3380a59f...97c9 | VMRay Analyzer Report
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Ransomware, Wiper, Spyware, Trojan

exec.exe

Windows Exe (x86-32)

Created at 2019-04-12T22:27:00

...

Remarks (1/1)

(0x2000004): The operating system was rebooted during the analysis because the sample installed a startup script, task or application for persistence.

VMRay Threat Indicators (15 rules, 154 matches)

Severity Category Operation Classification
5/5
File System Encrypts content of user files Ransomware
  • Encrypts the content of multiple user files. This is an indicator for ransomware.
    ...
5/5
Local AV Malicious content was detected by heuristic scan -
5/5
File System Known malicious file Trojan
  • File "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\exec.exe" is a known malicious file.
    ...
4/5
Information Stealing Exhibits Spyware behavior Spyware
  • Tries to read sensitive data of multiple applications.
    ...
    • VTI Actions
4/5
OS Modifies Windows automatic backups -
2/5
Anti Analysis Resolves APIs dynamically to possibly evade static detection -
2/5
Information Stealing Reads sensitive browser data -
  • Trying to read sensitive data of web browser "Google Chrome" by file.
    ...
  • Trying to read sensitive data of web browser "Internet Explorer / Edge" by file.
    ...
    • VTI Actions
  • Trying to read sensitive data of web browser "Mozilla Firefox" by file.
    ...
    • VTI Actions
2/5
Information Stealing Reads sensitive mail data -
  • Trying to read sensitive data of mail application "Windows Mail" by file.
    ...
    • VTI Actions
1/5
Process Creates system object -
  • Creates mutex with name "Global\00019C354B4200".
    ...
  • Creates mutex with name "Global\00019C354B4201".
    ...
  • Creates mutex with name "Local\!PrivacIE!SharedMemory!Mutex".
    ...
1/5
Process Creates process with hidden window -
  • The process "C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\exec.exe" starts with hidden window.
    ...
  • The process "C:\Windows\system32\cmd.exe" starts with hidden window.
    ...
1/5
Persistence Installs system startup script or application -
  • Adds "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\exec.exe" to Windows startup via registry.
    ...
  • Adds "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\startup\exec.exe" to Windows startup folder.
    ...
  • Adds "c:\programdata\microsoft\windows\start menu\programs\startup\exec.exe" to Windows startup folder.
    ...
  • Adds "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini" to Windows startup folder.
    ...
  • Adds "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini.id[9c354b42-0001].[tedmundboardus@aol.com].phobos" to Windows startup folder.
    ...
  • Adds "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini" to Windows startup folder.
    ...
    • VTI Actions
  • Adds "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini.id[9c354b42-0001].[tedmundboardus@aol.com].phobos" to Windows startup folder.
    ...
    • VTI Actions
  • Adds "c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini" to Windows startup folder.
    ...
    • VTI Actions
  • Adds "c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini.id[9c354b42-0001].[tedmundboardus@aol.com].phobos" to Windows startup folder.
    ...
    • VTI Actions
1/5
Process Reads from memory of another process -
  • "c:\windows\system32\cmd.exe" reads from "C:\Windows\system32\vssadmin.exe".
    ...
  • "c:\windows\system32\cmd.exe" reads from "C:\Windows\system32\netsh.exe".
    ...
  • "c:\windows\system32\cmd.exe" reads from "C:\Windows\System32\Wbem\WMIC.exe".
    ...
  • "c:\windows\system32\cmd.exe" reads from "C:\Windows\system32\bcdedit.exe".
    ...
1/5
Masquerade Changes folder appearance -
  • Folder "c:\$recycle.bin\s-1-5-21-3388679973-3930757225-3770151564-1000" has a changed appearance.
    ...
  • Folder "c:\programdata\microsoft\windows\ringtones" has a changed appearance.
    ...
  • Folder "c:\programdata\microsoft\windows\start menu" has a changed appearance.
    ...
  • Folder "c:\programdata\microsoft\windows\start menu\programs\accessories\accessibility" has a changed appearance.
    ...
  • Folder "c:\programdata\microsoft\windows\start menu\programs\accessories" has a changed appearance.
    ...
  • Folder "c:\programdata\microsoft\windows\start menu\programs\accessories\system tools" has a changed appearance.
    ...
  • Folder "c:\programdata\microsoft\windows\start menu\programs\accessories\tablet pc" has a changed appearance.
    ...
  • Folder "c:\programdata\microsoft\windows\start menu\programs\accessories\windows powershell" has a changed appearance.
    ...
  • Folder "c:\programdata\microsoft\windows\start menu\programs\administrative tools" has a changed appearance.
    ...
  • Folder "c:\programdata\microsoft\windows\start menu\programs" has a changed appearance.
    ...
  • Folder "c:\programdata\microsoft\windows\start menu\programs\games" has a changed appearance.
    ...
  • Folder "c:\programdata\microsoft\windows\start menu\programs\maintenance" has a changed appearance.
    ...
  • Folder "c:\programdata\microsoft\windows\start menu\programs\startup" has a changed appearance.
    ...
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\feeds cache\1nbur4hr" has a changed appearance.
    ...
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\feeds cache\6asvn7j7" has a changed appearance.
    ...
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\feeds cache\d68g7bij" has a changed appearance.
    ...
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\feeds cache" has a changed appearance.
    ...
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\feeds cache\kqmhsvkd" has a changed appearance.
    ...
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\burn\burn" has a changed appearance.
    ...
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\burn\burn1" has a changed appearance.
    ...
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\burn\burn2" has a changed appearance.
    ...
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\history" has a changed appearance.
    ...
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\history\history.ie5" has a changed appearance.
    ...
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\history\low" has a changed appearance.
    ...
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\history\low\history.ie5" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5" has a changed appearance.
    ...
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\mm5o9xqs" has a changed appearance.
    ...
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\pmmr5k9k" has a changed appearance.
    ...
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\rijuql1c" has a changed appearance.
    ...
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\x9ohk109" has a changed appearance.
    ...
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files" has a changed appearance.
    ...
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz" has a changed appearance.
    ...
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\abv8l7my" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\ikqeepzr" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\yg1r61z8" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\stationery" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\history\history.ie5" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\temporary internet files\content.ie5\03j4uqw0" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\temporary internet files\content.ie5" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\temporary internet files\content.ie5\ketajp6d" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\temporary internet files\content.ie5\vb18b0kb" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\temporary internet files\content.ie5\xt1rpyg9" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\internet explorer\quick launch" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\taskbar" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\libraries" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\recent" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\accessories" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\administrative tools" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\maintenance" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\startup" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\sendto" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\5p5nrgjn0js halpmcxz\contacts" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\5p5nrgjn0js halpmcxz\desktop" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\5p5nrgjn0js halpmcxz\documents" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\5p5nrgjn0js halpmcxz\documents\my shapes" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\5p5nrgjn0js halpmcxz\downloads" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\5p5nrgjn0js halpmcxz\favorites" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\5p5nrgjn0js halpmcxz\links" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\5p5nrgjn0js halpmcxz\music" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\5p5nrgjn0js halpmcxz\favorites\links" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\5p5nrgjn0js halpmcxz\pictures" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\5p5nrgjn0js halpmcxz\saved games" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\5p5nrgjn0js halpmcxz\searches" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\5p5nrgjn0js halpmcxz\videos" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\default\appdata\local\microsoft\feeds cache\1nbur4hr" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\default\appdata\local\microsoft\feeds cache\6asvn7j7" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\default\appdata\local\microsoft\feeds cache\d68g7bij" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\default\appdata\local\microsoft\feeds cache" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\default\appdata\local\microsoft\feeds cache\kqmhsvkd" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\default\appdata\local\microsoft\windows\burn\burn" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\default\appdata\local\microsoft\windows\history" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\default\appdata\local\microsoft\windows\history\history.ie5" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\default\appdata\local\microsoft\windows\temporary internet files\content.ie5" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\default\appdata\local\microsoft\windows\temporary internet files\content.ie5\mm5o9xqs" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\default\appdata\local\microsoft\windows\temporary internet files\content.ie5\pmmr5k9k" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\default\appdata\local\microsoft\windows\temporary internet files\content.ie5\rijuql1c" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\default\appdata\local\microsoft\windows\temporary internet files" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\default\appdata\local\microsoft\windows\temporary internet files\content.ie5\x9ohk109" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\default\appdata\local\microsoft\windows mail\stationery" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\default\appdata\roaming\microsoft\internet explorer\quick launch" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\default\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\taskbar" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\default\appdata\roaming\microsoft\windows\libraries" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\default\appdata\roaming\microsoft\windows\recent" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\default\appdata\roaming\microsoft\windows\sendto" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\default\appdata\roaming\microsoft\windows\start menu" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\administrative tools" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\default\appdata\roaming\microsoft\windows\start menu\programs" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\maintenance" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\startup" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\default\contacts" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\default\desktop" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\default\documents" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\default\downloads" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\default\favorites" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\default\favorites\links" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\default\links" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\default\music" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\default\pictures" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\default\saved games" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\default\searches" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\default\videos" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\public\desktop" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\public" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\public\documents" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\public\downloads" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\public\libraries" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\public\music" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\public\music\sample music" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\public\pictures" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\public\pictures\sample pictures" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\public\recorded tv" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\public\recorded tv\sample media" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\public\videos" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\users\public\videos\sample videos" has a changed appearance.
    ...
    • VTI Actions
1/5
Information Stealing Possibly does reconnaissance -
  • Possibly trying to gather information about application "Mozilla Firefox" by file.
    ...
    • VTI Actions
1/5
File System Creates an unusually large number of files -

Screenshots

Monitored Processes

Process Graph

Process Graph Legend

Sample Information

ID #593637
MD5 c499e9350dfd74eba5d15fb183725e61 Copy to Clipboard
SHA1 04a76b08175c51c808e221a614698222e3f983ab Copy to Clipboard
SHA256 3380a59f6277030af31ecab0023af30a4f63e5b4407f1aba4a262c34fce397c9 Copy to Clipboard
SSDeep 1536:1FOPbkyoTwtPto0Rl0DsN9/zLec5oGFACZrqdKBNY33sGD1s0+o:1YPxAwtPtoe/zLaGmCZrqcBS33bD1s9 Copy to Clipboard
ImpHash 14d7a5762b03da9e2746411501b3d038 Copy to Clipboard
Filename exec.exe
File Size 71.00 KB
Sample Type Windows Exe (x86-32)

Analysis Information

Creation Time 2019-04-13 00:27 (UTC+2)
Analysis Duration 00:03:55
Number of Monitored Processes 30
Execution Successful True
Reputation Enabled True
WHOIS Enabled True
Local AV Enabled True
YARA Enabled True
Number of AV Matches 1
Number of YARA Matches 0
Termination Reason Maximum binlog size reached
Tags
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image