24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 27:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T49c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.BTCWare.Generic Sample e27fc6bb3b7c… — Score 52/100 — Hybrid Analysis","description":"Malicious verdict for sample e27fc6bb3b7c…. Malware family: Ransom.BTCWare.Generic. Threat score 52/100. 18/26 AV engines flagged this file. 0 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e27fc6bb3b7cc8cd88976130baa065879e4bd5f2f64a5af2d3a12447064bfa19","keywords":["Malicious","Ransom.BTCWare.Generic","malware analysis","sandbox report","threat intelligence","e27fc6bb3b7cc8cd88976130baa065879e4bd5f2f64a5af2d3a12447064bfa19"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"e27fc6bb3b7cc8cd88976130baa065879e4bd5f2f64a5af2d3a12447064bfa19","additionalType":"Malicious sample"},"threatScore":52,"malwareFamily":"Ransom.BTCWare.Generic","antivirusDetections":{"malicious":18,"total":26},"behavioralIndicators":{"malicious":0,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T686,"" opened "C:\1516635744827$MAPFAILURE" with delete access "" opened "C:\1516635744827$OK" with delete access "" opened "C:\autoexec.bat" with delete access "" opened "C:\config.sys" with delete access "" opened "C:\Recovery\72d3f4c2-b53f-11e4-b6d9-9157ca704b30\boot.sdi" with delete access "" opened "C:\Recovery\72d3f4c2-b53f-11e4-b6d9-9157ca704b30\Winre.wim" with delete access "" opened "C:\Users\desktop.ini" with delete access "" opened "C:\Users\%OSUSER%\Contacts\desktop.ini" with delete access "" opened "C:\Users\%OSUSER%\Contacts\%OSUSER%.contact" with delete access "" opened "C:\Users\%OSUSER%\Desktop\Calculator.lnk" with delete access "" opened "C:\Users\%OSUSER%\Desktop\desktop.ini" with delete access "" opened "C:\Users\%OSUSER%\Desktop\MineSweeper.lnk" with delete access "" opened "C:\Users\%OSUSER%\Desktop\Paint.lnk" with delete access "" opened "C:\Users\%OSUSER%\Desktop\Sticky Notes.lnk" with delete access "" opened "C:\Users\%OSUSER%\Desktop\Windows Media Player.lnk" with delete access "" opened "C:\Users\%OSUSER%\Desktop background.png" with delete access "" opened "C:\Users\%OSUSER%\Documents\desktop.ini" with delete access "" opened "C:\Users\%OSUSER%\Downloads\01dMtnkBz9.gif" with delete access "" opened "C:\Users\%OSUSER%\Downloads\04bZ.txt" with delete access "" opened "C:\Users\%OSUSER%\Downloads\07Y08HBp.txt" with delete access26:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"e27fc6bb3b7cc8cd88976130baa065879e4bd5f2f64a5af2d3a12447064bfa19","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":52,"unified_at_epoch_ms":1790476841283,"unified_at":"2026-09-27T02:40:41.283Z","metadata":{"hashes":{"sha256":"e27fc6bb3b7cc8cd88976130baa065879e4bd5f2f64a5af2d3a12447064bfa19","sha1":"514ae98d22a06664a68eb70285a3f63157f27adc","md5":"c80ea6a8b0c010aed7248d0ae3d1c7ac","sha512":"7bf508f4e3788039dbd068382ddf99b790233f4391718a7e76211c89a2671cf8e8e7397613211e5512991e3efa728dae9bfe454612f7d06e0c23f0064f4a0c58","ssdeep":"6144:um/EdTRN71O6y6ySme2SHrHj5jb33fI0Ao88goAQZpOWKu+yLENm2eK7mnoUSgpA:HEdTRv86XwMnnXxMccxB+GwW","ssdeep_chunks":["6144:um/EdTR","6144:m/EdTRN","6144:/EdTRN7","6144:EdTRN71","6144:dTRN71O","6144:TRN71O6","6144:RN71O6y","6144:N71O6y6","6144:71O6y6y","6144:1O6y6yS","6144:O6y6ySm","6144:6y6ySme","6144:y6ySme2","6144:6ySme2S","6144:ySme2SH","6144:Sme2SHr","6144:me2SHrH","6144:e2SHrHj","6144:2SHrHj5","6144:SHrHj5j","6144:HrHj5jb","6144:rHj5jb3","6144:Hj5jb33","6144:j5jb33f","6144:5jb33fI","6144:jb33fI0","6144:b33fI0A","6144:33fI0Ao","6144:3fI0Ao8","6144:fI0Ao88","6144:I0Ao88g","6144:0Ao88go","6144:Ao88goA","6144:o88goAQ","6144:88goAQZ","6144:8goAQZp","6144:goAQZpO","6144:oAQZpOW","6144:AQZpOWK","6144:QZpOWKu","6144:ZpOWKu+","6144:pOWKu+y","6144:OWKu+yL","6144:WKu+yLE","6144:Ku+yLEN","6144:u+yLENm","6144:+yLENm2","6144:yLENm2e","6144:LENm2eK","6144:ENm2eK7","6144:Nm2eK7m","6144:m2eK7mn","6144:2eK7mno","6144:eK7mnoU","6144:K7mnoUS","6144:7mnoUSg","6144:mnoUSgp","6144:noUSgpA","12288:um/EdTR","12288:m/EdTRN","12288:/EdTRN7","12288:EdTRN71","12288:dTRN71O","12288:TRN71O6","12288:RN71O6y","12288:N71O6y6","12288:71O6y6y","12288:1O6y6yS","12288:O6y6ySm","12288:6y6ySme","12288:y6ySme2","12288:6ySme2S","12288:ySme2SH","12288:Sme2SHr","12288:me2SHrH","12288:e2SHrHj","12288:2SHrHj5","12288:SHrHj5j","12288:HrHj5jb","12288:rHj5jb3","12288:Hj5jb33","12288:j5jb33f","12288:5jb33fI","12288:jb33fI0","12288:b33fI0A","12288:33fI0Ao","12288:3fI0Ao8","12288:fI0Ao88","12288:I0Ao88g","12288:0Ao88go","12288:Ao88goA","12288:o88goAQ","12288:88goAQZ","12288:8goAQZp","12288:goAQZpO","12288:oAQZpOW","12288:AQZpOWK","12288:QZpOWKu","12288:ZpOWKu+","12288:pOWKu+y","12288:OWKu+yL","12288:WKu+yLE","12288:Ku+yLEN","12288:u+yLENm","12288:+yLENm2","12288:yLENm2e","12288:LENm2eK","12288:ENm2eK7","12288:Nm2eK7m","12288:m2eK7mn","12288:2eK7mno","12288:eK7mnoU","12288:K7mnoUS","12288:7mnoUSg","12288:mnoUSgp","12288:noUSgpA","6144:HEdTRv8","6144:EdTRv86","6144:dTRv86X","6144:TRv86Xw","6144:Rv86XwM","6144:v86XwMn","6144:86XwMnn","6144:6XwMnnX","6144:XwMnnXx","6144:wMnnXxM","6144:MnnXxMc","6144:nnXxMcc","6144:nXxMccx","6144:XxMccxB","6144:xMccxB+","6144:MccxB+G","6144:ccxB+Gw","6144:cxB+GwW"],"imphash":"642557dcee45d85cc97bb1bdaa19e76d"},"file_info":{"file_name":"file","file_type":["peexe","executable"],"file_type_id":"exe","file_size":265728,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1516636083000,"last_seen":1629574966000,"last_multi_scan":1629574966000}},"detections":{"summary":{"verdict":"malicious","score":52,"tags":["ransomware"]},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":10,"suspicious_count":11,"malicious_count":0,"total":21},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"Ahnlab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/Win32.AGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/DelFile.xveoe","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"BitDefender","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.BTCWare.0AF2E2CF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.BTCWare.0AF2E2CF (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Filecoder.NPD trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/BTCware.d","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"Ikarus","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.FileCrypter","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.cyn","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.DelFile.exdfii","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":" Ransom.DeusCrypt.S1821434","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Ransom-EUZ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"TrendMicro","success":true,"verdict":"malicious","threat_name":"Ransom_.161F9FAD","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"TrendMicro House Call","success":true,"verdict":"malicious","threat_name":"Ransom_.161F9FAD","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.BTCWare.POI","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xviruspersonalguard":{"name":"Xvirus Personal Guard","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom.BTCWare.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 64908-2044-0040F9DC\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00014642-00003096-3942-2-000CF8C0\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00014642-00003096-3942-83-000D62AA\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00014642-00003096-3942-363-000CF518\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00014642-00003096-3942-1429-000CF9DC","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00014642-00003096-3942-8-000CEE2B\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00014642-00003096-3942-558-000DD370","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"EnumSystemLocalesW@KERNEL32.DLL at 00014642-00003096-3942-351-000E673D\n EnumSystemLocalesW@KERNEL32.DLL at 00014642-00003096-3942-313-000DCD39\n EnumSystemLocalesW@KERNEL32.DLL at 00014642-00003096-3942-354-000E66A2\n GetUserDefaultLCID@KERNEL32.DLL at 00014642-00003096-3942-349-000E6D1F\n EnumSystemLocalesW@KERNEL32.DLL at 00014642-00003096-3942-350-000E6657\n GetUserDefaultLCID@KERNEL32.DLL at 00014642-00003096-3942-319-000DD3C6","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 64908-2082-00421286\n GetProcessHeap@KERNEL32.DLL at 00014642-00003096-3942-1463-000E1286","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"\\kript dekript\\desuCrypt-master\\Release\\desuCrypt.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"autoexec.bat\" has type \"data\"\n \"9rNtWnjTq9RGbU.exe\" has type \"data\"\n \"Calculator.lnk\" has type \"empty\"\n \"MineSweeper.lnk\" has type \"empty\"\n \"Paint.lnk\" has type \"empty\"\n \"Sticky Notes.lnk\" has type \"empty\"\n \"Windows Media Player.lnk\" has type \"empty\"\n \"Adobe Reader XI.lnk\" has type \"data\"\n \"yZw6snqBQ28DAzu.exe\" has type \"data\"\n \"MineSweeper.lnk\" has type \"data\"\n \"rRgk91Ih5n.doc\" has type \"data\"\n \"dH1rDN9f9.doc\" has type \"data\"\n \"6SZfLTu9z.doc\" has type \"data\"\n \"lCEf83Wf7e4nuIMk.doc\" has type \"data\"\n \"C04T72pR0Bcl.doc\" has type \"data\"\n \"Desktop.lnk\" has type \"data\"\n \"w5JaoO.doc\" has type \"data\"\n \"6WMjwc1zqk3IB.exe\" has type \"data\"\n \"tDUzYwYK5f.exe\" has type \"data\"\n \"kdo6iAicsoicvHg.exe\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"\" touched file \"%WINDIR%\\System32\\rsaenh.dll\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"e27fc6bb3b7cc8cd88976130baa065879e4bd5f2f64a5af2d3a12447064bfa19.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00014642-00003096-00000105-40977392","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 15 calls to GetProcAddress@KERNEL32.dll at 64908-2075-0040E849\n Found 25 calls to GetProcAddress@KERNEL32.dll at 64908-1507-0040E995\n Found 14 calls to GetProcAddress@KERNEL32.DLL at 00014642-00003096-3942-1453-000CE849\n Found 26 calls to GetProcAddress@KERNEL32.DLL at 00014642-00003096-3942-1097-000CE995","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"DES\" (Indicator: \"des\"; File: \"e27fc6bb3b7cc8cd88976130baa065879e4bd5f2f64a5af2d3a12447064bfa19.exe.bin\")","origin":"File/Memory","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00014642-00003096-3942-611-000CF717","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a dropped file containing the Windows username (possible fingerprint attempt)","description":"Found dropped filename \"PSPUBWS.contact\" containing the Windows username \"PSPUBWS\"","origin":"Binary File","relevance":5,"id":"binary-19","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Users\\%OSUSER%\\Contacts\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Documents\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Downloads\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"\"All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail rememberggg@tutanota.com.You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files.${KEY}\" (Source: e27fc6bb3b7cc8cd88976130baa065879e4bd5f2f64a5af2d3a12447064bfa19.exe.bin, Indicator: \"files have been encrypted\")\n \"All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail rememberggg@tutanota.com.You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After paymen\" (Source: 64908-432-00401790, Indicator: \"files have been encrypted\")","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$25","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"CryptEncrypt\n FindFirstFileW\n GetModuleFileNameA\n UnhandledExceptionFilter\n GetCommandLineW\n LoadLibraryExW\n GetStartupInfoW\n GetCommandLineA\n GetProcAddress\n FindFirstFileExA\n FindNextFileW\n WriteFile\n FindNextFileA\n GetModuleHandleW\n TerminateProcess\n GetModuleHandleExW\n CreateFileW\n IsDebuggerPresent\n Sleep\n ShellExecuteW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Opens many files with write access (often indicator for full-system infection)","description":"\"\" opens more than 500 files with write access","origin":"API Call","relevance":10,"id":"api-49","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Found a dropped file containing the Windows username (possible fingerprint attempt)"},{"detail":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":36,"dropped_files_count":0,"extracted_files_count":55,"files_written_count":14,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ransomware"],"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"5a6606607ca3e164b56e6265","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"suspicious","threat_score":52,"submit_name":"e27fc6bb3b7cc8cd88976130baa065879e4bd5f2f64a5af2d3a12447064bfa19","analysis_start_time":"2018-01-22T16:42:03+00:00","indicators_count":{"informative":10,"suspicious":12,"malicious":0},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}],"processes":[{"pid":3096,"ppid":0,"name":"e27fc6bb3b7cc8cd88976130baa065879e4bd5f2f64a5af2d3a12447064bfa19.exe","command_line":"","sha256":"e27fc6bb3b7cc8cd88976130baa065879e4bd5f2f64a5af2d3a12447064bfa19","normalized_path":"C:\\e27fc6bb3b7cc8cd88976130baa065879e4bd5f2f64a5af2d3a12447064bfa19.exe","uid":"00014642-00003096","icon":"$26"}],"all_imported_dlls":["sechost.dll","uxtheme.dll","ieframe.dll","iertutil.dll","cryptsp.dll","kernel32.dll","advapi32.dll","user32.dll","oleacc.dll","urlmon.dll","wininet.dll","msasn1.dll","rpcss.dll","cryptbase.dll","propsys.dll","psapi.dll","msctf.dll","KernelBase.dll","msvcrt.dll","rpcrt4.dll","crypt32.dll","oleaut32.dll","clbcatq.dll","rsaenh.dll","ntdll.dll","gdi32.dll","ole32.dll","shell32.dll","shlwapi.dll","lpk.dll","usp10.dll","imm32.dll","oleaccrc.dll","mpr.dll","comctl32.dll","apphelp.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Desktop background.png","sha256":"be4007266799e3121deb55068dea1a2cf719d8d0e8bc4c7a458c2093c4ce8d6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"Calculator.lnk","sha256":"a912e9e4e4b52ef32725ec3d21d03fd81cbf9d57934e7d143e3c2d73b5abf66b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"MineSweeper.lnk","sha256":"a5d4a01a2683a6502c59af25922896e8022e6120b00b7349b27c2b62615584fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"Paint.lnk","sha256":"8ff2ca5594af087a1f0f6fe1094828170b69c8a0e7002874a75e8bc7198eea16","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"Sticky Notes.lnk","sha256":"4376e2e455581beb1663ad67c380e86598051a649f930a5290900279fbe0d521","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"Windows Media Player.lnk","sha256":"90027d35569f096eedfd33f6da802035e49e25f3592520cc897f02eb88e623b4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"Adobe Reader XI.lnk","sha256":"68b017baa4ba6f244393c54020d0bdda7c623ea1f34728404018470a0d8e5da5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"Google Chrome.lnk","sha256":"079de52d882d6ab93b24947f920f6ffdba2e8b00d16b9ddfc24b83c5f55edfe0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"Mozilla Firefox.lnk","sha256":"af68221e386e6b3f6024171238850b16f92b3a4ee8a09a5097aff4e13c0d5017","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"RecordedTV.library-ms","sha256":"bdc0c826b208392f20169562c20fdb134aa7acfd7ec956d2a8c15b3c00357a30","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"Maid with the Flaxen Hair.mp3","sha256":"9a768ee945938f34bbca8fa3591c0400ae629f282081d54ebc4042b04e22f9c4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"Sleep Away.mp3","sha256":"b52a2164bad9d90ed62195b37335e6e7e126103a549e8b7a0e20b6f53d9bf99e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"Chrysanthemum.jpg","sha256":"66ee115f59bcbb78813e593ac653d5fd4b6271df7beb4ed7a2fe9d960a48bf5a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"Desert.jpg","sha256":"12f1aa00aebf3a0a2a717fe1e35c7402ea2243448a6b69730f39748ef1b3404f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"Hydrangeas.jpg","sha256":"2b043ab2216c8747aa09151891d869678bf8dfc5443d81309aa5c7ed0433aa9b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"Jellyfish.jpg","sha256":"7b779bfab92b84b01fc1eab8a340da6c63f6b8e71cacb5b5ff70d6a8a9623d17","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"Koala.jpg","sha256":"099f6f5afbbd3e8da0b80e99700a591406e862a7bf7db086d8493f6c4a3a2eb9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"Lighthouse.jpg","sha256":"87e9fc24a701241a47d6cf3b7dbb689ff5ed904ca74a228c435c5cd9d59befdb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"Penguins.jpg","sha256":"598e8b55b3919e7a0ebfb5b3f181b5cb1587f9e19b33a1f3da18a49a2b6f509c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"Tulips.jpg","sha256":"68c5d61ff1d4757a6a4528f7559d8a13aceca26aba02cf68d947d0170b890c7c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"PSPUBWS.contact","sha256":"121dc79e6fea6f37c0e0bc7a3c555a78ab6592cadd6f6b34cd900de9ef482c56","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"0gakl8ixtWMkw.doc","sha256":"805bb8b936aebb3154f21bb026b3a633c0614d8ba89886821414288f8a85b46f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"0pYWspjURe8aqA.exe","sha256":"ab0ef4a287fb14f017b8acf3d66c3363469dfe337ec6977576cd8ca0018cf1d9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"0zIG0D.doc","sha256":"e7c0b4acd223537359424abc91870fce3b2636699492f6e93f6ba849ffa7e8a4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"5F1yaAIKfUGQcmmt.doc","sha256":"9ca39b4183c5a0e237b9fb5908b878ca94920907ee9c3a9d91a17be695a9cdb4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"63sDzrkUoHoRT.exe","sha256":"98559f2d21aa63abda2d86064657e15e406a83d9c6372a53d4e80d31e85b390a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"6SZfLTu9z.doc","sha256":"0ba0af0d8e29a3028b788866421a849109cfb1e6edf896b4c85131c98da8943c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"6WMjwc1zqk3IB.exe","sha256":"dcad96a48b0a8e267f512258f01542d8395afe1bfda78cc14df5543d8915c8bb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"9rNtWnjTq9RGbU.exe","sha256":"a2449cf699c366491d6a1664bbfaa25f8f965cfcd237853750c194ebc48a175a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"C04T72pR0Bcl.doc","sha256":"baab128a2374fff23a153989ac55fcc01acaf7b54a01834e532323755e1b65b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"EKeaJO.doc","sha256":"831d2aebb9a53b19fdf82096f2548fd0017cdff13629679e676993adc4b0af02","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"F3hzum1.doc","sha256":"06e7575341e446e0a2c442e83fbe88ca083c94ee4807f8bcdbed52974217d75f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"Tmg2wsFHYf9ioO.doc","sha256":"5bd868982f49cad28b96cb78e7093bae47769554eb19229c1ff7d69962e395fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"a3Ntx.exe","sha256":"759afba4c8085ff8b44b0778d1a8bb0fac654d917ec32861df20513eae662adc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"bg3oTe.doc","sha256":"a83c7a8409259bf2ad75def0b7647e54b4d3ece65edf307042f9336c2f9dc742","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"bvYkKJ33N9A.exe","sha256":"c6a4f6891a4544f399c09b4753aa9de51bd8b7c88d8a0533ed30b374123c7fe2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"dH1rDN9f9.doc","sha256":"16df38d4f6f9d4c68638f0ad6c867b97438fb7c298fb60b6a40f5fca8b46044b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"dgQJde60mPXhI.exe","sha256":"45f8701550fc92ba1899fed277b7ce4760afa6b58b22447eaea242496c60140b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"dskCEJ.exe","sha256":"920513ad827d00929bd67377064a0ccc92a04062953eae4b0c237cd820f2d3ab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"hKY8.doc","sha256":"b1f2c2fc1b83e133f14a32b75fccfa6204a90f8153fa39facd280f6aaa91f71b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"hlchPBL.exe","sha256":"a6838a42b7bdb61e3f082a35853cf6dc618dc4034983b2625a5bd10e141a8273","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"iLLOga.exe","sha256":"b53a24acd8c66e3e9386e7dbb3fa46e46afb25f547f02078a5e9118e38e87429","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"kY01UeAiy5.exe","sha256":"8b356ed842f051bcba549ddc9f74f6c154f4ddd5e907f2157b0cca803e264fc2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"kdo6iAicsoicvHg.exe","sha256":"a5451a542babff0c8d6eca56eb43deef1c0faf49c7a98d1aa12c41a40f1d19e2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"klmqz.doc","sha256":"69e28c5b0f0b5edd7c0f3a1951fec1237b265ded0c9a6d666f6658ff9e36a7f1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"lCEf83Wf7e4nuIMk.doc","sha256":"001a01e2305b383d2885330a1f08572d8af9dafb58255f807303feac7ab62395","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"mtgFs8Za.doc","sha256":"fe8a6429e6ae3c7090592b6e0ba3fad8022006bc8b32b975d831d949488ea95e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"rRgk91Ih5n.doc","sha256":"078bfa4366ca00328baae5a289694b60cf4536de9400e874bcda1d5d010babb6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"tDUzYwYK5f.exe","sha256":"89c8c7478998b0e93dc234e98627fc47f4b18e653cb846092e17ef4d8604919f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"w5JaoO.doc","sha256":"15b77942da319b862a2371f1ce0527eb1c198870d3bb5472cd85bb000f066035","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"yZw6snqBQ28DAzu.exe","sha256":"bd355ffd26e7efd670739ea3ee1a73b3e52276b2a46b0a70de65c654ad2e1d4f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"Desktop.lnk","sha256":"c0aea9a198c3027a2e4c942e5c92367346a17c803319db79f0131d400b40d220","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"Downloads.lnk","sha256":"4350b3f555081a0d298747a6382eeb000550b6ce4e0b0fff7d8e8d11ba148ddf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"RecentPlaces.lnk","sha256":"c2975c60f08122ad51dd6aeca27dbe2ba4795aefea243663f6a4c99650ace8f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"name":"autoexec.bat","sha256":"165f0960ee21d6e0f9536adba86cef37cea7ea1168708efeebb826bb461ae622","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"path":"C:\\mV3.byK","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"path":"C:\\e27fc6bb3b7cc8cd88976130baa065879e4bd5f2f64a5af2d3a12447064bfa19.exe","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"path":"C:\\pagefile.sys","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"path":"%USERPROFILE%\\NTUSER.DAT","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"path":"%USERPROFILE%\\ntuser.dat.LOG1","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"path":"%USERPROFILE%\\ntuser.dat.LOG2","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"path":"%USERPROFILE%\\Searches\\Everywhere.search-ms","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]},{"path":"%USERPROFILE%\\Searches\\Indexed Locations.search-ms","sources":[{"report_type":"sandbox","report_id":"5a6606607ca3e164b56e6265"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5a6606607ca3e164b56e6265"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Ransom.BTCWare.Generic Sample e27fc6bb3b7c… — Score 52/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample e27fc6bb3b7c…. Malware family: Ransom.BTCWare.Generic. Threat score 52/100. 18/26 AV engines flagged this file. 0 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/e27fc6bb3b7cc8cd88976130baa065879e4bd5f2f64a5af2d3a12447064bfa19"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom.BTCWare.Generic Sample e27fc6bb3b7c… — Score 52/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample e27fc6bb3b7c…. Malware family: Ransom.BTCWare.Generic. Threat score 52/100. 18/26 AV engines flagged this file. 0 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/e27fc6bb3b7cc8cd88976130baa065879e4bd5f2f64a5af2d3a12447064bfa19"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom.BTCWare.Generic Sample e27fc6bb3b7c… — Score 52/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample e27fc6bb3b7c…. Malware family: Ransom.BTCWare.Generic. Threat score 52/100. 18/26 AV engines flagged this file. 0 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L27","11",{}]]