1c5c91bf...283d | VMRay Analyzer Report
Logo
Try VMRay Analyzer
VTI SCORE: 98/100
Dynamic Analysis Report
Classification: Ransomware, Wiper, Trojan

11.exe

Windows Exe (x86-32)

Created at 2019-04-11T22:01:00

...

Remarks (1/1)

(0x2000004): The operating system was rebooted during the analysis because the sample installed a startup script, task or application for persistence.

VMRay Threat Indicators (24 rules, 222 matches)

Severity Category Operation Classification
4/5
File System Modifies content of user files Ransomware
  • Modifies the content of multiple user files. This is an indicator for an encryption attempt.
    ...
4/5
File System Deletes user files Wiper
  • Deletes multiple user files. This is an indicator for ransomware or wiper malware.
    ...
4/5
OS Modifies Windows automatic backups -
3/5
Anti Analysis Tries to evade debugger -
3/5
Anti Analysis Tries to detect application sandbox -
  • Possibly trying to detect "Comodo Sandbox" by checking for existence of module "cmdvrt32.dll".
    ...
  • Possibly trying to detect "Sandboxie" by checking for existence of module "SbieDll.dll".
    ...
2/5
Anti Analysis Tries to detect virtual machine -
  • Reads out system information, commonly used to detect "VirtualBox" via registry. (Key is "HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__").
    ...
  • Possibly trying to detect VM via rdtsc.
    ...
    • VTI Actions
2/5
Anti Analysis Tries to detect debugger -
  • Tries to detect debugger by finding window class "OLLYDBG".
    ...
  • Tries to detect debugger by finding window class "GBDYLLO".
    ...
  • Tries to detect debugger by finding window class "pediy06".
    ...
2/5
Anti Analysis Tries to detect a forensic tool -
  • Searches for the window class "FilemonClass" that is related to a forensic tool.
    ...
  • Searches for the window "File Monitor - Sysinternals: www.sysinternals.com" that is related to a forensic tool.
    ...
  • Searches for the window class "PROCMON_WINDOW_CLASS" that is related to a forensic tool.
    ...
  • Searches for the window class "RegmonClass" that is related to a forensic tool.
    ...
  • Searches for the window "Registry Monitor - Sysinternals: www.sysinternals.com" that is related to a forensic tool.
    ...
  • Searches for the window class "18467-41" that is related to a forensic tool.
    ...
2/5
Anti Analysis Resolves APIs dynamically to possibly evade static detection -
2/5
Anti Analysis Makes direct system call to possibly evade hooking based sandboxes -
  • Makes a direct system call to "NtQueryInformationProcess".
    ...
    • VTI Actions
2/5
File System Known suspicious file Trojan
2/5
Injection Writes into the memory of a process running from a created or modified executable -
  • "c:\users\fd1hvy\desktop\11.exe" modifies memory of "c:\users\fd1hvy\desktop\11.exe".
    ...
2/5
Injection Modifies control flow of a process running from a created or modified executable -
  • "c:\users\fd1hvy\desktop\11.exe" alters context of "c:\users\fd1hvy\desktop\11.exe".
    ...
1/5
Process Creates process with hidden window -
  • The process "C:\Users\FD1HVy\Desktop\11.exe" starts with hidden window.
    ...
  • The process "C:\WINDOWS\system32\cmd.exe" starts with hidden window.
    ...
1/5
Process Creates system object -
  • Creates mutex with name "Global\syncronize_P4AHB8A".
    ...
  • Creates mutex with name "Global\syncronize_P4AHB8U".
    ...
1/5
File System Modifies operating system directory -
1/5
Persistence Installs system startup script or application -
  • Adds "C:\WINDOWS\System32\11.exe" to Windows startup via registry.
    ...
  • Adds "c:\users\fd1hvy\appdata\roaming\microsoft\windows\start menu\programs\startup\11.exe" to Windows startup folder.
    ...
  • Adds "c:\programdata\microsoft\windows\start menu\programs\startup\11.exe" to Windows startup folder.
    ...
1/5
Masquerade Changes folder appearance -
  • Folder "c:\$recycle.bin\s-1-5-18" has a changed appearance.
    ...
  • Folder "c:\$recycle.bin\s-1-5-21-1051304884-625712362-2192934891-1000" has a changed appearance.
    ...
1/5
File System Modifies application directory -
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\officeupdateschedule.xml".
    ...
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\c2rheartbeatconfig.xml.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\common files\microsoft shared\ink\en-us\join.avi".
    ...
  • Modifies "c:\program files\java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif".
    ...
  • Modifies "c:\program files\java\jre1.8.0_144\lib\images\cursors\win32_linknodrop32x32.gif.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\java\jre1.8.0_144\lib\images\cursors\win32_movedrop32x32.gif.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\java\jre1.8.0_144\lib\images\cursors\win32_movenodrop32x32.gif.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\java\jre1.8.0_144\lib\images\cursors\win32_copynodrop32x32.gif.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\java\jre1.8.0_144\lib\images\cursors\win32_linkdrop32x32.gif.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\java\jre1.8.0_144\lib\images\cursors\win32_copydrop32x32.gif.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\microsoft office\office16\ospp.vbs".
    ...
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml".
    ...
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml".
    ...
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml".
    ...
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifestloc.en-us.xml.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\microsoft office\packagemanifests\appxmanifest.common.xml.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\an01060_.wmf".
    ...
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\bl00148_.wmf".
    ...
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\bl00045_.wmf".
    ...
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-heap-l1-1-0.dll".
    ...
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-math-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-locale-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-private-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-runtime-l1-1-0.dll".
    ...
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-process-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-string-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-utility-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-time-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\appvisvstream32.dll".
    ...
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\api-ms-win-crt-stdio-l1-1-0.dll.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\appvisvstream64.dll.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\appvisvstream32.dll.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems32.dll.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\appvscripting.dll.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\appvshnotify.exe.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\appvshnotify.exe".
    ...
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\officec2rcom.dll.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\officec2rclient.exe.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
  • Modifies "c:\program files\common files\microsoft shared\clicktorun\mso40uires.dll".
    ...
  • Modifies "c:\program files\common files\microsoft shared\ink\ar-sa\tipresx.dll.mui".
    ...
  • Modifies "c:\program files\common files\microsoft shared\ink\el-gr\tipresx.dll.mui".
    ...
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd00437_.wmf".
    ...
    • VTI Actions
  • Modifies "c:\program files\microsoft office\root\clipart\pub60cor\dd00261_.wmf".
    ...
    • VTI Actions
  • Modifies "c:\program files\common files\microsoft shared\office16\liclua.exe.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
    • VTI Actions
  • Modifies "c:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml".
    ...
    • VTI Actions
  • Modifies "c:\program files\common files\microsoft shared\office16\office setup controller\pkeyconfig.companion.dll.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
    • VTI Actions
  • Modifies "c:\program files\common files\microsoft shared\vc\msdia90.dll.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
    • VTI Actions
  • Modifies "c:\program files\common files\microsoft shared\vc\msdia90.dll".
    ...
    • VTI Actions
  • Modifies "c:\program files\common files\microsoft shared\vsto\10.0\vstomessageprovider.dll.id-b4197730.[seeyoubro@tutanota.com].love".
    ...
    • VTI Actions
  • Modifies "c:\program files\common files\system\ole db\msdaps.dll".
    ...
    • VTI Actions
  • Modifies "c:\program files\common files\system\ole db\sqloledb.rll".
    ...
    • VTI Actions
1/5
Process Reads from memory of another process -
  • "c:\windows\system32\cmd.exe" reads from "C:\WINDOWS\system32\mode.com".
    ...
  • "c:\windows\system32\cmd.exe" reads from "C:\WINDOWS\system32\vssadmin.exe".
    ...
1/5
File System Creates an unusually large number of files -
1/5
Process Overwrites code -
1/5
Static Unparsable sections in file -
  • Static analyzer was unable to completely parse the analyzed file: C:\Users\FD1HVy\Desktop\11.exe.
    ...
0/5
Process Enumerates running processes -

Screenshots

Monitored Processes

Process Graph

Process Graph Legend

Sample Information

ID #587002
MD5 a43f5a2ef5f7f21d30875ae2a809b3aa Copy to Clipboard
SHA1 48d200c9946bed8d6b9c48dd93bc07ac9ebb044f Copy to Clipboard
SHA256 1c5c91bf6f4b2764070f050f0a64731cca2a68a419bfb4702cf8132b22c7283d Copy to Clipboard
SSDeep 49152:WCxqXPyL9P5LRx2PWferUr6y4C0rJx31+JYlkD0o7XyUNmqy85VpEmQEDj:1Rx2RC0lt1OjyUNRFbDj Copy to Clipboard
ImpHash 2eabe9054cad5152567f0699947a2c5b Copy to Clipboard
Filename 11.exe
File Size 2.00 MB
Sample Type Windows Exe (x86-32)

Analysis Information

Creation Time 2019-04-12 00:01 (UTC+2)
Analysis Duration 00:04:49
Number of Monitored Processes 5
Execution Successful True
Reputation Enabled True
WHOIS Enabled True
Local AV Enabled False
YARA Enabled True
Number of YARA Matches 0
Termination Reason Timeout
Tags
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image