "C:\Windows\" "" created file "C:\Windows\system32\rsaenh.dll" "" created file "C:\Windows\Globalization\Sorting\sortdefault.nls" "" created file "%APPDATA%\Microsoft\Windows\Cookies" "" created file "%APPDATA%\Microsoft\Windows\Cookies\index.dat" "" created file "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat" "" created file "C:\Windows\system32\vssadmin.exe" "" created file "C:\Windows\Fonts\staticcache.dat" "" created file "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\Caches" "" created file "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "" created file "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db" "" created file "C:\Windows\system32\NOTEPAD.EXE" "" created file "C:\Windows\system32\notepad.exe"26:T958,"" opened "c:\autoexec.bat" with delete access "" opened "c:\MSOCache\All Users\{90120000-0015-0407-0000-0000000FF1CE}-C\AccessMUI.xml" with delete access "" opened "c:\MSOCache\All Users\{90120000-0015-0407-0000-0000000FF1CE}-C\Setup.xml" with delete access "" opened "c:\MSOCache\All Users\{90120000-0016-0407-0000-0000000FF1CE}-C\ExcelMUI.xml" with delete access "" opened "c:\MSOCache\All Users\{90120000-0016-0407-0000-0000000FF1CE}-C\Setup.xml" with delete access "" opened "c:\MSOCache\All Users\{90120000-0018-0407-0000-0000000FF1CE}-C\PowerPointMUI.xml" with delete access "" opened "c:\MSOCache\All Users\{90120000-0018-0407-0000-0000000FF1CE}-C\Setup.xml" with delete access "" opened "c:\MSOCache\All Users\{90120000-0019-0407-0000-0000000FF1CE}-C\PublisherMUI.xml" with delete access "" opened "c:\MSOCache\All Users\{90120000-0019-0407-0000-0000000FF1CE}-C\Setup.xml" with delete access "" opened "c:\MSOCache\All Users\{90120000-001A-0407-0000-0000000FF1CE}-C\OutlookMUI.xml" with delete access "" opened "c:\MSOCache\All Users\{90120000-001A-0407-0000-0000000FF1CE}-C\Setup.xml" with delete access "" opened "c:\MSOCache\All Users\{90120000-001B-0407-0000-0000000FF1CE}-C\Setup.xml" with delete access "" opened "c:\MSOCache\All Users\{90120000-001B-0407-0000-0000000FF1CE}-C\WordMUI.xml" with delete access "" opened "c:\MSOCache\All Users\{90120000-002C-0407-0000-0000000FF1CE}-C\Proof.de\Proof.xml" with delete access "" opened "c:\MSOCache\All Users\{90120000-002C-0407-0000-0000000FF1CE}-C\Proof.en\Proof.xml" with delete access "" opened "c:\MSOCache\All Users\{90120000-002C-0407-0000-0000000FF1CE}-C\Proof.fr\Proof.xml" with delete access "" opened "c:\MSOCache\All Users\{90120000-002C-0407-0000-0000000FF1CE}-C\Proof.it\Proof.xml" with delete access "" opened "c:\MSOCache\All Users\{90120000-002C-0407-0000-0000000FF1CE}-C\Proofing.xml" with delete access "" opened "c:\MSOCache\All Users\{90120000-002C-0407-0000-0000000FF1CE}-C\Setup.xml" with delete access "" opened "c:\MSOCache\All Users\{90120000-006E-0407-0000-0000000FF1CE}-C\branding.xml" with delete access27:T986,Found dropped filename "32C0D883E1644D0A7FF89F2D400B480E.locky.208828" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A1FA8AD6517B22CAD.locky.208859" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A7C85FDBA71AB9BE2.locky.208906" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0AA6D4C156AAF1E58A.locky.208953" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A2AF7827824E06628.locky.208984" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A915CDFAE0FA1C900.locky.209000" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0AA1B677B5810B84FA.locky.209031" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A1FECF517F88C3CDC.locky.209078" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0AE45DE98A888D5D1C.locky.209125" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0AC6E48BD898A92D4A.locky.209171" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A7BB64EEE049D47F3.locky.209437" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0AE65C45937C8D0B12.locky.209546" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A7C265C23D561D5C3.locky.209640" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0AF6EFD32F4EC896A8.locky.209687" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A90D50FC299DC6A39.locky.209796" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A936BF44A61E3D83F.locky.210078" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A08A56E9687A39227.locky.210890" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A5EC0A159F5531732.locky.210984" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0A15794591ED4CB82E.locky.211015" which has been seen in the context of ransomware Found dropped filename "32C0D883E1644D0AA167851206882BA5.locky.211078" which has been seen in the context of ransomware28:T608,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAQaSURBVFhH7VdLV1NXGPV/OadWWxV5KPiMaItdC5eCCBR0QULegRgDWCQYwiMEQkBqayu1U1uIHTjSkc7oBEhyc1954O537s3jAjdN0C6YNGvtdZJzc8+3v/09zjlHjvz/OWwFrE43+vptB4p+iwPktwqLzYF379fx5u0Hwvv/FN92epT1do/M4QIBq30Qf6xGPwura6+xFv0La69VrNL3P2mOQW/tHQRMZgeSgoR0SkZKlj4B6nuyDnavx2yIqYwS7oICJrNdmTxI7CGQyWYVAisrr/Dy9zcVYeW3V8hm0gqi0agu8gocvTEBBvZbV4FsjgAzXtOzgNp7YdT1zqPeOIez5hDOWUNodAbRODCDC54pXPROKiT/Xl9HShLKhm1fBK7YlmFwPIXBuYSmwUVc80Rw3buAb0bm0Tw6hxu+EL7zz2oI8J+nAIvHtkaBFu/PaBn+CTcfPcOtxwTfMlr9T9EWWMKd6UW0ByPomAsXCKQlPpeEojpK6qgFU6DKNKwfAkaAF9XYMFk7xl+gy/8rugK/oHv6OW6T8Zv+MJrHg7g65ofBN46mCV+RgCiUVYAZP/3IWZoAx4sFAsbgS9yfeYGmoRBO2sbwhWUIXzoe4sSAB189cOOkdwCnR5waAjkFyHOlFNm4SwVmvHGmtzICrU9+xAnzKKr6h3HM5sVxJxkffICvHw7i1LBL8eTMY7uGQLKsAsx48/OW0gSSGgWqjCOq13YyXvCajI+4UP2DA2fGbKh9YtmRA7IsQ6JQlGpkzPi/ExCKIThmzUnOvPaQ5EMkOXldPWpHjc+KOr8ZZwOmYhWI5augAgLFJDzuoli7NZIzr0ny2nEr6if6cW7SiAaStNAHBH5fbXxPI2JVwPaCfBVoE6161IEakryOJK8PkPGpPkqm+7gQ6tlXH9CGpiwBbaLV5iWfNKFhuhfng/dwca4bl8OdOwikchVQyWZWloA20RTJp4yq17M9uDT/PS4vdMKw2F4gIFEOsATUa0BsTqRnHMchHo8jEY/t3Qt2h0CbaA3TfeQ1k7wbl8JduBLpwNWldjQttxUIyGLpMpQlCi0RTCTiiMViiMe2ShDQdEJtop2fZZKT1yS5IXKXjN/BteVWXH92S0OA0/U+35YFSlLm+ebmJra2NvUJCKJ6UJicWqxoK2YVMBGIKLuhRAZKbccCzyPJJcjwlkqAoJsDiaRaBWxvZ4vuB0KyqACLOcsHnk+Co3kWd+b1xsaGgpIEYpwEdibAdgppmQeQBrI0lxKQIWBbprmPhG0C/Y89RwofM2qS5fu/JIrgSZEkGefI8zjFnsU/D6aGrgKMwKEdydgZvafP/Mn3AhO9b7G7YHe5YXW4YbY6YSxzz7jddrd4KC2cTvMXhYMfczeUgzecV+GwL4eHbP8fuv0VoZ+XlYMAAAAASUVORK5CYII=1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"bee14206aa3e443af592a6946671d191f878f2cb7ca04013704b8fd4014a4c3a","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790443920355,"unified_at":"2026-09-26T17:32:00.355Z","metadata":{"hashes":{"sha256":"bee14206aa3e443af592a6946671d191f878f2cb7ca04013704b8fd4014a4c3a","sha1":"ced2758106f2f7157afad7cf4c61586dc60de694","md5":"5e9dd617618f153db503f965abeaf479","sha512":"6c74ad726989989647f5e760a8bd4f08e789511a77262bc9cd9967d1e58cf1905288b5d7fa7453a875cc333f6bc57656b74c053549484bf205957d260c434ce3","ssdeep":"3072:6WbfTQGd4sZKb3o7tVlfrnrUB/9x4x/UyyHNMdlPXs:9bfTQGdd8o7t3zmv4VPPXs","ssdeep_chunks":["3072:6WbfTQG","3072:WbfTQGd","3072:bfTQGd4","3072:fTQGd4s","3072:TQGd4sZ","3072:QGd4sZK","3072:Gd4sZKb","3072:d4sZKb3","3072:4sZKb3o","3072:sZKb3o7","3072:ZKb3o7t","3072:Kb3o7tV","3072:b3o7tVl","3072:3o7tVlf","3072:o7tVlfr","3072:7tVlfrn","3072:tVlfrnr","3072:VlfrnrU","3072:lfrnrUB","3072:frnrUB/","3072:rnrUB/9","3072:nrUB/9x","3072:rUB/9x4","3072:UB/9x4x","3072:B/9x4x/","3072:/9x4x/U","3072:9x4x/Uy","3072:x4x/Uyy","3072:4x/UyyH","3072:x/UyyHN","3072:/UyyHNM","3072:UyyHNMd","3072:yyHNMdl","3072:yHNMdlP","3072:HNMdlPX","3072:NMdlPXs","6144:6WbfTQG","6144:WbfTQGd","6144:bfTQGd4","6144:fTQGd4s","6144:TQGd4sZ","6144:QGd4sZK","6144:Gd4sZKb","6144:d4sZKb3","6144:4sZKb3o","6144:sZKb3o7","6144:ZKb3o7t","6144:Kb3o7tV","6144:b3o7tVl","6144:3o7tVlf","6144:o7tVlfr","6144:7tVlfrn","6144:tVlfrnr","6144:VlfrnrU","6144:lfrnrUB","6144:frnrUB/","6144:rnrUB/9","6144:nrUB/9x","6144:rUB/9x4","6144:UB/9x4x","6144:B/9x4x/","6144:/9x4x/U","6144:9x4x/Uy","6144:x4x/Uyy","6144:4x/UyyH","6144:x/UyyHN","6144:/UyyHNM","6144:UyyHNMd","6144:yyHNMdl","6144:yHNMdlP","6144:HNMdlPX","6144:NMdlPXs","3072:9bfTQGd","3072:bfTQGdd","3072:fTQGdd8","3072:TQGdd8o","3072:QGdd8o7","3072:Gdd8o7t","3072:dd8o7t3","3072:d8o7t3z","3072:8o7t3zm","3072:o7t3zmv","3072:7t3zmv4","3072:t3zmv4V","3072:3zmv4VP","3072:zmv4VPP","3072:mv4VPPX","3072:v4VPPXs"],"imphash":"04e125f973d491da230ac9ac1efd33dd"},"file_info":{"file_name":"5e9dd617618f153db503f965abeaf479.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":163840,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499295771000,"last_seen":1713413201000,"last_multi_scan":1713413201000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":3,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":11,"suspicious_count":23,"malicious_count":9,"total":43},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bkavpro":{"name":"Bkav Pro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Filecoder.Locky.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004dea2e1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/43 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"91.234.32.192:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\_!MSFTHISTORY!_\"\n \"Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!\"\n \"Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!\"\n \"Local\\WininetStartupMutex\"\n \"Local\\WininetConnectionMutex\"\n \"Local\\WininetProxyRegistryMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"\" loaded module \"NETAPI32.DLL\" at base 743F0000\n \"\" loaded module \"CRYPTSP.DLL\" at base 75740000\n \"\" loaded module \"%WINDIR%\\SYSTEM32\\RSAENH.DLL\" at base 754E0000\n \"\" loaded module \"ADVAPI32.DLL\" at base 77700000\n \"\" loaded module \"CRYPTBASE.DLL\" at base 75C10000\n \"\" loaded module \"%WINDIR%\\SYSTEM32\\UXTHEME.DLL\" at base 74A30000\n \"\" loaded module \"COMCTL32.DLL\" at base 74B90000\n \"\" loaded module \"KERNEL32.DLL\" at base 76E10000\n \"\" loaded module \"SHELL32.DLL\" at base 761C0000\n \"\" loaded module \"OLE32.DLL\" at base 77A10000\n \"\" loaded module \"API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL\" at base 77CB0000\n \"\" loaded module \"PROFAPI.DLL\" at base 75CC0000\n \"\" loaded module \"NTMARTA.DLL\" at base 75250000\n \"\" loaded module \"WININET.DLL\" at base 76090000\n \"\" loaded module \"RASAPI32.DLL\" at base 736D0000","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"DsRoleGetPrimaryDomainInformation@NETAPI32.dll\"\n \"DsRoleFreeMemory@NETAPI32.dll\"\n \"RtlZeroMemory@ntdll.dll\"\n \"RtlExitUserThread@ntdll.dll\"\n \"CryptAcquireContextA@CRYPTSP.dll\"\n \"CPAcquireContext@rsaenh.dll\"\n \"CPReleaseContext@rsaenh.dll\"\n \"CPGenKey@rsaenh.dll\"\n \"CPDeriveKey@rsaenh.dll\"\n \"CPDestroyKey@rsaenh.dll\"\n \"CPSetKeyParam@rsaenh.dll\"\n \"CPGetKeyParam@rsaenh.dll\"\n \"CPExportKey@rsaenh.dll\"\n \"CPImportKey@rsaenh.dll\"\n \"CPEncrypt@rsaenh.dll\"\n \"CPDecrypt@rsaenh.dll\"\n \"CPCreateHash@rsaenh.dll\"\n \"CPHashData@rsaenh.dll\"\n \"CPHashSessionKey@rsaenh.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/C del /Q /F \"%TEMP%\\sysB3D0.tmp\"\" on 2016-03-11.10:56:02","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"NOTEPAD.EXE\" with commandline \"%USERPROFILE%\\Desktop\\_Locky_recover_instructions.txt\" (UID: 00240093-00001768)\n Spawned process \"cmd.exe\" with commandline \"/C del /Q /F \"%TEMP%\\sysB3D0.tmp\"\" (UID: 00242687-00001716)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"LookupAccountNameLocalW@SECHOST.DLL at 00176750-00002968-77BD228D-207324","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$24","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"MV`yXi|.Id\"\n Pattern match: \"http://en.wikipedia.org/wiki/RSA_(cryptosystem)\"\n Pattern match: \"http://en.wikipedia.org/wiki/Advanced_Encryption_Standard\"\n Pattern match: \"http://i3ezlvkoi7fwyood.tor2web.org/32C0D883E1644D0A\"\n Pattern match: \"http://i3ezlvkoi7fwyood.onion.to/32C0D883E1644D0A\"\n Pattern match: \"http://i3ezlvkoi7fwyood.onion.cab/32C0D883E1644D0A\"\n Pattern match: \"https://www.torproject.org/download/download-easy.html\"\n Pattern match: \"c.vnWK/s:VL?#].m\"\n Pattern match: \"00d.0ni0n.cab/32cODBB3E1644DOA\"\n Pattern match: \"https://www.torproje_.or9/download/download-easy.html\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Contains ability to open a service","description":"OpenServiceA@SECHOST.DLL at 00176750-00002968-77BD228D-205932\n OpenServiceW@SECHOST.DLL at 00176750-00002968-77BD228D-207504","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-14","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00176750-00002968-77BB61F8-204479","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text with unusual entropies 7.2567492797","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.dll at 32719-43-00403C35\n GetVersionExW@KERNEL32.dll at 32719-82-00403A5F\n RasRpcGetVersion@RASMAN.DLL at 00176750-00002968-77BD228D-205813","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FreeResource@KERNEL32.dll at 32719-43-00403C35","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"\"POST /main.php HTTP/1.1\nHost: 91.234.32.192\nContent-Length: 101\nConnection: Keep-Alive\nCache-Control: no-cache\" with no payload\n \"POST /main.php HTTP/1.1\nHost: 91.234.32.192\nContent-Length: 55\nConnection: Keep-Alive\nCache-Control: no-cache\" with no payload\n \"POST /main.php HTTP/1.1\nHost: 91.234.32.192\nContent-Length: 93\nConnection: Keep-Alive\nCache-Control: no-cache\" with no payload","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"$25","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"listen@??? at 00176750-00002968-77BD228D-205291\n RasPortListen@RASMAN.DLL at 00176750-00002968-77BD228D-205697","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"91.234.32.192\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"suspicious","category":"Pattern Matching","name":"Code classification distribution is known to appear in malware","description":"TrID distribution is very similar to the \"CTB-Locker\" family (e.g. SHA256: cbba56bd16222191f1468a1d93b63945394371cfb9ffe38f34a9575c5655e57a)","origin":"TrID Evaluation","relevance":5,"id":"trid-0","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Changes the desktop background picture","description":"\"\" (Access type: \"SETVAL\", Path: \"HKCU\\CONTROL PANEL\\DESKTOP\", Key: \"WALLPAPERSTYLE\", Value: \"30000000\")\n \"\" (Access type: \"SETVAL\", Path: \"HKCU\\CONTROL PANEL\\DESKTOP\", Key: \"TILEWALLPAPER\", Value: \"30000000\")","origin":"Registry Access","relevance":10,"id":"registry-22","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"\" !!! IMPORTANT INFORMATION !!!!\n\nAll of your files are encrypted with RSA-2048 and AES-128 ciphers.\nMore information about the RSA and AES can be found here:\n http://en.wikipedia.org/wiki/RSA_(cryptosystem)\n http://en.wikipedia.org/w\" (Source: 00176750-00002968-77BB6A68-209359, Indicator: \"files are encrypted\")\n \"All of your files are encrypted with RSA-2048 and AES-128 ciphers.\" (Source: _Locky_recover_instructions.txt, Indicator: \"files are encrypted\")\n \"Decrypting of your files is only possible with the private key and decrypt program, which is on our secret server.\" (Source: _Locky_recover_instructions.txt, Indicator: \"private key and decrypt program\")","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve keyboard strokes","description":"GetKeyboardState@USER32.dll at 32719-43-00403C35\n GetKeyboardState@USER32.dll at 32719-82-00403A5F","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-12","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$26","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to elevate privileges","description":"SetEntriesInAclW@ADVAPI32.DLL at 00176750-00002968-77BD228D-239305\n SetSecurityDescriptorDacl@ADVAPI32.DLL at 00176750-00002968-77BD228D-239309","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-44","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"SETVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYENABLE\", Value: \"00000000\")\n \"\" (Access type: \"DELETEVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYSERVER\")\n \"\" (Access type: \"DELETEVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYOVERRIDE\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"suspicious","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"suspicious","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"NOTEPAD.EXE\" (Access type: \"QUERYVAL\", Path: \"HKCR\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.TXT\", Key: \"ALWAYSSHOWEXT\")\n \"NOTEPAD.EXE\" (Access type: \"QUERYVAL\", Path: \"HKCR\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\TEXT\", Key: \"ALWAYSSHOWEXT\")\n \"NOTEPAD.EXE\" (Access type: \"QUERYVAL\", Path: \"HKCR\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.TXT\", Key: \"NEVERSHOWEXT\")\n \"NOTEPAD.EXE\" (Access type: \"QUERYVAL\", Path: \"HKCR\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\TEXT\", Key: \"NEVERSHOWEXT\")","origin":"Registry Access","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"SetKeyboardState\n FindWindowA\n FindWindowExW\n GetVersionExW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"NOTEPAD.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\", Key: \"00000409\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\", Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":5,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"5/56 Antivirus vendors marked sample as malicious (8% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated 00000088 bytes of memory in \"vssadmin.exe\" (Protection: \"read/write\")\n \"\" allocated 00000088 bytes of memory in \"notepad.exe\" (Protection: \"read/write\")\n \"\" allocated 00000088 bytes of memory in \"cmd.exe\" (Protection: \"read/write\")","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a foreign process \"vssadmin.exe\" (PID: 00003028)\n \"\" wrote 52 bytes to a foreign process \"vssadmin.exe\" (PID: 00003028)\n \"\" wrote 4 bytes to a foreign process \"vssadmin.exe\" (PID: 00003028)\n \"\" wrote 32 bytes to a foreign process \"notepad.exe\" (PID: 00001768)\n \"\" wrote 52 bytes to a foreign process \"notepad.exe\" (PID: 00001768)\n \"\" wrote 4 bytes to a foreign process \"notepad.exe\" (PID: 00001768)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by Ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00207687-00003028)","origin":"Monitored Target","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Detected text artifact in screenshot that indicate file is ransomware","description":"\"decrypT\" (Source: screen_11.png, Indicator: \"decrypt\")\n \"DecrypTin9\" (Source: screen_11.png, Indicator: \"decrypt\")\n \"(crypT0sysTem7\" (Source: screen_11.png, Indicator: \"crypt0\")\n \".tor2web.or9/32COD883E\" (Source: screen_6.png, Indicator: \"tor2web\")\n \"i3ezlvkoi7myood.onion/32COD883E1644DOA\" (Source: screen_6.png, Indicator: \"onion\")","origin":"File/Memory","relevance":8,"id":"string-12","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"malicious","category":"Ransomware/Banking","name":"The input sample dropped a known ransomware file","description":"$27","origin":"Binary File","relevance":5,"id":"binary-9","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\" (Type: \"FileHandle\", Context: \"NtSetInformationFile\")","origin":"Touched Handle","relevance":5,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtSetSystemInformation@NTDLL.DLL at 00176750-00002968-77BD228D-238847","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"name":"Spyware/Leak","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"name":"Ransomware","details_count":2,"details":[{"detail":"The input sample dropped a known ransomware file"},{"detail":"Deletes volume snapshots (often used by Ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":7,"imported_dlls_count":67,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":151,"files_deleted_count":0,"registry_keys_created_count":9,"registry_keys_modified_count":0,"registry_keys_deleted_count":3,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":12,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"56e31387aac2edc41a9a2760","environment_id":1,"environment_description":"Windows 7 32 bit - Usermode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"HW32.Packed","contacted_countries":["UKR"],"submit_name":"5e9dd617618f153db503f965abeaf479.exe","analysis_start_time":"2016-03-11T12:51:22+00:00","indicators_count":{"informative":11,"suspicious":26,"malicious":10},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"91.234.32.192","port":80,"protocol":"TCP","country":"Ukraine","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]}],"dns_resolutions":null,"http_requests":[{"host":"91.234.32.192","host_ip":"91.234.32.192:80","url":"/main.php","method":"POST","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}],"processes":[{"pid":2968,"ppid":0,"name":"5e9dd617618f153db503f965abeaf479.exe","command_line":"","normalized_path":"","uid":"00176750-00002968","icon":"$28"},{"pid":3028,"ppid":0,"name":"vssadmin.exe","command_line":"Delete Shadows /All /Quiet","normalized_path":"","uid":"00207687-00003028"},{"pid":1768,"ppid":0,"name":"NOTEPAD.EXE","command_line":"%USERPROFILE%\\Desktop\\_Locky_recover_instructions.txt","normalized_path":"","uid":"00240093-00001768"},{"pid":1716,"ppid":0,"name":"cmd.exe","command_line":"/C del /Q /F \"%TEMP%\\sysB3D0.tmp\"","normalized_path":"","uid":"00242687-00001716"}],"all_imported_dlls":["GDI32.dll","apphelp.dll","comctl32.dll","rasman.dll","mswsock.dll","wshtcpip.DLL","NLAapi.dll","rasadhlp.dll","LPK.dll","USP10.dll","rtutils.dll","SHLWAPI.dll","msvcrt.dll","COMDLG32.dll","RPCRT4.dll","CFGMGR32.dll","browcli.dll","NETAPI32.dll","CRYPTBASE.dll","ntdll.dll","IMM32.DLL","VSSAPI.DLL","CRYPTSP.dll","iphlpapi.DLL","IconCodecService.dll","CLBCatQ.DLL","WINBRAND.dll","MSCTF.dll","OLEAUT32.dll","PhotoViewer.dll","kernel32.dll","SETUPAPI.dll","vss_ps.dll","dwmapi.dll","WININET.dll","ole32.dll","sensapi.dll","drprov.dll","cscapi.dll","sechost.dll","WindowsCodecs.dll","PROPSYS.dll","wkscli.dll","MPR.dll","KERNELBASE.dll","ADVAPI32.dll","DEVOBJ.dll","COMCTL32.dll","MSVCRT.dll","netutils.dll","PSAPI.DLL","rsaenh.dll","VERSION.dll","USER32.dll","ieproxy.dll","VssTrace.DLL","profapi.dll","ntmarta.dll","ntlanman.dll","SHELL32.dll","uxtheme.dll","SspiCli.dll","RASAPI32.dll","wshqos.dll","ATL.DLL","davclnt.dll","RpcRtRemote.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"MountPointManager","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%WINDIR%\\system32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"PIPE\\lsarpc","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"\\Device\\Afd\\AsyncConnectHlp","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"PIPE\\DAV RPC SERVICE","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%WINDIR%\\system32\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"C:\\32C0D883E1644D0A7FF89F2D400B480E.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"C:\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"c:\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-0015-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0A1FA8AD6517B22CAD.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-0015-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0A7C85FDBA71AB9BE2.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"c:\\MSOCache\\All Users\\{90120000-0015-0407-0000-0000000FF1CE}-C\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-0016-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0AA6D4C156AAF1E58A.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"c:\\MSOCache\\All Users\\{90120000-0016-0407-0000-0000000FF1CE}-C\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-0016-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0A2AF7827824E06628.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-0018-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0A915CDFAE0FA1C900.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-0018-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0AA1B677B5810B84FA.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"c:\\MSOCache\\All Users\\{90120000-0018-0407-0000-0000000FF1CE}-C\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-0019-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0A1FECF517F88C3CDC.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-0019-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0AE45DE98A888D5D1C.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"c:\\MSOCache\\All Users\\{90120000-0019-0407-0000-0000000FF1CE}-C\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-001A-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0AC6E48BD898A92D4A.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"c:\\MSOCache\\All Users\\{90120000-001A-0407-0000-0000000FF1CE}-C\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-001A-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0A7BB64EEE049D47F3.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-001B-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0AE65C45937C8D0B12.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"c:\\MSOCache\\All Users\\{90120000-001B-0407-0000-0000000FF1CE}-C\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-001B-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0A7C265C23D561D5C3.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-002C-0407-0000-0000000FF1CE}-C\\Proof.de\\32C0D883E1644D0AF6EFD32F4EC896A8.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"c:\\MSOCache\\All Users\\{90120000-002C-0407-0000-0000000FF1CE}-C\\Proof.de\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-002C-0407-0000-0000000FF1CE}-C\\Proof.en\\32C0D883E1644D0A90D50FC299DC6A39.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"c:\\MSOCache\\All Users\\{90120000-002C-0407-0000-0000000FF1CE}-C\\Proof.en\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-002C-0407-0000-0000000FF1CE}-C\\Proof.fr\\32C0D883E1644D0A936BF44A61E3D83F.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"c:\\MSOCache\\All Users\\{90120000-002C-0407-0000-0000000FF1CE}-C\\Proof.fr\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-002C-0407-0000-0000000FF1CE}-C\\Proof.it\\32C0D883E1644D0A08A56E9687A39227.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"c:\\MSOCache\\All Users\\{90120000-002C-0407-0000-0000000FF1CE}-C\\Proof.it\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-002C-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0A5EC0A159F5531732.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"c:\\MSOCache\\All Users\\{90120000-002C-0407-0000-0000000FF1CE}-C\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-002C-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0A15794591ED4CB82E.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-006E-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0AA167851206882BA5.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"c:\\MSOCache\\All Users\\{90120000-006E-0407-0000-0000000FF1CE}-C\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-006E-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0AD0DEF4C85676A871.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"C:\\MSOCache\\All Users\\{90120000-006E-0407-0000-0000000FF1CE}-C\\32C0D883E1644D0A6896A9F4A890693B.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"C:\\MSOCache\\All Users\\{91120000-0031-0000-0000-0000000FF1CE}-C\\32C0D883E1644D0A50E1517DE5920414.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"c:\\MSOCache\\All Users\\{91120000-0031-0000-0000-0000000FF1CE}-C\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"C:\\MSOCache\\All Users\\{91120000-0031-0000-0000-0000000FF1CE}-C\\32C0D883E1644D0AD7C3C07460D3424C.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"C:\\MSOCache\\All Users\\{91120000-0031-0000-0000-0000000FF1CE}-C\\32C0D883E1644D0A4DC9F9C5C1FBD4F4.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\32C0D883E1644D0AFAAAD6590B0D2566.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\32C0D883E1644D0A64F202699C0E2EBC.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\32C0D883E1644D0AE086442FBC4CF5BE.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\32C0D883E1644D0A60122B7486BC2983.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\32C0D883E1644D0AD040683A3F9D6FC0.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\32C0D883E1644D0A6F61B73F3D21D592.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\32C0D883E1644D0AED9BAF7203CCA792.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Sun\\Java\\Java Update\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows NT\\MSScan\\32C0D883E1644D0A7D0FA67FF653D839.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows NT\\MSScan\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\32C0D883E1644D0A61E30337E1443FBE.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\32C0D883E1644D0A9FCF84A67CFB2F82.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\32C0D883E1644D0A01631FBAEE9CBD24.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\32C0D883E1644D0A750D5A9527794209.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\32C0D883E1644D0A5F2F31C2265DC848.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\32C0D883E1644D0A46143BCFC185BB0C.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\32C0D883E1644D0A8BCAA52F81151380.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\32C0D883E1644D0A8AF77DB02A190A31.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\32C0D883E1644D0AA53E98C11F56CB63.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A33C6E5225E4DA76E.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A64D74DC1A4AEDD36.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A7C79A909DD8AADE8.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A500E58D5EA4261E6.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A0F57EBA78D496FD4.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0AACEF19ADF58B0618.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A8876B83F2BD4EAA4.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0AB2BD0A71FADA8465.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A32AF992D0EF5DDB2.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A9AC2332507CBE1A5.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A0441F4ED3D2B8C48.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0AD29F311E2435B189.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0AD72827774E0C54B3.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A95434F542B92E74F.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A287ECB8D07120509.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A311671284C3983DE.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0ADF5A394DBE490B74.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A98ADF70FFEB33C56.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A4B9C6948AD4DA2E3.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A474CA7C0790BBF19.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A44FA2ECE84DC6BBC.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A4839E6B45817C5B6.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0AE9AAA47BDDC261EF.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A824DD15F1894C815.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0AD84E5CBAA048ABD8.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0AA064564FDD9A0579.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A07B1D11D5CC16DE6.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0AB6AD0DB57BC55B10.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A7BA44443A064E698.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0AFBD10DCC00652DB1.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A416D13B3B96132DD.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\32C0D883E1644D0ACB4F6FD7BD48E1C9.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\32C0D883E1644D0A3C426D374936590F.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\32C0D883E1644D0ACE53B0D385F889E8.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\32C0D883E1644D0AA8F1CD4C5D1AA7F6.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\32C0D883E1644D0A0CF032C38B71AF7E.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\32C0D883E1644D0AE09B809828036591.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\32C0D883E1644D0A2EEFAEE76ABDCD1D.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\32C0D883E1644D0AA18D21D3A13FE203.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A5E6B5071E2DDBAB4.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A8B02C29B5FC6C010.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A4A5620D75A852DD5.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\User Account Pictures\\Default Pictures\\32C0D883E1644D0A6CB81BAA114FDB41.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\OFFICE\\DATA\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\32C0D883E1644D0AE4D81982433C2256.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\32C0D883E1644D0A3FB6533CF4DB1028.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\32C0D883E1644D0AC96A8B5D5EEA2F79.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%PUBLIC%\\Videos\\Sample Videos\\32C0D883E1644D0A76BFF55642B94434.locky","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%PUBLIC%\\Videos\\Sample Videos\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%USERPROFILE%\\Desktop\\_Locky_recover_instructions.txt","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%USERPROFILE%\\Desktop\\_Locky_recover_instructions.bmp","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%WINDIR%\\system32\\NOTEPAD.EXE","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%SAMPLEDIR%\\","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%WINDIR%\\system32\\notepad.exe","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%PROGRAMFILES%\\Windows Photo Viewer\\en-US\\PhotoViewer.dll.mui","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"%PROGRAMFILES%\\Windows Photo Viewer\\PhotoViewer.dll","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"path":"C:\\Users\\","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\5E9DD617618F153DB503F965ABEAF479_RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"key":"HKCU\\SOFTWARE\\LOCKY\\","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\5E9DD617618F153DB503F965ABEAF479_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\LOCATION AWARENESS\\","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\SESSION MANAGER\\","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\SHELL EXTENSIONS\\CACHED\\","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]}]},"mutex_activity":{"mutex_created":[{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"name":"Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"56e31387aac2edc41a9a2760"}]}]}},"report_ids":{"sandbox_job_ids":["56e31387aac2edc41a9a2760"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample bee14206aa3e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample bee14206aa3e…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 3/26 AV engines flagged this file. 9 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/bee14206aa3e443af592a6946671d191f878f2cb7ca04013704b8fd4014a4c3a"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample bee14206aa3e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample bee14206aa3e…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 3/26 AV engines flagged this file. 9 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/bee14206aa3e443af592a6946671d191f878f2cb7ca04013704b8fd4014a4c3a"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample bee14206aa3e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample bee14206aa3e…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 3/26 AV engines flagged this file. 9 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]