24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T485,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample e08fc761cc22… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample e08fc761cc22…. Malware family: Trojan.Generic. Threat score 100/100. 25/27 AV engines flagged this file. 6 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e08fc761cc22953de7fcc1684b7424755fa52f361dd5c6605b1469a80cb858bb","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","e08fc761cc22953de7fcc1684b7424755fa52f361dd5c6605b1469a80cb858bb"],"about":{"@type":"SoftwareApplication","name":"sample.exe","applicationCategory":["peexe","executable"],"identifier":"e08fc761cc22953de7fcc1684b7424755fa52f361dd5c6605b1469a80cb858bb","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":25,"total":27},"behavioralIndicators":{"malicious":6,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tb2e,Spawned process "cmd.exe" with commandline "/C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\RSW7B37.tmp.exe" /f /reg:64" (UID: 00010471-00002784) Spawned process "reg.exe" with commandline "REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\RSW7B37.tmp.exe" /f /reg:64" (UID: 00010493-00002840) Spawned process "cmd.exe" with commandline "/C "%PUBLIC%\window.bat"" (UID: 00010918-00002164) Spawned process "vssadmin.exe" with commandline "vssadmin Delete Shadows /all /quiet" (UID: 00010951-00002924) Spawned process "cmd.exe" with commandline "/C %USERPROFILE%\Desktop\DECRYPT_INFORMATION.txt" (UID: 00010967-00002428) Spawned process "vssadmin.exe" with commandline "vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB" (UID: 00011010-00002308) Spawned process "vssadmin.exe" with commandline "vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded" (UID: 00011058-00001300) Spawned process "vssadmin.exe" with commandline "vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB" (UID: 00011116-00000964) Spawned process "vssadmin.exe" with commandline "vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded" (UID: 00011152-00001956) Spawned process "vssadmin.exe" with commandline "vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB" (UID: 00011184-00002612) Spawned process "vssadmin.exe" with commandline "vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded" (UID: 00011217-00001860) Spawned process "vssadmin.exe" with commandline "vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB" (UID: 00011256-00002896) Spawned process "vssadmin.exe" with commandline "vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded" (UID: 00011295-00001528) Spawned process "vssadmin.exe" with commandline "vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB" (UID: 00011352-00002084) Spawned process "vssadmin.exe" with commandline "vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded" (UID: 00011426-00002820) Spawned process "vssadmin.exe" with commandline "vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB" (UID: 00011472-00002852) Spawned process "vssadmin.exe" with commandline "vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded" (UID: 00011561-00001864) Spawned process "vssadmin.exe" with commandline "vssadmin Delete Shadows /all /quiet" (UID: 00011599-00002876) Spawned process "cmd.exe" with commandline "/C REG DELETE "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /f /reg:64" (UID: 00012505-00001600) Spawned process "reg.exe" with commandline "REG DELETE "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /f /reg:64" (UID: 00012533-00000960)26:T5aa,"HERMES 2.1 RANSOMWARE radical editionAll your important files are encryptedYour files has been encrypted using RSA2048 algorithm with unique public-key stored on your PC.There is only one way to get your files back: contact with us, pay, and g" (Source: 21459-19-00401FD5, Indicator: "files are encrypted") "HERMES 2.1 RANSOMWARE radical editionAll your important files are encryptedYour files has been encrypted using RSA2048 algorithm with unique public-key stored on your PC.There is only one way to get your files back: contact with us, pay, and get decryptor software.You have "UNIQUE_ID_DO_NOT_REMOVE" file on your desktop also it duplicated in some folders,its your unique idkey, attach it to letter when contact with us. Also you can decrypt 3 files for test.We accept Bitcoin, you can find exchangers on https://www.bitcoin.com/buy-bitcoin and others.Contact information: BM-2cVcZL1xfve1yGGKwEBgG1ge6xJ5PYGfGw@bitmessage.ch reserve: BM-2cT4U1vBdjfqKDeWMEXgCWs9SfnMK1GLTF@bitmessage.ch" (Source: 00009520-00001740.00000001.11762.00406000.00000004.mdmp, Indicator: "files are encrypted") "HERMES 2.1 RANSOMWARE radical editionAll your important files are encryptedYour files has been encrypted using RSA2048 algorithm with unique public-key stored on your PC.There is only one way to get your files back: contact with us, pay, and get d" (Source: 00009520-00001740-00000005-43845989, Indicator: "files are encrypted")27:T43b,"" wrote bytes "75349f75c0419f753e199f7577499f7526189f7500000000aefd907500000000" to virtual address "0x00404000" (part of module "RSW7B37.TMP.EXE") "" wrote bytes "711107027a3b0602ab8b02007f950200fc8c0200729602006cc805001ecd03027d260302" to virtual address "0x758B07E4" (part of module "USER32.DLL") "cmd.exe" wrote bytes "711107027a3b0602ab8b02007f950200fc8c0200729602006cc805001ecd03027d260302" to virtual address "0x758B07E4" (part of module "USER32.DLL") "reg.exe" wrote bytes "c0df8c771cf98b77ccf88b770d648d7700000000c0119f7500000000fc3e9f7500000000e0139f75000000009457f47525e08c77c6e08c7700000000bc6af37500000000cf319f75000000009319f475000000002c329f7500000000" to virtual address "0x75891000" (part of module "NSI.DLL") "reg.exe" wrote bytes "711107027a3b0602ab8b02007f950200fc8c0200729602006cc805001ecd03027d260302" to virtual address "0x758B07E4" (part of module "USER32.DLL") "vssadmin.exe" wrote bytes "711107027a3b0602ab8b02007f950200fc8c0200729602006cc805001ecd03027d260302" to virtual address "0x758B07E4" (part of module "USER32.DLL")28:Tc2f,Spawned process "" (UID: 00009520-00001740) Spawned process "cmd.exe" with commandline "/C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\RSW7B37.tmp.exe" /f /reg:64" (UID: 00010471-00002784) Spawned process "reg.exe" with commandline "REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\RSW7B37.tmp.exe" /f /reg:64" (UID: 00010493-00002840) Spawned process "cmd.exe" with commandline "/C "%PUBLIC%\window.bat"" (UID: 00010918-00002164) Spawned process "vssadmin.exe" with commandline "vssadmin Delete Shadows /all /quiet" (UID: 00010951-00002924) Spawned process "cmd.exe" with commandline "/C %USERPROFILE%\Desktop\DECRYPT_INFORMATION.txt" (UID: 00010967-00002428) Spawned process "vssadmin.exe" with commandline "vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB" (UID: 00011010-00002308) Spawned process "vssadmin.exe" with commandline "vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded" (UID: 00011058-00001300) Spawned process "vssadmin.exe" with commandline "vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB" (UID: 00011116-00000964) Spawned process "vssadmin.exe" with commandline "vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded" (UID: 00011152-00001956) Spawned process "vssadmin.exe" with commandline "vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB" (UID: 00011184-00002612) Spawned process "vssadmin.exe" with commandline "vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded" (UID: 00011217-00001860) Spawned process "vssadmin.exe" with commandline "vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB" (UID: 00011256-00002896) Spawned process "vssadmin.exe" with commandline "vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded" (UID: 00011295-00001528) Spawned process "vssadmin.exe" with commandline "vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB" (UID: 00011352-00002084) Spawned process "vssadmin.exe" with commandline "vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded" (UID: 00011426-00002820) Spawned process "vssadmin.exe" with commandline "vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB" (UID: 00011472-00002852) Spawned process "vssadmin.exe" with commandline "vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded" (UID: 00011561-00001864) Spawned process "vssadmin.exe" with commandline "vssadmin Delete Shadows /all /quiet" (UID: 00011599-00002876) Spawned process "cmd.exe" with commandline "/C REG DELETE "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /f /reg:64" (UID: 00012505-00001600) Spawned process "reg.exe" with commandline "REG DELETE "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /f /reg:64" (UID: 00012533-00000960) Spawned process "cmd.exe" with commandline "/C "C:\RSW7B37.tmpaexe.bat"" (UID: 00012582-00002524) Spawned process "timeout.exe" with commandline "TIMEOUT /T 10 /NOBREAK" (UID: 00012592-00001676)29:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"e08fc761cc22953de7fcc1684b7424755fa52f361dd5c6605b1469a80cb858bb","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790444901142,"unified_at":"2026-09-26T17:48:21.142Z","metadata":{"hashes":{"sha256":"e08fc761cc22953de7fcc1684b7424755fa52f361dd5c6605b1469a80cb858bb","sha1":"d08573c5e825b7beeb9629d03e0f8ff3cb7d1716","md5":"b27881f59c8d8cc529fa80a58709db36","sha512":"d572bfeaec1abd68c796ccd7e289c6b7f9879ea32bd72eaf8ab980fa408eb1287f74488b74cc3bdcb499e60ae4526d6e6c5a43088a29b14dd168471edf913256","ssdeep":"768:qV/3fZLqIWp1NQtGhT9zYaMg0XxS4wVex+1yIU:qVnJqIaf7R0XF2","ssdeep_chunks":["768:qV/3fZL","768:V/3fZLq","768:/3fZLqI","768:3fZLqIW","768:fZLqIWp","768:ZLqIWp1","768:LqIWp1N","768:qIWp1NQ","768:IWp1NQt","768:Wp1NQtG","768:p1NQtGh","768:1NQtGhT","768:NQtGhT9","768:QtGhT9z","768:tGhT9zY","768:GhT9zYa","768:hT9zYaM","768:T9zYaMg","768:9zYaMg0","768:zYaMg0X","768:YaMg0Xx","768:aMg0XxS","768:Mg0XxS4","768:g0XxS4w","768:0XxS4wV","768:XxS4wVe","768:xS4wVex","768:S4wVex+","768:4wVex+1","768:wVex+1y","768:Vex+1yI","768:ex+1yIU","1536:qV/3fZL","1536:V/3fZLq","1536:/3fZLqI","1536:3fZLqIW","1536:fZLqIWp","1536:ZLqIWp1","1536:LqIWp1N","1536:qIWp1NQ","1536:IWp1NQt","1536:Wp1NQtG","1536:p1NQtGh","1536:1NQtGhT","1536:NQtGhT9","1536:QtGhT9z","1536:tGhT9zY","1536:GhT9zYa","1536:hT9zYaM","1536:T9zYaMg","1536:9zYaMg0","1536:zYaMg0X","1536:YaMg0Xx","1536:aMg0XxS","1536:Mg0XxS4","1536:g0XxS4w","1536:0XxS4wV","1536:XxS4wVe","1536:xS4wVex","1536:S4wVex+","1536:4wVex+1","1536:wVex+1y","1536:Vex+1yI","1536:ex+1yIU","768:qVnJqIa","768:VnJqIaf","768:nJqIaf7","768:JqIaf7R","768:qIaf7R0","768:Iaf7R0X","768:af7R0XF","768:f7R0XF2"],"imphash":"ad1c7c17c6266b11be687fb6cf4c10e3"},"file_info":{"file_name":"sample.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":29696,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1510829403000,"last_seen":1689296791000,"last_multi_scan":1689296791000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["hermes","stardustchollima","targeted","ransomware"]},"stats":{"av":{"malicious_count":25,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":14,"suspicious_count":16,"malicious_count":6,"total":36},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Gen.tpCC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Hermesran","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.SGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.ZPACK.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.Hermes.DB4079ED","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.Agent-6349072-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.Hermes.DB4079ED (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Filecoder.Hermes.E trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/Hermes.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005185f61 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Hermez.gs","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXDK-XQ!B27881F59C8D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.fiimgy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_96","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Hermes-F","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_HERMS.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_HERMS.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Filecoder.PZXE-8809","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.PVO","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Malware-Cryptor.General.3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Gen.Win32.1501","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.DLL at 00009150-00003456-17014-29-0040326C","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5a860f507ca3e12a91797013"},{"report_type":"sandbox","report_id":"5a85e3777ca3e142a13916b3"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersionExW@KERNEL32.DLL (Target: \"e08fc761cc22953de7fcc1684b7424755fa52f361dd5c6605b1469a80cb858bb.exe\"; Stream UID: \"00009150-00003456-17014-29-0040326C\")\n which is directly followed by \"cmp dword ptr [ebp-00000110h], 05h\" and \"ret \". See related instructions: \"...+25 call 004038D0h+30 add esp, 0Ch+33 mov dword ptr [ebp-00000114h], esi+39 lea eax, dword ptr [ebp-00000114h]+45 push eax+46 call dword ptr [00408304h] ;GetVersionExW+52 xor eax, eax+54 cmp dword ptr [ebp-00000110h], 05h+61 pop esi+62 sete al+65 mov esp, ebp+67 pop ebp+68 ret \" ... at 00009150-00003456-17014-29-0040326C","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"5a860f507ca3e12a91797013"},{"report_type":"sandbox","report_id":"5a85e3777ca3e142a13916b3"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"5a860f507ca3e12a91797013"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\tech\"\n \"tech\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5a860f507ca3e12a91797013"},{"report_type":"sandbox","report_id":"5a85e3777ca3e142a13916b3"},{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameW@ADVAPI32.DLL at 00009150-00003456-17014-12-00402643\n GetUserNameW@ADVAPI32.DLL at 00009150-00003456-17014-19-00401FD5","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"5a860f507ca3e12a91797013"},{"report_type":"sandbox","report_id":"5a85e3777ca3e142a13916b3"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\System32\\rsaenh.dll\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a860f507ca3e12a91797013"},{"report_type":"sandbox","report_id":"5a85e3777ca3e142a13916b3"},{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://dmd.metaservices.microsoft.com/dms/metadata.svc\"\n Pattern match: \"http://schemas.microsoft.com/windowsmetadata/services/2007/09/18/dms/DeviceMetadataService/GetDeviceMetadata\"\n Heuristic match: \"GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1ddd7a6ed102db03 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ctldl.windowsupdate.com\"\n Heuristic match: \"GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab?d377bec2020a9083 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ctldl.windowsupdate.com\"\n Pattern match: \"http://www.symauth.com/cps0\"\n Pattern match: \"http://www.symauth.com/rpa0\"\n Heuristic match: \"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx%2BJOp7hVgTeaGFJ%2FCQgQUljtT8Hkzl699g%2B8uK8zKt4YecmYCEBuN56dlW1Lzehhu%2FtdSD3U%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: sv.symcd.com\"\n Pattern match: \"http://www.symauth.com/cps0*\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a860f507ca3e12a91797013"},{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"level":"informative","category":"Pattern Matching","name":"Code classification distribution is known to appear in malware","description":"TrID distribution is very similar to the \"CTB-Locker\" family (e.g. SHA256: cbba56bd16222191f1468a1d93b63945394371cfb9ffe38f34a9575c5655e57a)","origin":"TrID Evaluation","relevance":5,"id":"trid-0","sources":[{"report_type":"sandbox","report_id":"5a860f507ca3e12a91797013"},{"report_type":"sandbox","report_id":"5a85e3777ca3e142a13916b3"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00009150-00003456-00000105-40672976","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5a860f507ca3e12a91797013"},{"report_type":"sandbox","report_id":"5a85e3777ca3e142a13916b3"},{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5a860f507ca3e12a91797013"},{"report_type":"sandbox","report_id":"5a85e3777ca3e142a13916b3"},{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a860f507ca3e12a91797013"},{"report_type":"sandbox","report_id":"5a85e3777ca3e142a13916b3"},{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\"\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\HwOrder\" (Filter: 4; Subtree: 2147483648)","origin":"API Call","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5a860f507ca3e12a91797013"},{"report_type":"sandbox","report_id":"5a85e3777ca3e142a13916b3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"CreateThread\n GetFileSize\n VirtualAlloc\n LoadLibraryA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a860f507ca3e12a91797013"},{"report_type":"sandbox","report_id":"5a85e3777ca3e142a13916b3"},{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"50/64 Antivirus vendors marked sample as malicious (78% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a85e3777ca3e142a13916b3"},{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"50/64 Antivirus vendors marked sample as malicious (78% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a85e3777ca3e142a13916b3"},{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/C REG ADD \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"svchos\" /t REG_SZ /d \"C:\\RSW7B37.tmp.exe\" /f /reg:64\" on 2017-12-26.11:02:00.318\n \"/C \"%PUBLIC%\\window.bat\"\" on 2017-12-26.11:02:10.631\n \"/C %USERPROFILE%\\Desktop\\DECRYPT_INFORMATION.txt\" on 2017-12-26.11:02:11.826\n \"/C REG DELETE \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"svchos\" /f /reg:64\" on 2017-12-26.11:26:00.113\n \"/C \"C:\\RSW7B37.tmpaexe.bat\"\" on 2017-12-26.11:27:00.227","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$25","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"PidGenX.dll\" has type \"data\"\n \"setup.exe\" has type \"data\"\n \"ose.exe\" has type \"data\"\n \"window.bat\" has type \"ASCII text with CRLF line terminators\"\n \"RSW7B37.tmpaexe.bat\" has type \"ASCII text with CRLF line terminators\"\n \"Office32WW.msi\" has type \"data\"\n \"08e575673cce10c72090304839888e02_6b06490d-f9fd-424c-8b6d-83edc4369e89\" has type \"data\"\n \"Desktop\" has type \"empty \"\n \"UNIQUE_ID_DO_NOT_REMOVE\" has type \"data\"\n \"6de85aa230cde3e2a97eb830dd3abe8c_6b06490d-f9fd-424c-8b6d-83edc4369e89\" has type \"data\"\n \"Setup.xml\" has type \"data\"\n \"ProPlusWW.xml\" has type \"data\"\n \"pkeyconfig-office.xrm-ms\" has type \"data\"\n \"PUBLIC\" has type \"b.out executable V2.3 V3.0 86\"\n \"Office32WW.xml\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Writes to a desktop.ini file (may be used to cloak folders)","description":"\"\" wrote 144 bytes to file \"C:\\$RECYCLE.BIN\\S-1-5-21-686412048-2446563785-1323799475-1001\\DESKTOP.INI\" (Byte Offset: 0): ws�\n \"\" wrote 6 bytes to file \"C:\\$RECYCLE.BIN\\S-1-5-21-686412048-2446563785-1323799475-1001\\DESKTOP.INI\" (Byte Offset: 144): HERMES\n \"\" wrote 268 bytes to file \"C:\\$RECYCLE.BIN\\S-1-5-21-686412048-2446563785-1323799475-1001\\DESKTOP.INI\" (Byte Offset: 150): f�T4��;�g��'�V��i�9��1��25��K�̌��Qu'GV��?��+�Tk�q��:��E�I�� `��'�Ho��~��'�'֐�s��/h��敼��:�tj��ܞ��(ٸ�?�T�>k($D�R�z�;��l��π8�1ѽ��g��i�CJ��N>��MP��I�HY;�>��\"�.�d��8��<��Ţb��Uh��y, \"\" wrote to file \"C:\\$Recycle.Bin\\S-1-5-21-686412048-2446563785-1323799475-1001\\desktop.ini\"","origin":"API Call","relevance":3,"id":"api-34","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)\n \"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_ENUMERATE_SERVICE\" (0x4)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"\n \"\" read file \"C:\\$Recycle.Bin\\S-1-5-21-686412048-2446563785-1323799475-1001\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"\" called \"OpenService\" to access the \"LanmanServer\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"\" called \"OpenService\" to access the \"LanmanWorkstation\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"PUBLIC\" has type \"b.out executable V2.3 V3.0 86\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"reg.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"reg.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"SVCHOS\"; Value: \"C:\\RSW7B37.tmp.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"$26","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$27","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"4/58 Antivirus vendors marked dropped file \"window.bat\" as malicious (classified as \"Other:Malware\" with 6% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"level":"malicious","category":"General","name":"Tries to delete registry keys using reg.exe","description":"Process \"cmd.exe\" with commandline \"/C REG DELETE \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"svchos\" /f /reg:64\" (UID: 00012505-00001600)\n Process \"reg.exe\" with commandline \"REG DELETE \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"svchos\" /f /reg:64\" (UID: 00012533-00000960)","origin":"Monitored Target","relevance":5,"id":"target-24","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"vssadmin Delete Shadows /all /quiet\" (UID: 00010951-00002924)\n Deletes volume snapshots files \"vssadmin.exe\" with commandline \"vssadmin Delete Shadows /all /quiet\" (UID: 00011599-00002876)","origin":"Monitored Target","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$28","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]}],"incidents":[{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5a860f507ca3e12a91797013"},{"report_type":"sandbox","report_id":"5a85e3777ca3e142a13916b3"},{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"name":"Ransomware","details_count":2,"details":[{"detail":"Deletes volume snapshots (often used by ransomware)"},{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]}]},"activity":{"stats":{"process_count":23,"spawned_processes_count":23,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":70,"dropped_files_count":0,"extracted_files_count":14,"files_written_count":50,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":1,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["hermes","stardustchollima","targeted","ransomware"],"sample_flags":["Extracted Files","Sample not shared"],"sandbox_reports":[{"id":"5a860f507ca3e12a91797013","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":18,"submit_name":"sample.exe","analysis_start_time":"2018-02-15T23:58:43+00:00","indicators_count":{"informative":8,"suspicious":5,"malicious":0},"is_in_unified_schema":true},{"id":"5a85e3777ca3e142a13916b3","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":88,"malware_family":"Trojan.Generic","submit_name":"sample.exe","analysis_start_time":"2018-02-15T23:05:53+00:00","indicators_count":{"informative":6,"suspicious":5,"malicious":3},"is_in_unified_schema":true},{"id":"5a4219307ca3e154a6317356","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"OTX_e08fc761cc22953de7fcc1684b7424755fa52f361dd5c6605b1469a80cb858bb","analysis_start_time":"2017-12-26T11:00:24+00:00","indicators_count":{"informative":9,"suspicious":17,"malicious":9},"tags":["Extracted Files","Sample not shared"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}],"processes":[{"pid":1740,"ppid":0,"name":"RSW7B37.tmp.exe","command_line":"","sha256":"e08fc761cc22953de7fcc1684b7424755fa52f361dd5c6605b1469a80cb858bb","normalized_path":"C:\\RSW7B37.tmp.exe","uid":"00009520-00001740","icon":"$29"},{"pid":2784,"ppid":1740,"name":"cmd.exe","command_line":"/C REG ADD \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"svchos\" /t REG_SZ /d \"C:\\RSW7B37.tmp.exe\" /f /reg:64","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00009520-00001740","uid":"00010471-00002784"},{"pid":2840,"ppid":2784,"name":"reg.exe","command_line":"REG ADD \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"svchos\" /t REG_SZ /d \"C:\\RSW7B37.tmp.exe\" /f /reg:64","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","normalized_path":"%WINDIR%\\SysWOW64\\reg.exe","parent_uid":"00010471-00002784","uid":"00010493-00002840"},{"pid":2164,"ppid":1740,"name":"cmd.exe","command_line":"/C \"%PUBLIC%\\window.bat\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00009520-00001740","uid":"00010918-00002164"},{"pid":2924,"ppid":2164,"name":"vssadmin.exe","command_line":"vssadmin Delete Shadows /all /quiet","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","normalized_path":"%WINDIR%\\SysWOW64\\vssadmin.exe","parent_uid":"00010918-00002164","uid":"00010951-00002924"},{"pid":2308,"ppid":2164,"name":"vssadmin.exe","command_line":"vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","normalized_path":"%WINDIR%\\SysWOW64\\vssadmin.exe","parent_uid":"00010918-00002164","uid":"00011010-00002308"},{"pid":1300,"ppid":2164,"name":"vssadmin.exe","command_line":"vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","normalized_path":"%WINDIR%\\SysWOW64\\vssadmin.exe","parent_uid":"00010918-00002164","uid":"00011058-00001300"},{"pid":964,"ppid":2164,"name":"vssadmin.exe","command_line":"vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","normalized_path":"%WINDIR%\\SysWOW64\\vssadmin.exe","parent_uid":"00010918-00002164","uid":"00011116-00000964"},{"pid":1956,"ppid":2164,"name":"vssadmin.exe","command_line":"vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","normalized_path":"%WINDIR%\\SysWOW64\\vssadmin.exe","parent_uid":"00010918-00002164","uid":"00011152-00001956"},{"pid":2612,"ppid":2164,"name":"vssadmin.exe","command_line":"vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","normalized_path":"%WINDIR%\\SysWOW64\\vssadmin.exe","parent_uid":"00010918-00002164","uid":"00011184-00002612"},{"pid":1860,"ppid":2164,"name":"vssadmin.exe","command_line":"vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","normalized_path":"%WINDIR%\\SysWOW64\\vssadmin.exe","parent_uid":"00010918-00002164","uid":"00011217-00001860"},{"pid":2896,"ppid":2164,"name":"vssadmin.exe","command_line":"vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","normalized_path":"%WINDIR%\\SysWOW64\\vssadmin.exe","parent_uid":"00010918-00002164","uid":"00011256-00002896"},{"pid":1528,"ppid":2164,"name":"vssadmin.exe","command_line":"vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","normalized_path":"%WINDIR%\\SysWOW64\\vssadmin.exe","parent_uid":"00010918-00002164","uid":"00011295-00001528"},{"pid":2084,"ppid":2164,"name":"vssadmin.exe","command_line":"vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","normalized_path":"%WINDIR%\\SysWOW64\\vssadmin.exe","parent_uid":"00010918-00002164","uid":"00011352-00002084"},{"pid":2820,"ppid":2164,"name":"vssadmin.exe","command_line":"vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","normalized_path":"%WINDIR%\\SysWOW64\\vssadmin.exe","parent_uid":"00010918-00002164","uid":"00011426-00002820"},{"pid":2852,"ppid":2164,"name":"vssadmin.exe","command_line":"vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","normalized_path":"%WINDIR%\\SysWOW64\\vssadmin.exe","parent_uid":"00010918-00002164","uid":"00011472-00002852"},{"pid":1864,"ppid":2164,"name":"vssadmin.exe","command_line":"vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","normalized_path":"%WINDIR%\\SysWOW64\\vssadmin.exe","parent_uid":"00010918-00002164","uid":"00011561-00001864"},{"pid":2876,"ppid":2164,"name":"vssadmin.exe","command_line":"vssadmin Delete Shadows /all /quiet","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","normalized_path":"%WINDIR%\\SysWOW64\\vssadmin.exe","parent_uid":"00010918-00002164","uid":"00011599-00002876"},{"pid":2428,"ppid":1740,"name":"cmd.exe","command_line":"/C %USERPROFILE%\\Desktop\\DECRYPT_INFORMATION.txt","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00009520-00001740","uid":"00010967-00002428"},{"pid":1600,"ppid":1740,"name":"cmd.exe","command_line":"/C REG DELETE \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"svchos\" /f /reg:64","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00009520-00001740","uid":"00012505-00001600"},{"pid":960,"ppid":1600,"name":"reg.exe","command_line":"REG DELETE \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"svchos\" /f /reg:64","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","normalized_path":"%WINDIR%\\SysWOW64\\reg.exe","parent_uid":"00012505-00001600","uid":"00012533-00000960"},{"pid":2524,"ppid":1740,"name":"cmd.exe","command_line":"/C \"C:\\RSW7B37.tmpaexe.bat\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00009520-00001740","uid":"00012582-00002524"},{"pid":1676,"ppid":2524,"name":"timeout.exe","command_line":"TIMEOUT /T 10 /NOBREAK","sha256":"c4efafc49d46dba7e89cd94892799c739a3103f724fec9be494bf1267fdb059e","normalized_path":"%WINDIR%\\SysWOW64\\timeout.exe","parent_uid":"00012582-00002524","uid":"00012592-00001676"}],"all_imported_dlls":["advapi32.dll","sechost.dll","ntdll.dll","msvcrt.dll","mpr.dll","kernel32.dll","KernelBase.dll","rpcrt4.dll","shell32.dll","rsaenh.dll","user32.dll","gdi32.dll","usp10.dll","imm32.dll","msctf.dll","ole32.dll","shlwapi.dll","cryptsp.dll","lpk.dll","userenv.dll","profapi.dll","winsta.dll","ntlanman.dll","devobj.dll","normaliz.dll","cfgmgr32.dll","netutils.dll","wow64.dll","browcli.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","api-ms-win-downlevel-user32-l1-1-0.dll","wow64cpu.dll","drprov.dll","davclnt.dll","vsstrace.dll","uxtheme.dll","setupapi.dll","davhlpr.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","wininet.dll","ws2_32.dll","cscapi.dll","urlmon.dll","msasn1.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","vssapi.dll","comctl32.dll","Wldap32.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","secur32.dll","atl.dll","sspicli.dll","cryptbase.dll","crypt32.dll","apphelp.dll","srvcli.dll","version.dll","oleaut32.dll","wow64win.dll","ntmarta.dll","wkscli.dll","winbrand.dll","clbcatq.dll","dwmapi.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","nsi.dll","propsys.dll","iertutil.dll","RpcRtRemote.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"window.bat","sha256":"8940135a58d28338ce4ea9b9933e6780507c56ab37a2f2e3a1a98c6564548a12","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"name":"PUBLIC","sha256":"bf9e537442d584bc8f24398e7c2ecdf12b28ec07cfb476f64fc14c910cf62710","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"name":"RSW7B37.tmpaexe.bat","sha256":"dfe0334a38c7136f7b7dcd4da261ef065b15f42efca052e355e8107be8637c63","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"name":"08e575673cce10c72090304839888e02_6b06490d-f9fd-424c-8b6d-83edc4369e89","sha256":"a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"name":"6de85aa230cde3e2a97eb830dd3abe8c_6b06490d-f9fd-424c-8b6d-83edc4369e89","sha256":"9de15a4bb0f2c9eb87cd66fde3d65f1c78a11000e11e83e14c251c405b58eb06","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"name":"UNIQUE_ID_DO_NOT_REMOVE","sha256":"48138e744919d5e6e84001cb4a73111c02ccc3ace435aaaa2db7b1acd4f6144f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"name":"Office32WW.msi","sha256":"75503eed39db35e626bf52d2cdbd6ce88e6ab5262ad79b68d7a1f2e170804ce9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"name":"Office32WW.xml","sha256":"671c8d9c7675e0e130411f1078f747d13323d4b06c7c6145db1402c0f743ac6e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"name":"PidGenX.dll","sha256":"b90cec10a8b19b97ada84cf94c09dbe07fd06170256092fea5b48eadf8efc80e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"name":"ose.exe","sha256":"353f51d9d9ccd93dff561c57a4b0a1114f5479e1333141e65d3b88c6000a5078","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"name":"pkeyconfig-office.xrm-ms","sha256":"ec667adba2059282e39856c799b2fc55a24ba5fa4484b604901fc2d4ab1df3d8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"name":"setup.exe","sha256":"9d03abc23be809a5e2b6f73d12b57b3864dc1c0be86748402bf1f5c37940ab1e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"name":"Setup.xml","sha256":"0025d82df3686eb3784f8880a1e24c7966c695ab080fb52ba20de926cd9464b2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"name":"ProPlusWW.xml","sha256":"0638fb0d557713ff5a813e2ae8c92642689224db897e77afc8ab99d8b84c7ff8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]}],"files_written":[{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a860f507ca3e12a91797013"},{"report_type":"sandbox","report_id":"5a85e3777ca3e142a13916b3"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5a860f507ca3e12a91797013"},{"report_type":"sandbox","report_id":"5a85e3777ca3e142a13916b3"},{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"%APPDATA%\\Microsoft\\Crypto","sources":[{"report_type":"sandbox","report_id":"5a860f507ca3e12a91797013"},{"report_type":"sandbox","report_id":"5a85e3777ca3e142a13916b3"},{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA","sources":[{"report_type":"sandbox","report_id":"5a860f507ca3e12a91797013"},{"report_type":"sandbox","report_id":"5a85e3777ca3e142a13916b3"},{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"5a860f507ca3e12a91797013"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-2092356043-4041700817-663127204-1001\\6de85aa230cde3e2a97eb830dd3abe8c_733c94c5-cebb-4f98-a75f-22a797d1d50b","sources":[{"report_type":"sandbox","report_id":"5a860f507ca3e12a91797013"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"5a860f507ca3e12a91797013"},{"report_type":"sandbox","report_id":"5a85e3777ca3e142a13916b3"},{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5a860f507ca3e12a91797013"},{"report_type":"sandbox","report_id":"5a85e3777ca3e142a13916b3"},{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto","sources":[{"report_type":"sandbox","report_id":"5a860f507ca3e12a91797013"},{"report_type":"sandbox","report_id":"5a85e3777ca3e142a13916b3"},{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto\\RSA","sources":[{"report_type":"sandbox","report_id":"5a860f507ca3e12a91797013"},{"report_type":"sandbox","report_id":"5a85e3777ca3e142a13916b3"},{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto\\RSA\\MachineKeys","sources":[{"report_type":"sandbox","report_id":"5a860f507ca3e12a91797013"},{"report_type":"sandbox","report_id":"5a85e3777ca3e142a13916b3"},{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto\\RSA\\MachineKeys\\6de85aa230cde3e2a97eb830dd3abe8c_733c94c5-cebb-4f98-a75f-22a797d1d50b","sources":[{"report_type":"sandbox","report_id":"5a860f507ca3e12a91797013"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5a85e3777ca3e142a13916b3"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000\\6de85aa230cde3e2a97eb830dd3abe8c_e47c61d2-1dae-480e-827a-ae8d797649df","sources":[{"report_type":"sandbox","report_id":"5a85e3777ca3e142a13916b3"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto\\RSA\\MachineKeys\\6de85aa230cde3e2a97eb830dd3abe8c_e47c61d2-1dae-480e-827a-ae8d797649df","sources":[{"report_type":"sandbox","report_id":"5a85e3777ca3e142a13916b3"}]},{"path":"%WINDIR%\\SysWOW64\\crypt32.dll","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto\\RSA\\MachineKeys\\6de85aa230cde3e2a97eb830dd3abe8c_6b06490d-f9fd-424c-8b6d-83edc4369e89","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-686412048-2446563785-1323799475-1001\\6de85aa230cde3e2a97eb830dd3abe8c_6b06490d-f9fd-424c-8b6d-83edc4369e89","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto\\RSA\\MachineKeys\\08e575673cce10c72090304839888e02_6b06490d-f9fd-424c-8b6d-83edc4369e89","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"%PUBLIC%\\PUBLIC","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"C:\\$Recycle.Bin\\UNIQUE_ID_DO_NOT_REMOVE","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"C:\\$Recycle.Bin\\S-1-5-21-686412048-2446563785-1323799475-1001\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"C:\\1514282456239$MAPFAILURE","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"C:\\1514282456239$OK","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"C:\\UNIQUE_ID_DO_NOT_REMOVE","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"C:\\MSOCache\\UNIQUE_ID_DO_NOT_REMOVE","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"%PUBLIC%\\UNIQUE_ID_DO_NOT_REMOVE","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"C:\\MSOCache\\All Users\\UNIQUE_ID_DO_NOT_REMOVE","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusWW.msi","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"\\.\\.","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-686412048-2446563785-1323799475-1001\\08e575673cce10c72090304839888e02_6b06490d-f9fd-424c-8b6d-83edc4369e89","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"%USERPROFILE%\\Desktop\\UNIQUE_ID_DO_NOT_REMOVE","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"%USERPROFILE%\\Desktop","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"%WINDIR%\\SysWOW64\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"%WINDIR%\\SysWOW64\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"path":"%PUBLIC%\\window.bat","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\SVCHOS\\SVCHOS","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\tech","sources":[{"report_type":"sandbox","report_id":"5a860f507ca3e12a91797013"},{"report_type":"sandbox","report_id":"5a85e3777ca3e142a13916b3"},{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"name":"tech","sources":[{"report_type":"sandbox","report_id":"5a860f507ca3e12a91797013"},{"report_type":"sandbox","report_id":"5a85e3777ca3e142a13916b3"},{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a4219307ca3e154a6317356"}]}]}},"report_ids":{"sandbox_job_ids":["5a4219307ca3e154a6317356","5a85e3777ca3e142a13916b3","5a860f507ca3e12a91797013"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample e08fc761cc22… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample e08fc761cc22…. Malware family: Trojan.Generic. Threat score 100/100. 25/27 AV engines flagged this file. 6 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/e08fc761cc22953de7fcc1684b7424755fa52f361dd5c6605b1469a80cb858bb"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample e08fc761cc22… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample e08fc761cc22…. Malware family: Trojan.Generic. Threat score 100/100. 25/27 AV engines flagged this file. 6 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/e08fc761cc22953de7fcc1684b7424755fa52f361dd5c6605b1469a80cb858bb"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample e08fc761cc22… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample e08fc761cc22…. Malware family: Trojan.Generic. Threat score 100/100. 25/27 AV engines flagged this file. 6 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]