26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T4b6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Ransom.Crysis Sample c2ab289cbd25… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c2ab289cbd25…. Malware family: Trojan.Ransom.Crysis. Threat score 100/100. 25/28 AV engines flagged this file. 5 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c2ab289cbd2573572c39cac3f234d77fdf769e48a1715a14feddaea8ae9d9702","keywords":["Malicious","Trojan.Ransom.Crysis","malware analysis","sandbox report","threat intelligence","c2ab289cbd2573572c39cac3f234d77fdf769e48a1715a14feddaea8ae9d9702"],"about":{"@type":"SoftwareApplication","name":"Sample_5b6d3c47b8ebb50a6130794d.bin","applicationCategory":["peexe","executable"],"identifier":"c2ab289cbd2573572c39cac3f234d77fdf769e48a1715a14feddaea8ae9d9702","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Ransom.Crysis","antivirusDetections":{"malicious":25,"total":28},"behavioralIndicators":{"malicious":5,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T56b,".exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" ".exe" touched file "C:\Windows\System32\c2ab289cbd2573572c39cac3f234d77fdf769e48a1715a14feddaea8ae9d9702.exe" ".exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c2ab289cbd2573572c39cac3f234d77fdf769e48a1715a14feddaea8ae9d9702.exe" ".exe" touched file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\c2ab289cbd2573572c39cac3f234d77fdf769e48a1715a14feddaea8ae9d9702.exe" ".exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\c2ab289cbd2573572c39cac3f234d77fdf769e48a1715a14feddaea8ae9d9702.exe" ".exe" touched file "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\c2ab289cbd2573572c39cac3f234d77fdf769e48a1715a14feddaea8ae9d9702.exe" "cmd.exe" touched file "C:\Windows\Branding\Basebrd\basebrd.dll" "cmd.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "cmd.exe" touched file "C:\Windows\AppPatch\AppPatch64\sysmain.sdb" "mode.com" touched file "C:\Windows\System32\en-US\ulib.dll.mui" "vssadmin.exe" touched file "C:\Windows\System32\en-US\vssadmin.exe.mui" "vssadmin.exe" touched file "C:\Windows\System32\rsaenh.dll" "vssadmin.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls"28:T6ab,"_Date_Time_DOSDateTimeToFileTime.au3.id-C1EE6045.[paymentbtc@firemail.cc].cmb" has type "data" "_WinAPI_FlashWindowEx.au3.id-C1EE6045.[paymentbtc@firemail.cc].cmb" has type "data" "_GUICtrlRichEdit_GetFirstCharPosOnLine.au3.id-C1EE6045.[paymentbtc@firemail.cc].cmb" has type "data" "DEXShare.spi.id-C1EE6045.[paymentbtc@firemail.cc].cmb" has type "data" "BD21325_.GIF.id-C1EE6045.[paymentbtc@firemail.cc].cmb" has type "data" "_GUICtrlListView_GetItemRect.au3.id-C1EE6045.[paymentbtc@firemail.cc].cmb" has type "data" "BD21301_.GIF.id-C1EE6045.[paymentbtc@firemail.cc].cmb" has type "data" "BD14870_.GIF.id-C1EE6045.[paymentbtc@firemail.cc].cmb" has type "data" "AN01216_.WMF.id-C1EE6045.[paymentbtc@firemail.cc].cmb" has type "data" "_GUICtrlComboBox_GetDroppedControlRectEx.au3.id-C1EE6045.[paymentbtc@firemail.cc].cmb" has type "data" "_Excel_RangeRead.au3.id-C1EE6045.[paymentbtc@firemail.cc].cmb" has type "data" "BD14531_.GIF.id-C1EE6045.[paymentbtc@firemail.cc].cmb" has type "data" "BD21323_.GIF.id-C1EE6045.[paymentbtc@firemail.cc].cmb" has type "data" "_GUICtrlToolbar_HideButton.au3.id-C1EE6045.[paymentbtc@firemail.cc].cmb" has type "data" "FD00543_.WMF.id-C1EE6045.[paymentbtc@firemail.cc].cmb" has type "data" "_GUICtrlListView_GetItemStateImage.au3.id-C1EE6045.[paymentbtc@firemail.cc].cmb" has type "data" "_GUICtrlRichEdit_HideSelection.au3.id-C1EE6045.[paymentbtc@firemail.cc].cmb" has type "data" "_GUICtrlRichEdit_GetSel.au3.id-C1EE6045.[paymentbtc@firemail.cc].cmb" has type "data" "_GUICtrlListView_EnsureVisible.au3.id-C1EE6045.[paymentbtc@firemail.cc].cmb" has type "data" "_WinAPI_GetFontResourceInfo.au3.id-C1EE6045.[paymentbtc@firemail.cc].cmb" has type "data"29:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"c2ab289cbd2573572c39cac3f234d77fdf769e48a1715a14feddaea8ae9d9702","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790727745613,"unified_at":"2026-09-30T00:22:25.613Z","metadata":{"hashes":{"sha256":"c2ab289cbd2573572c39cac3f234d77fdf769e48a1715a14feddaea8ae9d9702","sha1":"c25ff1bb2ea3e0804ab3f370ad2877b0b7c56903","md5":"d50f69f0d3a73c0a58d2ad08aedac1c8","sha512":"b3b9601479254bf3b36d20ea1f073171b0efa8cf9b6ce5074e9015cef243dadee9d2dcf8d4df6a7674f0dcac3c2f661ad9c76196b66046f736a5078b60e44aeb","ssdeep":"1536:mBwl+KXpsqN5vlwWYyhY9S4AKlj/UGqxsP87ToNt/PZWZdCB5fNqzRJSqo:Qw+asqN5aW/hLk/UGqxOkoN1PsdC3WLo","ssdeep_chunks":["1536:mBwl+KX","1536:Bwl+KXp","1536:wl+KXps","1536:l+KXpsq","1536:+KXpsqN","1536:KXpsqN5","1536:XpsqN5v","1536:psqN5vl","1536:sqN5vlw","1536:qN5vlwW","1536:N5vlwWY","1536:5vlwWYy","1536:vlwWYyh","1536:lwWYyhY","1536:wWYyhY9","1536:WYyhY9S","1536:YyhY9S4","1536:yhY9S4A","1536:hY9S4AK","1536:Y9S4AKl","1536:9S4AKlj","1536:S4AKlj/","1536:4AKlj/U","1536:AKlj/UG","1536:Klj/UGq","1536:lj/UGqx","1536:j/UGqxs","1536:/UGqxsP","1536:UGqxsP8","1536:GqxsP87","1536:qxsP87T","1536:xsP87To","1536:sP87ToN","1536:P87ToNt","1536:87ToNt/","1536:7ToNt/P","1536:ToNt/PZ","1536:oNt/PZW","1536:Nt/PZWZ","1536:t/PZWZd","1536:/PZWZdC","1536:PZWZdCB","1536:ZWZdCB5","1536:WZdCB5f","1536:ZdCB5fN","1536:dCB5fNq","1536:CB5fNqz","1536:B5fNqzR","1536:5fNqzRJ","1536:fNqzRJS","1536:NqzRJSq","1536:qzRJSqo","3072:mBwl+KX","3072:Bwl+KXp","3072:wl+KXps","3072:l+KXpsq","3072:+KXpsqN","3072:KXpsqN5","3072:XpsqN5v","3072:psqN5vl","3072:sqN5vlw","3072:qN5vlwW","3072:N5vlwWY","3072:5vlwWYy","3072:vlwWYyh","3072:lwWYyhY","3072:wWYyhY9","3072:WYyhY9S","3072:YyhY9S4","3072:yhY9S4A","3072:hY9S4AK","3072:Y9S4AKl","3072:9S4AKlj","3072:S4AKlj/","3072:4AKlj/U","3072:AKlj/UG","3072:Klj/UGq","3072:lj/UGqx","3072:j/UGqxs","3072:/UGqxsP","3072:UGqxsP8","3072:GqxsP87","3072:qxsP87T","3072:xsP87To","3072:sP87ToN","3072:P87ToNt","3072:87ToNt/","3072:7ToNt/P","3072:ToNt/PZ","3072:oNt/PZW","3072:Nt/PZWZ","3072:t/PZWZd","3072:/PZWZdC","3072:PZWZdCB","3072:ZWZdCB5","3072:WZdCB5f","3072:ZdCB5fN","3072:dCB5fNq","3072:CB5fNqz","3072:B5fNqzR","3072:5fNqzRJ","3072:fNqzRJS","3072:NqzRJSq","3072:qzRJSqo","1536:Qw+asqN","1536:w+asqN5","1536:+asqN5a","1536:asqN5aW","1536:sqN5aW/","1536:qN5aW/h","1536:N5aW/hL","1536:5aW/hLk","1536:aW/hLk/","1536:W/hLk/U","1536:/hLk/UG","1536:hLk/UGq","1536:Lk/UGqx","1536:k/UGqxO","1536:/UGqxOk","1536:UGqxOko","1536:GqxOkoN","1536:qxOkoN1","1536:xOkoN1P","1536:OkoN1Ps","1536:koN1Psd","1536:oN1PsdC","1536:N1PsdC3","1536:1PsdC3W","1536:PsdC3WL","1536:sdC3WLo"],"imphash":"f86dec4a80961955a89e7ed62046cc0e"},"file_info":{"file_name":"Sample_5b6d3c47b8ebb50a6130794d.bin","file_type":["peexe","executable"],"file_type_id":"exe","file_size":94720,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1533924320000,"last_seen":1683554094000,"last_multi_scan":1683554094000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["crypt","crysis","downloader","filecryptor","fynloski","nemreq","neshta","parite","ransomware","tescrypt","troldesh","wadhrama","dharma","sality"]},"stats":{"av":{"malicious_count":25,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":8},"sandbox_signatures":{"informative_count":13,"suspicious_count":14,"malicious_count":5,"total":32},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Crusis.tqMs","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Crysis","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.AGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Wadhrama.vbfnm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.Crysis.E","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.Dharma-6668198-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.Crysis.D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Trojan.ILHO-9216","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.Crysis.E (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Filecoder.Crysis.P trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/Crysis.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 00519f781 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Crusis.to","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Ransom-Dharma!D50F69F0D3A7","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Filecoder.emdnxn","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_98","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Criakl-G","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Ransom/W32.Dharma.94720","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom.71377523","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom.71377523","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanRansom.Crusis","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Dropper.Crusis.Win32.28","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Ransom.Crysis","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Service Execution","attack_id":"T1035","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","identifiers":[{"type":"suspicious","value":"Opened the service control manager"}],"sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"},{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Start Folder","attack_id":"T1060","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1060","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"},{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"},{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"suspicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","identifiers":[{"type":"malicious","value":"Deletes volume snapshots (often used by ransomware)"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"},{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"},{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","identifiers":[{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Queries volume information of an entire harddrive"}],"sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"},{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"},{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"vssadmin.exe\" at 00011697-00003548-00000033-18515050363","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"},{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\".exe\" queries volume information of \"\\REGISTRY\\USER\\S-1-5-21-686412048-2446563785-1323799475-1001\\Control Panel\\Desktop\\MuiCached\" at 00011149-00002496-00000046-14891676748\n \".exe\" queries volume information of unknown location at 00011149-00002496-00000046-14910471284\n \".exe\" queries volume information of unknown location at 00011149-00002496-00000046-14944063146\n \".exe\" queries volume information of unknown location at 00011149-00002496-00000046-15322060073\n \".exe\" queries volume information of unknown location at 00011149-00002496-00000046-15345237884\n \".exe\" queries volume information of unknown location at 00011149-00002496-00000046-15516208669","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"},{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\crysis\\Release\\PDB\\payload.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"},{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Global\\syncronize_G3GADTA\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\syncronize_G3GADTU\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"},{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"mode.com\" (UID: 00011648-00003240) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"mode.com\" (UID: 00011648-00003240) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" (UID: 00011631-00003440)\n Spawned process \"mode.com\" with commandline \"mode con cp select=1251\" (UID: 00011648-00003240)\n Spawned process \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00011697-00003548)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"},{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"cmd.exe\" (UID: 00011631-00003440)\n Spawned process \"mode.com\" with commandline \"mode con cp select=1251\" (UID: 00011648-00003240)\n Spawned process \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00011697-00003548)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"},{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"mode.com\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"},{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$27","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"},{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"vssadmin.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"},{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\".exe\" queried SystemProcessInformation at 00011149-00002496-00000033-14258869691\n \".exe\" queried SystemProcessInformation at 00011149-00002496-00000033-14604422127\n \".exe\" queried SystemProcessInformation at 00011149-00002496-00000033-15831123655","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"},{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rdata\n .data with unusual entropies 7.78504061339\n 7.9828902625","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"},{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"},{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"},{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\".exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_ENUMERATE_SERVICE\" (0x4)","origin":"API Call","mitre_attack_id":"T1035","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"},{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\".exe\" read file \"C:\\$Recycle.Bin\\S-1-5-21-686412048-2446563785-1323799475-1001\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\".exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"C2AB289CBD2573572C39CAC3F234D77FDF769E48A1715A14FEDDAEA8AE9D9702.EXE\"; Value: \"%WINDIR%\\System32\\c2ab289cbd2573572c39cac3f234d77fdf769e48a1715a14feddaea8ae9d9702.exe\")","origin":"Registry Access","mitre_attack_id":"T1060","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"},{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"cmd.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\mode.com\" (Handle: 84)\n \"cmd.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\mode.com\" (Handle: 84)\n \"cmd.exe\" wrote 8 bytes to a remote process \"%WINDIR%\\System32\\mode.com\" (Handle: 84)\n \"cmd.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\vssadmin.exe\" (Handle: 80)\n \"cmd.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\vssadmin.exe\" (Handle: 80)\n \"cmd.exe\" wrote 8 bytes to a remote process \"%WINDIR%\\System32\\vssadmin.exe\" (Handle: 80)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"},{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\c2ab289cbd2573572c39cac3f234d77fdf769e48a1715a14feddaea8ae9d9702.exe\" marked \"C:\\$Recycle.Bin\\S-1-5-21-686412048-2446563785-1323799475-1001\\desktop.ini\" for deletion\n \"C:\\c2ab289cbd2573572c39cac3f234d77fdf769e48a1715a14feddaea8ae9d9702.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml\" for deletion\n \"C:\\c2ab289cbd2573572c39cac3f234d77fdf769e48a1715a14feddaea8ae9d9702.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusWW.xml\" for deletion\n \"C:\\c2ab289cbd2573572c39cac3f234d77fdf769e48a1715a14feddaea8ae9d9702.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml\" for deletion\n \"C:\\c2ab289cbd2573572c39cac3f234d77fdf769e48a1715a14feddaea8ae9d9702.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml\" for deletion","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"},{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\".exe\" opened \"C:\\$Recycle.Bin\\S-1-5-21-686412048-2446563785-1323799475-1001\\desktop.ini\" with delete access\n \".exe\" opened \"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml\" with delete access\n \".exe\" opened \"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusWW.xml\" with delete access\n \".exe\" opened \"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml\" with delete access\n \".exe\" opened \"C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"},{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetProcAddress\n LoadLibraryA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"},{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"mode.com\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"},{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"57/67 Antivirus vendors marked sample as malicious (85% detection rate)\n 11/15 Antivirus vendors marked sample as malicious (73% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"},{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"57/67 Antivirus vendors marked sample as malicious (85% detection rate)\n 11/15 Antivirus vendors marked sample as malicious (73% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"},{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"dharma_ransomware\" classified file \"c2ab289cbd2573572c39cac3f234d77fdf769e48a1715a14feddaea8ae9d9702.bin\" as \"dharma,crysis,ransomware\" based on indicators: \"C:\\crysis\\Release\\PDB\\payload.pdb\" (Author: Marc Rivero | Hybrid Analysis)","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"},{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00011697-00003548)","origin":"Monitored Target","mitre_attack_id":"T1107","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"},{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"\" queries volume information of \"C:\\\" at 00013873-00002328-0000010C-4822325053\n \"\" queries volume information of \"C:\\\" at 00013873-00002328-0000010C-4827046949\n \"\" queries volume information of \"C:\\\" at 00013873-00002328-0000010C-4831035735\n \"\" queries volume information of \"C:\\\" at 00013873-00002328-0000010C-4835492750\n \"\" queries volume information of \"C:\\\" at 00013873-00002328-0000010C-4835492825\n \"\" queries volume information of \"C:\\\" at 00013873-00002328-0000010C-4838502729","origin":"API Call","mitre_attack_id":"T1120","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$28","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"level":"informative","category":"Pattern Matching","name":"Code classification distribution is known to appear in malware","description":"TrID distribution is very similar to the \"CTB-Locker\" family (e.g. SHA256: cbba56bd16222191f1468a1d93b63945394371cfb9ffe38f34a9575c5655e57a)","origin":"TrID Evaluation","relevance":5,"id":"trid-0","sources":[{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to measure performance","description":"rdtsc at 00013873-00002328-28103-120-004053B0","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-6","sources":[{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 2000 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"level":"malicious","category":"Ransomware/Banking","name":"The analysis extracted a known ransomware file","description":"Found dropped filename \"_ReadMe_.txt.id-C1EE6045.[paymentbtc@firemail.cc].cmb\" which has been seen in the context of ransomware (Indicator: README_.txt)","origin":"Binary File","relevance":5,"id":"binary-9","sources":[{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Deletes volume snapshots (often used by ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"},{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"},{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"},{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":49,"dropped_files_count":0,"extracted_files_count":20,"files_written_count":32,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["crypt","crysis","downloader","filecryptor","fynloski","nemreq","neshta","parite","ransomware","tescrypt","troldesh","wadhrama","dharma","sality"],"sample_flags":["TOR analysis","Extracted Files"],"sandbox_reports":[{"id":"5ba67aa77ca3e12b7104db13","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Ransom.Crysis","submit_name":"d.exe","analysis_start_time":"2018-09-22T19:24:00+00:00","indicators_count":{"informative":10,"suspicious":15,"malicious":6},"tags":["TOR analysis"],"is_in_unified_schema":true},{"id":"5b6dd3e07ca3e1517f475c34","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Ransom.Crysis","submit_name":"Sample_5b6d3c47b8ebb50a6130794d.bin","analysis_start_time":"2018-08-10T19:01:30+00:00","indicators_count":{"informative":13,"suspicious":15,"malicious":7},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"}],"processes":[{"pid":2496,"ppid":0,"name":"c2ab289cbd2573572c39cac3f234d77fdf769e48a1715a14feddaea8ae9d9702.exe","command_line":"","sha256":"c2ab289cbd2573572c39cac3f234d77fdf769e48a1715a14feddaea8ae9d9702","normalized_path":"C:\\c2ab289cbd2573572c39cac3f234d77fdf769e48a1715a14feddaea8ae9d9702.exe","uid":"00011149-00002496","icon":"$29"},{"pid":3440,"ppid":2496,"name":"cmd.exe","command_line":"","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00011149-00002496","uid":"00011631-00003440"},{"pid":3240,"ppid":3440,"name":"mode.com","command_line":"mode con cp select=1251","sha256":"64ad2057863172cbfef4328bc57be134f956a7736e87eb90b04f2be391bca517","normalized_path":"%WINDIR%\\System32\\mode.com","parent_uid":"00011631-00003440","uid":"00011648-00003240"},{"pid":3548,"ppid":3440,"name":"vssadmin.exe","command_line":"vssadmin delete shadows /all /quiet","sha256":"4de7fa20e3224382d8c4a81017e5bdd4673afbef9c0f017e203d7b78977fbf8c","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","parent_uid":"00011631-00003440","uid":"00011697-00003548"}],"all_imported_dlls":["shlwapi.dll","ws2_32.dll","cscapi.dll","netutils.dll","wow64win.dll","msvcrt.dll","sechost.dll","usp10.dll","winbrand.dll","clbcatq.dll","vss_ps.dll","ntdll.dll","kernel32.dll","advapi32.dll","sspicli.dll","ntlanman.dll","ole32.dll","browcli.dll","basebrd.dll","wow64.dll","KernelBase.dll","rpcrt4.dll","cryptbase.dll","imm32.dll","nsi.dll","vsstrace.dll","vssapi.dll","wow64cpu.dll","user32.dll","ulib.dll","rpcss.dll","rsaenh.dll","gdi32.dll","lpk.dll","davhlpr.dll","RpcRtRemote.dll","msctf.dll","shell32.dll","mpr.dll","drprov.dll","winsta.dll","davclnt.dll","oleaut32.dll","uxtheme.dll","apphelp.dll","wkscli.dll","ureg.dll","atl.dll","cryptsp.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"config.sys.id-C1EE6045.[paymentbtc@firemail.cc].cmb","sha256":"e07688b5cc495971144e2f01e68ed1aa0fc862d15ea4c6ee50d1e374d10ddc13","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"name":"_Date_Time_DOSDateTimeToFileTime.au3.id-C1EE6045.[paymentbtc@firemail.cc].cmb","sha256":"c1a59b0ab50b80387fbba077cd6f17054a23e351aad69d851ec42258b65da379","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"name":"_WinAPI_FlashWindowEx.au3.id-C1EE6045.[paymentbtc@firemail.cc].cmb","sha256":"1053a700e7a8af2d84200d8f4818f4dc94cd3cd6df7fc437ba9781e94522af3b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"name":"_GUICtrlRichEdit_GetFirstCharPosOnLine.au3.id-C1EE6045.[paymentbtc@firemail.cc].cmb","sha256":"bda2cb25438312640a0fe446533a2f258dd5d273c09876665042b8e2c7e681ba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"name":"DEXShare.spi.id-C1EE6045.[paymentbtc@firemail.cc].cmb","sha256":"965a26abd1bfffa135086de068df5a298210675cdace0dd0cc51cdc4cf4da48f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"name":"BD21325_.GIF.id-C1EE6045.[paymentbtc@firemail.cc].cmb","sha256":"431a0b41ab81cdb81456ccb0ade29a618a10172b50a55160d3de40ef915db92f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"name":"_GUICtrlListView_GetItemRect.au3.id-C1EE6045.[paymentbtc@firemail.cc].cmb","sha256":"b0a200c57d5d49306081fd273fbc90d1f7f3c8c5465adc5d17980a1e3b8b610e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"name":"BD21301_.GIF.id-C1EE6045.[paymentbtc@firemail.cc].cmb","sha256":"2a82d63d8579823213ecbf3183fefde3a65f6999f16ea00057ac1b79c8916bc4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"name":"BD14870_.GIF.id-C1EE6045.[paymentbtc@firemail.cc].cmb","sha256":"2ba3aecce6324821422d02e4168ee571e618f40091305fe7e99bac1da50fc3cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"name":"AN01216_.WMF.id-C1EE6045.[paymentbtc@firemail.cc].cmb","sha256":"e07b18c22b0274c373f8181fba7c7b8bd00f5e30a945bad3cf0116c95a1cf313","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"name":"_GUICtrlComboBox_GetDroppedControlRectEx.au3.id-C1EE6045.[paymentbtc@firemail.cc].cmb","sha256":"6c00ebeddb2b2db997599667aef24c075fd7dc9cebf5a58494eec97d78618a77","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"name":"_Excel_RangeRead.au3.id-C1EE6045.[paymentbtc@firemail.cc].cmb","sha256":"f731caa470978589162263c5f318bd6e067180a5ca38a99df20ca7c2ac67e41d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"name":"BD14531_.GIF.id-C1EE6045.[paymentbtc@firemail.cc].cmb","sha256":"393e97a6724bca820a817ce4e3d0b73d466c21024c4cd6b6886d8f19de5b5c4d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"name":"BD21323_.GIF.id-C1EE6045.[paymentbtc@firemail.cc].cmb","sha256":"15be4fc1fab2147dfa8d26adea3ab988f9325cca033513557caf0fbf80a44324","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"name":"_GUICtrlToolbar_HideButton.au3.id-C1EE6045.[paymentbtc@firemail.cc].cmb","sha256":"b9772f3a444388b02fe93e47d4157396d0f6caf0f1267ce61b8cf216a79208ea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"name":"FD00543_.WMF.id-C1EE6045.[paymentbtc@firemail.cc].cmb","sha256":"73e0e0965727f9c354efafc0382d8a2ffc03e3a9841d4a0c23a7b32e9497b23e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"name":"_GUICtrlListView_GetItemStateImage.au3.id-C1EE6045.[paymentbtc@firemail.cc].cmb","sha256":"e8ca4acadda534e0dcf34432b09199053c86c4d0f498c713f13631abf80cd667","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"name":"_GUICtrlRichEdit_HideSelection.au3.id-C1EE6045.[paymentbtc@firemail.cc].cmb","sha256":"91060844b839acd842d26e53fb71f4040423dc99b0e1f0af82b218347f7db32c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"name":"_GUICtrlRichEdit_GetSel.au3.id-C1EE6045.[paymentbtc@firemail.cc].cmb","sha256":"ed03f70059e23facaabce13e74ed8d79f9c5b144dadfb596bdbea0602535889b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"name":"_GUICtrlListView_EnsureVisible.au3.id-C1EE6045.[paymentbtc@firemail.cc].cmb","sha256":"d50b90ad2a5abf4260e2c3dff77edf9c604aff798902807aff89f39bcaad0b32","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]}],"files_written":[{"path":"%WINDIR%\\Branding\\Basebrd\\basebrd.dll","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"},{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"path":"%WINDIR%\\AppPatch\\AppPatch64\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"}]},{"path":"C:\\c2ab289cbd2573572c39cac3f234d77fdf769e48a1715a14feddaea8ae9d9702.exe","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"}]},{"path":"%WINDIR%\\System32\\c2ab289cbd2573572c39cac3f234d77fdf769e48a1715a14feddaea8ae9d9702.exe","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\c2ab289cbd2573572c39cac3f234d77fdf769e48a1715a14feddaea8ae9d9702.exe","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\c2ab289cbd2573572c39cac3f234d77fdf769e48a1715a14feddaea8ae9d9702.exe","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"}]},{"path":"%WINDIR%\\System32\\en-US\\ulib.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"},{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-5FC0EEBB.[paymentbtc@firemail.cc].cmb","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-5FC0EEBB.[paymentbtc@firemail.cc].cmb","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-5FC0EEBB.[paymentbtc@firemail.cc].cmb","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"}]},{"path":"%WINDIR%\\System32\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"},{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"},{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"},{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"path":"C:\\Sample_5b6d3c47b8ebb50a6130794d.bin.exe","sources":[{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"path":"%WINDIR%\\System32\\Sample_5b6d3c47b8ebb50a6130794d.bin.exe","sources":[{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Sample_5b6d3c47b8ebb50a6130794d.bin.exe","sources":[{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Sample_5b6d3c47b8ebb50a6130794d.bin.exe","sources":[{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"path":"%WINDIR%\\System32\\en-US\\mpr.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"path":"%WINDIR%\\Branding\\Basebrd\\en-US\\basebrd.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"path":"%WINDIR%\\System32\\mode.com","sources":[{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"path":"C:\\$Recycle.Bin\\S-1-5-21-4162757579-3804539371-4239455898-1000\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\ose.exe","sources":[{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"path":"%WINDIR%\\System32\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\syncronize_G3GADTA","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"},{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\syncronize_G3GADTU","sources":[{"report_type":"sandbox","report_id":"5ba67aa77ca3e12b7104db13"},{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"name":"Global\\syncronize_G3GADTA","sources":[{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]},{"name":"Global\\syncronize_G3GADTU","sources":[{"report_type":"sandbox","report_id":"5b6dd3e07ca3e1517f475c34"}]}]}},"report_ids":{"sandbox_job_ids":["5ba67aa77ca3e12b7104db13","5b6dd3e07ca3e1517f475c34"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Ransom.Crysis Sample c2ab289cbd25… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample c2ab289cbd25…. Malware family: Trojan.Ransom.Crysis. Threat score 100/100. 25/28 AV engines flagged this file. 5 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/c2ab289cbd2573572c39cac3f234d77fdf769e48a1715a14feddaea8ae9d9702"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Ransom.Crysis Sample c2ab289cbd25… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample c2ab289cbd25…. Malware family: Trojan.Ransom.Crysis. Threat score 100/100. 25/28 AV engines flagged this file. 5 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/c2ab289cbd2573572c39cac3f234d77fdf769e48a1715a14feddaea8ae9d9702"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Ransom.Crysis Sample c2ab289cbd25… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample c2ab289cbd25…. Malware family: Trojan.Ransom.Crysis. Threat score 100/100. 25/28 AV engines flagged this file. 5 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]