21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T49f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample cc4647c4370f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample cc4647c4370f…. Malware family: Trojan.Generic. Threat score 100/100. 16/29 AV engines flagged this file. 7 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/cc4647c4370f78c442f6d456a31a3a6a2fc1ab7381277fc3791d9a91fc80cf6d","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","cc4647c4370f78c442f6d456a31a3a6a2fc1ab7381277fc3791d9a91fc80cf6d"],"about":{"@type":"SoftwareApplication","name":"Private Builder Ransomware V2.01.exe","applicationCategory":["peexe","executable"],"identifier":"cc4647c4370f78c442f6d456a31a3a6a2fc1ab7381277fc3791d9a91fc80cf6d","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":16,"total":29},"behavioralIndicators":{"malicious":7,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T5ac,"" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\System32\en-US\setupapi.dll.mui" "" touched file "C:\Users\881EdYG\AppData\Local\Microsoft\Windows\Caches" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "" touched file "C:\Windows\System32\en-US\propsys.dll.mui" "" touched file "C:\Windows\System32\wscript.exe" "" touched file "C:\Windows\AppPatch\sysmain.sdb" "" touched file "C:\Windows\System32\en-US\wscript.exe.mui" "" touched file "C:\Windows\System32\en\WScript.exe.mui" "" touched file "C:\Windows\System32\rsaenh.dll" "" touched file "C:\Windows\System32\en-US\shell32.dll.mui" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "wscript.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "wscript.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db"23:T405,Spawned process "" (UID: 00014758-00003020) Spawned process "cmd.exe" with commandline "/c wusa %TEMP%\32.cab /quiet /extract:%WINDIR%\system32\migwiz\ & exit" (UID: 00014978-00003152) Spawned process "wusa.exe" with commandline "wusa %TEMP%\32.cab /quiet /extract:%WINDIR%\system32\migwiz\" (UID: 00014982-00003076) Spawned process "wscript.exe" with commandline ""%TEMP%\888.vbs"" (UID: 00015205-00003600) Spawned process "migwiz.exe" with commandline "%WINDIR%\System32\cmd.exe /c %WINDIR%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f" (UID: 00015231-00003648) Spawned process "cmd.exe" with commandline "/c %WINDIR%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f" (UID: 00015255-00003680) Spawned process "reg.exe" with commandline "ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f" (UID: 00015260-00003652)24:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHh4cAAAAAAAAAAAAAAAAAf3CPgAAAAAAAAAAAAAAAAI9wf/cAAAB1AAAAAAAAAAj/cH//cAAHcRAAAAAAAAB4/3CP/4IAcZkQAAAAAAAA+P9wf/iHIBmRcQAAAAAAB3eIiI//iAAVF3EAAAAAAHgHd3d3d3eAARAAAAAAAACHhwB/AAeHhwAAAAAAAAAHhwBwCAd3B38AAAAAAAAACHB/+I+P/4CIcAAAAAAAAHd4/3eP/4/4d4AAAAAAAACAeIgAf/h/iHeAAAAAAAAAeP//gH/4////8AAAAAAAAI////B///////cAAAAAAAD////3f//////4AAAAAAAH+I//93//////9wAAAAAAB/AAAAd//3AAB4cAAAAAAAD/cACHf/iHAAj3AAAAAAAA////gP/3j///9wAAAAAAAP//+HeP93j///cAAAAAAAD4+Hdw//AHePj3AAAAAAAAj3dweP//cHd49wAAAAAAAI//j/////+I//AAAAAAAAB////////////wAAAAAAAAD///////////cAAAAAAAAAf/////////+AAAAAAAAAAAB3j/////h3AAAAAAAAAAAAAAAAd3AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==25:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==26:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAACIiIcAAAAAAAAAAAAAAIiIiI+Hd3dwAAAAAAAACIiIiIiHd3eHdwAAAAAIiIj4iI/4d3d3iIdwAAAAd3/4iIiP/4d3ePiId3gAAHB/iIiIj/iIh3j4j3d3cABwf4d4iP/4iIeI+I93d3cAcHh3eIj/iIiHiPiId3d3AHB4iHeP+IiHiIj4iHd3dwBweIiI//iHd4iI+IhwAAAAcHd3ePiPd3eIiPiIcAAAAHB3d3j4+Hd3iIj4iHAAAABwd4h4//h3d4iI+IhwAAAAcHd3eIj4h3eIiPiIcAAAAHB4t4iP/4iIiIj4iHAAAABweHeIj/+IiIh/94hwAAAAcH+IiI//iIiIf/iIcAAAAHB/+IiP//iIiH/4iHAAAABwf/iIiIiIiHeP+IhwAAAAcH+Id3d4iIiIj/iIcAAAAHd4eIiIiPiIiP/4iHAAAAAIh3//iIj/////+IhwAAAAAAd///+P////+PeIcAAAAAAHf///+IiId3iIeHcAAAAAB3h3d3d3eIiIj4iHAAAAAAd4d3iI//////+Hh3AAAAAHeIeP////////+HeAAAAAB3iIj//////4iIiHgAAAiAd4iIj4iIiIiIiIeAAAAAAAj/iIiIiHiIiIiHAAAAAAAAAAh4iIiIiIh3gAAAAAgAAAAAAAAIAAAAAAiAAAD/+A///4AA//wAAH/AAAA/gAAAB4AAAAOAAAABgAAAAYAAAAGAAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD/AAAA/8AAAP/AAAB/wAAAf8AAAD/AAAA/wAAAPkAAAH/gAAD//gAB/v/7/nw==27:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmZmZmZmZmQAAAAAAAAAAAJmZmZmZmZkKAAAAAAAAAACZmZmZmZmZCqAAAAAAAAAAmZmZmZmZmQqqAAAAAAAAAJmZmZmZmZkKqqAAD/8AAACZmZmZmZmZCqqgAP//8AAAmZmZmZmZmQoAAAD///AAAJmZmZmZmZkKqqAA+//wAACZmZmZmZmZCqqgu7u/AAAAmZmZmZmZmQqqoAC7sAAAAJmZmZmZmZkKqqAAsLAAAAAAAAAAAAAACqqgALC7AAAADMzMzMzMzMCqoAAAAAAAAADMzMzMzMzMCqAAAAAAAAAADAzMzMzMzMCgAAAAAAAAAAAMzMzMzMzMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAAAAAC7C7/wAAAAAAAAAAAAAAAAC7v//wAAAAAAAAAAAAAAC7u7v/8AAAAAAAAAAAAAAAu7v///AAAAAAAAAAAAAAAAC7D/8AAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAD////////////////gAB//4AAP/+AAB//gAAP/4AAB8+AAAMHgAACA4AAAAOAAAIDgAAAB4AAAw+AAANfgAADT8AAA//gAAP/8AAD//gAA//8AAP//f////3////9/////f///zj///+Qf///wD///wA///8AP///wH///+D///w==28:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAiIiHd3AAAAAAAAAAAAAAiIj4iIh3AAAAAAAAAAAAB4iIiIiIhwAAAAAAAAAAAAiIiIiIiHgAAAAAAAAAAAAIiIiIiHd3AAAAAAAAAAAAAId4h3d3iIgAAAAAAAAAAAAAB3d4iIiIcAAAAAAAAHd3d4iId3REiIiIiHdwAAB3iIh3RERERIh4iIiIdwAAh3RERERGzMyIeIiIiIcAAIRERERER3d8iIiIiIiHAACHRERERHd3d4h4iId3iHAAh0ZEREx4iIiId3d3eIj3AIdHRERMiIiIiHd4h4d0iICId0REzIiIiIiId0RERIiAiHZEzMyIiIiIdEREzMyIcIh0RMzI+P//iIRERnd8iHCIZETMyP////+EREeHh4hwiHRMzGeP//+IhkTIiIiIcIh0TMx4d4iIiIRMyIiIiHAIdHd3d4d3iHdEzMiIiIhwCIiIh4d3h3h0TMx////4cAAAACd3d3d3dEzMj4///4cAAAB4d3d4eHRMzIiIiIiIAAAAeId3d3d3eId4iIiIgAAAB3iId3coiIh3d3d4AAAAAHeHd3d3cwACN3d3cAAAAAAjcjeHd3cyN3d3dwAAAAAAAgIHd3d3d3d3d3cAAAAAAAAAAid3d3d3d3cgAAAAAAAAAAAAd3d3d3cyAAAAAAAAAAAAAAJ3d3dyAAAAAAD8Af//8AAf/+AAB//gAAf/4AAH//AAN//8AB//AAAAHwAAAAMAAAAAAAAAAAAAAAIAAAADAAAAAQAAAAEAAAABAAAAAQAAAAEAAAABAAAAAYAAAAGAAAAB/AAAAPwAAAD4AAAB+AAAD/AAgB/wAAA/+oAAP/+AAH//4AB///AB/w==29:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==2a:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"cc4647c4370f78c442f6d456a31a3a6a2fc1ab7381277fc3791d9a91fc80cf6d","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790766708961,"unified_at":"2026-09-30T11:11:48.961Z","metadata":{"hashes":{"sha256":"cc4647c4370f78c442f6d456a31a3a6a2fc1ab7381277fc3791d9a91fc80cf6d","sha1":"c328b544463ceb39fe5355925327fd39e2287ccd","md5":"23d8ce67923d5dcfba88b7a6ee5fd5ae","sha512":"3e1830724b4457af0643816f757f9c8811ecdb267ff5a3c340916dbd33dbb644f4a3a5d76dab9bc4cb31d5f2b0e282c4dd1f03561e4ab56479f160da7bcbc212","ssdeep":"12288:u6Wq4aaE6KwyF5L0Y2D1PqLQahqhBkEFY9ddNdEYaTW3+kQj:0thEVaPqLxikFeYaTQQj","ssdeep_chunks":["12288:u6Wq4aa","12288:6Wq4aaE","12288:Wq4aaE6","12288:q4aaE6K","12288:4aaE6Kw","12288:aaE6Kwy","12288:aE6KwyF","12288:E6KwyF5","12288:6KwyF5L","12288:KwyF5L0","12288:wyF5L0Y","12288:yF5L0Y2","12288:F5L0Y2D","12288:5L0Y2D1","12288:L0Y2D1P","12288:0Y2D1Pq","12288:Y2D1PqL","12288:2D1PqLQ","12288:D1PqLQa","12288:1PqLQah","12288:PqLQahq","12288:qLQahqh","12288:LQahqhB","12288:QahqhBk","12288:ahqhBkE","12288:hqhBkEF","12288:qhBkEFY","12288:hBkEFY9","12288:BkEFY9d","12288:kEFY9dd","12288:EFY9ddN","12288:FY9ddNd","12288:Y9ddNdE","12288:9ddNdEY","12288:ddNdEYa","12288:dNdEYaT","12288:NdEYaTW","12288:dEYaTW3","12288:EYaTW3+","12288:YaTW3+k","12288:aTW3+kQ","12288:TW3+kQj","24576:u6Wq4aa","24576:6Wq4aaE","24576:Wq4aaE6","24576:q4aaE6K","24576:4aaE6Kw","24576:aaE6Kwy","24576:aE6KwyF","24576:E6KwyF5","24576:6KwyF5L","24576:KwyF5L0","24576:wyF5L0Y","24576:yF5L0Y2","24576:F5L0Y2D","24576:5L0Y2D1","24576:L0Y2D1P","24576:0Y2D1Pq","24576:Y2D1PqL","24576:2D1PqLQ","24576:D1PqLQa","24576:1PqLQah","24576:PqLQahq","24576:qLQahqh","24576:LQahqhB","24576:QahqhBk","24576:ahqhBkE","24576:hqhBkEF","24576:qhBkEFY","24576:hBkEFY9","24576:BkEFY9d","24576:kEFY9dd","24576:EFY9ddN","24576:FY9ddNd","24576:Y9ddNdE","24576:9ddNdEY","24576:ddNdEYa","24576:dNdEYaT","24576:NdEYaTW","24576:dEYaTW3","24576:EYaTW3+","24576:YaTW3+k","24576:aTW3+kQ","24576:TW3+kQj","12288:0thEVaP","12288:thEVaPq","12288:hEVaPqL","12288:EVaPqLx","12288:VaPqLxi","12288:aPqLxik","12288:PqLxikF","12288:qLxikFe","12288:LxikFeY","12288:xikFeYa","12288:ikFeYaT","12288:kFeYaTQ","12288:FeYaTQQ","12288:eYaTQQj"],"imphash":"890e522b31701e079a367b89393329e6"},"file_info":{"file_name":"Private Builder Ransomware V2.01.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":570999,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1511530086000,"last_seen":1665424452000,"last_multi_scan":1665424452000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ransomware"]},"stats":{"av":{"malicious_count":16,"suspicious_count":0,"total_engines":29},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":13,"suspicious_count":16,"malicious_count":7,"total":36},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"DR/AutoIt.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"AIT:Trojan.Nymeria.4490;Trojan.GenericKD.36145401;AIT:Trojan.Nymeria.4490;Trojan.GenericKD.36145401","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"AIT:Trojan.Nymeria.4490 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Filecoder.Crypt888.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Spyware ( 004fbe541 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan-AutoIt.d","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_96","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Trojan.Gen.2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_MIRCOP.H","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_MIRCOP.H","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Autoit.F","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win32.871347","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"UPX0\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WSCRIPT.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WSCRIPT.EXE\")\n \"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CC4647C4370F78C442F6D456A31A3A6A2FC1AB7381277FC3791D9A91FC80CF6D.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CC4647C4370F78C442F6D456A31A3A6A2FC1AB7381277FC3791D9A91FC80CF6D.EXE\")\n \"wscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MIGWIZ.EXE\")\n \"wscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MIGWIZ.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\aut4724.tmp\"\n \"\" created file \"%TEMP%\\fuoodkv\"\n \"\" created file \"%TEMP%\\aut48A2.tmp\"\n \"\" created file \"%TEMP%\\32.cab\"\n \"\" created file \"%TEMP%\\aut48AD.tmp\"\n \"\" created file \"%TEMP%\\64.cab\"\n \"\" created file \"%TEMP%\\888.vbs\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\WdsSetupLogInit\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\SetupLog\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"Lock.MineSweeper.lnk\" as clean (type is \"data\")\n Antivirus vendors marked dropped file \"Lock.Windows Media Player.lnk\" as clean (type is \"data\")\n Antivirus vendors marked dropped file \"Lock.Calculator.lnk\" as clean (type is \"data\")\n Antivirus vendors marked dropped file \"Lock.Sticky Notes.lnk\" as clean (type is \"data\")\n Antivirus vendors marked dropped file \"Lock.Paint.lnk\" as clean (type is \"data\")\n Antivirus vendors marked dropped file \"888.vbs\" as clean (type is \"ASCII text with CRLF line terminators\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"wscript.exe\" called \"WScript.Shell.1.CreateObject\" ... \n \"wscript.exe\" called \"WScript.Shell.1.Run\" ...","origin":"API Call","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"wscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c wusa %TEMP%\\32.cab /quiet /extract:%WINDIR%\\system32\\migwiz\\ & exit\" on 2017-11-24.14:16:41.705\n \"/c %WINDIR%\\System32\\reg.exe ADD HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f\" on 2017-11-24.14:16:44.489","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/c wusa %TEMP%\\32.cab /quiet /extract:%WINDIR%\\system32\\migwiz\\ & exit\" (UID: 00014978-00003152)\n Spawned process \"wusa.exe\" with commandline \"wusa %TEMP%\\32.cab /quiet /extract:%WINDIR%\\system32\\migwiz\\\" (UID: 00014982-00003076)\n Spawned process \"wscript.exe\" with commandline \"\"%TEMP%\\888.vbs\"\" (UID: 00015205-00003600)\n Spawned process \"migwiz.exe\" with commandline \"%WINDIR%\\System32\\cmd.exe /c %WINDIR%\\System32\\reg.exe ADD HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f\" (UID: 00015231-00003648)\n Spawned process \"cmd.exe\" with commandline \"/c %WINDIR%\\System32\\reg.exe ADD HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f\" (UID: 00015255-00003680)\n Spawned process \"reg.exe\" with commandline \"ADD HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f\" (UID: 00015260-00003652)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"Lock.MineSweeper.lnk\" has type \"data\"\n \"Lock.Windows Media Player.lnk\" has type \"data\"\n \"Calculator.lnk\" has type \"empty\"\n \"Lock.Calculator.lnk\" has type \"empty\"\n \"MineSweeper.lnk\" has type \"empty\"\n \"Lock.MineSweeper.lnk\" has type \"empty\"\n \"Paint.lnk\" has type \"empty\"\n \"Lock.Paint.lnk\" has type \"empty\"\n \"Sticky Notes.lnk\" has type \"empty\"\n \"Lock.Sticky Notes.lnk\" has type \"empty\"\n \"Windows Media Player.lnk\" has type \"empty\"\n \"Lock.Windows Media Player.lnk\" has type \"empty\"\n \"Lock.Calculator.lnk\" has type \"data\"\n \"Lock.Sticky Notes.lnk\" has type \"data\"\n \"Lock.Paint.lnk\" has type \"data\"\n \"888.vbs\" has type \"ASCII text with CRLF line terminators\"\n \"f3b1128f9725fe47a53dd42020255661.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"Lock.Identities\" has type \"data\"\n \"desktop.ini\" has type \"empty\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$22","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"*|.NG\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"cc4647c4370f78c442f6d456a31a3a6a2fc1ab7381277fc3791d9a91fc80cf6d.exe.bin\" was detected as \"UPX v1.25 (Delphi) Stub\"\n \"f3b1128f9725fe47a53dd42020255661.tmp\" was detected as \"Borland Delphi 3.0 (???)\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Writes to a desktop.ini file (may be used to cloak folders)","description":"\"\" wrote to file \"%USERPROFILE%\\Desktop\\Lock.desktop.ini\"","origin":"API Call","relevance":3,"id":"api-34","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"UPX1 with unusual entropies 7.92934161105","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"\"cc4647c4370f78c442f6d456a31a3a6a2fc1ab7381277fc3791d9a91fc80cf6d.exe.bin\" has a section named \"UPX0\"\n \"cc4647c4370f78c442f6d456a31a3a6a2fc1ab7381277fc3791d9a91fc80cf6d.exe.bin\" has a section named \"UPX1\"","origin":"Static Parser","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"wusa.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"wscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"wusa.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"wscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Name: \"%WINDIR%\\System32\\cmd.exe\", Handle: 328)\n \"\" is creating a new process (Name: \"%WINDIR%\\System32\\wscript.exe\", Handle: 496)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"f3b1128f9725fe47a53dd42020255661.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Executes a visual basic script","description":"Process \"wscript.exe\" with commandline \"\"%TEMP%\\888.vbs\"\" (UID: 00015205-00003600)","origin":"Monitored Target","relevance":10,"id":"target-17","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"wscript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"wscript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"wscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"level":"suspicious","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"\" (Access type: \"QUERYVAL\"; Path: \"HKCR\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\SYSTEM\"; Key: \"ALWAYSSHOWEXT\"; Value: \"0000000001000000020000000000\")","origin":"Registry Access","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"cc4647c4370f78c442f6d456a31a3a6a2fc1ab7381277fc3791d9a91fc80cf6d.exe.bin\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"VirtualProtect\n GetProcAddress\n VirtualAlloc\n LoadLibraryA\n EnumProcesses\n FtpOpenFileW\n recv\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n WinExec\n UnhandledExceptionFilter\n LoadLibraryExW\n GetStartupInfoW\n GetCommandLineA\n WriteFile\n GetModuleHandleW\n TerminateProcess\n GetModuleHandleExW\n OutputDebugStringW\n CreateFileW\n Sleep","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"migwiz.exe\" wrote bytes \"4053ed765858ee76186aee76653cef760000000000bf36750000000056cc3675000000007cca36750000000037682a756a2cef76d62def760000000020692a750000000029a6367500000000a48d2a7500000000f70e367500000000\" to virtual address \"0x76FE1000\" (part of module \"NSI.DLL\")\n \"reg.exe\" wrote bytes \"4053ed765858ee76186aee76653cef760000000000bf36750000000056cc3675000000007cca36750000000037682a756a2cef76d62def760000000020692a750000000029a6367500000000a48d2a7500000000f70e367500000000\" to virtual address \"0x76FE1000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"wscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"38/68 Antivirus vendors marked sample as malicious (55% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"38/68 Antivirus vendors marked sample as malicious (55% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"47/89 Antivirus vendors marked dropped file \"f3b1128f9725fe47a53dd42020255661.tmp\" as malicious (classified as \"Gen:Variant.Ransom.Aviso\" with 52% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"level":"malicious","category":"Installation/Persistance","name":"Drops executable files to the Windows system directory","description":"File type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\" was dropped at \"%WINDIR%\\system32\\migwiz\\$dpx$.tmp\\f3b1128f9725fe47a53dd42020255661.tmp\"","origin":"Binary File","relevance":7,"id":"binary-7","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\wscript.exe\" (Handle: 496)\n \"\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\wscript.exe\" (Handle: 496)\n \"\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\wscript.exe\" (Handle: 496)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"level":"malicious","category":"System Security","name":"Modifies the UAC/LUA settings (Account Control)","description":"\"reg.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\SYSTEM\"; Key: \"ENABLELUA\"; Value: \"00000000\")","origin":"Registry Access","relevance":8,"id":"registry-10","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$23","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]}],"incidents":[{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]}]},"activity":{"stats":{"process_count":7,"spawned_processes_count":7,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":10,"imported_dlls_count":81,"dropped_files_count":0,"extracted_files_count":12,"files_written_count":87,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ransomware"],"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"5a181c797ca3e1704d759163","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"AIT:Trojan.Nymeria","submit_name":"Private Builder Ransomware V2.01.exe","analysis_start_time":"2017-11-24T14:16:29+00:00","indicators_count":{"informative":13,"suspicious":18,"malicious":8},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}],"processes":[{"pid":3020,"ppid":0,"name":"cc4647c4370f78c442f6d456a31a3a6a2fc1ab7381277fc3791d9a91fc80cf6d.exe","command_line":"","sha256":"cc4647c4370f78c442f6d456a31a3a6a2fc1ab7381277fc3791d9a91fc80cf6d","normalized_path":"C:\\cc4647c4370f78c442f6d456a31a3a6a2fc1ab7381277fc3791d9a91fc80cf6d.exe","uid":"00014758-00003020","icon":"$24"},{"pid":3152,"ppid":3020,"name":"cmd.exe","command_line":"/c wusa %TEMP%\\32.cab /quiet /extract:%WINDIR%\\system32\\migwiz\\ & exit","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014758-00003020","uid":"00014978-00003152","icon":"$25"},{"pid":3076,"ppid":3152,"name":"wusa.exe","command_line":"wusa %TEMP%\\32.cab /quiet /extract:%WINDIR%\\system32\\migwiz\\","sha256":"cb128faf0430ce1a90412546e90a3b6446c74887d696485cc2c3aaf10714a428","normalized_path":"%WINDIR%\\System32\\wusa.exe","parent_uid":"00014978-00003152","uid":"00014982-00003076","icon":"$26"},{"pid":3600,"ppid":3020,"name":"wscript.exe","command_line":"\"%TEMP%\\888.vbs\"","sha256":"047f3c5a7ab0ea05f35b2ca8037bf62dd4228786d07707064dbd0d46569305d0","normalized_path":"%WINDIR%\\System32\\wscript.exe","parent_uid":"00014758-00003020","uid":"00015205-00003600","icon":"$27"},{"pid":3648,"ppid":3600,"name":"migwiz.exe","command_line":"%WINDIR%\\System32\\cmd.exe /c %WINDIR%\\System32\\reg.exe ADD HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f","sha256":"75a311401e5f73ae88d02964f9763d8ecc9c09e082555b9f16dd4276119e7de0","normalized_path":"%WINDIR%\\System32\\migwiz\\migwiz.exe","parent_uid":"00015205-00003600","uid":"00015231-00003648","icon":"$28"},{"pid":3680,"ppid":3648,"name":"cmd.exe","command_line":"/c %WINDIR%\\System32\\reg.exe ADD HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00015231-00003648","uid":"00015255-00003680","icon":"$29"},{"pid":3652,"ppid":3680,"name":"reg.exe","command_line":"ADD HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","normalized_path":"%WINDIR%\\System32\\reg.exe","parent_uid":"00015255-00003680","uid":"00015260-00003652","icon":"$2a"}],"all_imported_dlls":["nsi.dll","imm32.dll","setupapi.dll","clbcatq.dll","cryptsp.dll","wet.dll","kernel32.dll","rpcrt4.dll","gdi32.dll","user32.dll","wsock32.dll","sfc_os.dll","ntshrui.dll","wshext.dll","scrobj.dll","mfc42u.dll","odbc32.dll","advapi32.dll","sechost.dll","cfgmgr32.dll","ntmarta.dll","sspicli.dll","dbghelp.dll","sxs.dll","wininet.dll","urlmon.dll","msasn1.dll","scrrun.dll","GdiPlus.dll","iertutil.dll","apphelp.dll","rsaenh.dll","wintrust.dll","netapi32.dll","shlwapi.dll","userenv.dll","msctf.dll","srvcli.dll","RpcRtRemote.dll","rpcss.dll","crypt32.dll","ws2_32.dll","slc.dll","migcore.dll","KernelBase.dll","usp10.dll","msisip.dll","migstore.dll","mpr.dll","oleaut32.dll","profapi.dll","cryptbase.dll","unbcl.dll","odbcint.dll","comctl32.dll","psapi.dll","sfc.dll","netutils.dll","wtsapi32.dll","wkscli.dll","samcli.dll","msi.dll","msvcrt.dll","dwmapi.dll","propsys.dll","Wldap32.dll","lpk.dll","comdlg32.dll","devobj.dll","cscapi.dll","winbrand.dll","wdscore.dll","cabinet.dll","dpx.dll","vbscript.dll","version.dll","shell32.dll","ole32.dll","winmm.dll","uxtheme.dll","ntdll.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"888.vbs","sha256":"35d7204f9582b63b47942a4df9a55b8825b6d0af295b641f6257c39f7dda5f5e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"name":"Lock.Calculator.lnk","sha256":"7abe4ed734e47e6e3bdf4ca52c71977560bb0fb8edd4e2d21e6545d82673e995","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"name":"Lock.Paint.lnk","sha256":"f019655768a78200aeef7007c2c318d2fe06a977f94a44d2734b6190c970be0e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"name":"Lock.Sticky Notes.lnk","sha256":"4781c839e975a2fefbf9e284ceebb78d1873850bb9849bab30a8722bf0629b17","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"name":"Lock.Adobe","sha256":"645c2d0cb9f6edf276f7dead9ab8c72531cdae22f54962d174c1339c30cb1b42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"name":"Lock.Identities","sha256":"645c2d0cb9f6edf276f7dead9ab8c72531cdae22f54962d174c1339c30cb1b42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"name":"Lock.Media Center Programs","sha256":"645c2d0cb9f6edf276f7dead9ab8c72531cdae22f54962d174c1339c30cb1b42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"name":"Lock.Microsoft","sha256":"645c2d0cb9f6edf276f7dead9ab8c72531cdae22f54962d174c1339c30cb1b42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"name":"aut4724.tmp","sha256":"e2786aca31f8290bb93f837874b51a22d6a9b51283907f28399ebdb0d55acc9c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"name":"aut48A2.tmp","sha256":"fc31b205d5e4f32fa0c71c8f72ee06b92a28bd8690f71ab8f94ff401af2228fe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"name":"aut48AD.tmp","sha256":"6e438201a14a70980048d2377c2195608d5dc2cf915f489c0a59ac0627c98fa9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"name":"fuoodkv","sha256":"a99b87d95eb2bd67309f49d86b397debef3e3fb2cec888c5a88647aad8546f04","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]}],"files_written":[{"path":"C:\\cc4647c4370f78c442f6d456a31a3a6a2fc1ab7381277fc3791d9a91fc80cf6d.exe","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%TEMP%\\64.cab","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%WINDIR%\\System32\\wusa.exe","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%WINDIR%\\System32\\en-US\\wusa.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%WINDIR%\\wusa.lock","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%WINDIR%\\Logs\\DPX\\setuperr.log","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%WINDIR%\\Logs\\DPX\\setuplog.cfg","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%WINDIR%\\System32\\migwiz\\$dpx$.tmp","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%TEMP%\\32.cab","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%WINDIR%\\System32\\migwiz\\$dpx$.tmp\\f3b1128f9725fe47a53dd42020255661.tmp","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%WINDIR%\\Logs\\DPX\\setupact.log","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%WINDIR%\\System32\\en\\WScript.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%WINDIR%\\System32\\en-US\\wscript.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%WINDIR%\\System32\\wscript.exe","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%USERPROFILE%\\Desktop\\Lock.Calculator.lnk","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%TEMP%\\888.vbs","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%WINDIR%\\System32\\wshom.ocx","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%WINDIR%\\System32\\en-US\\propsys.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%WINDIR%\\System32\\migwiz\\migwiz.exe","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%WINDIR%\\System32\\migwiz\\en-US\\migwiz.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%WINDIR%\\System32\\en-US\\odbcint.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%WINDIR%\\System32\\en-US\\MFC42u.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%WINDIR%\\System32\\migwiz\\locale.dat","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%WINDIR%\\System32\\migwiz\\en-US\\wet.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%WINDIR%\\System32\\reg.exe","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%WINDIR%\\System32\\en-US\\reg.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%USERPROFILE%\\Desktop\\Lock.desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%USERPROFILE%\\Desktop\\Lock.MineSweeper.lnk","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%USERPROFILE%\\Desktop\\Lock.Paint.lnk","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%USERPROFILE%\\Desktop\\Lock.Sticky Notes.lnk","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%USERPROFILE%\\Desktop\\Lock.Windows Media Player.lnk","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%APPDATA%\\Lock.Adobe","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%WINDIR%\\System32\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%APPDATA%\\Lock.Identities","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%APPDATA%\\Lock.Media Center Programs","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%APPDATA%\\Lock.Microsoft","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%APPDATA%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%APPDATA%\\Microsoft\\Credentials\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%APPDATA%\\Microsoft\\Protect\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%APPDATA%\\Microsoft\\SystemCertificates\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%APPDATA%\\Microsoft\\AddIns","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%APPDATA%\\Microsoft\\Credentials","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%APPDATA%\\Microsoft\\Crypto","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%APPDATA%\\Microsoft\\Document Building Blocks","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%APPDATA%\\Microsoft\\Document Building Blocks\\1031","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%APPDATA%\\Microsoft\\Document Building Blocks\\1033","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%APPDATA%\\Microsoft\\Document Building Blocks\\1033\\14","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\UserData\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\7e4dca80246863e3\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\7e4dca80246863e3","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\UserData","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\UserData\\0LUEZ902\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\UserData\\233ZT97I\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\UserData\\7HSEVDLU\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\UserData\\RE6TVT4O\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\UserData\\0LUEZ902","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\UserData\\233ZT97I","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\SYSTEM\\","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\WdsSetupLogInit","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\SetupLog","sources":[{"report_type":"sandbox","report_id":"5a181c797ca3e1704d759163"}]}]}},"report_ids":{"sandbox_job_ids":["5a181c797ca3e1704d759163"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Trojan.Generic Sample cc4647c4370f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample cc4647c4370f…. Malware family: Trojan.Generic. Threat score 100/100. 16/29 AV engines flagged this file. 7 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/cc4647c4370f78c442f6d456a31a3a6a2fc1ab7381277fc3791d9a91fc80cf6d"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample cc4647c4370f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample cc4647c4370f…. Malware family: Trojan.Generic. Threat score 100/100. 16/29 AV engines flagged this file. 7 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/cc4647c4370f78c442f6d456a31a3a6a2fc1ab7381277fc3791d9a91fc80cf6d"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample cc4647c4370f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample cc4647c4370f…. Malware family: Trojan.Generic. Threat score 100/100. 16/29 AV engines flagged this file. 7 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]