3885589a...1363 | VMRay Analyzer Report
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Ransomware, Trojan

VMRay Threat Indicators (14 rules, 15 matches)

Severity Category Operation Count Classification
5/5
File System Encrypts content of user files 1 Ransomware
  • Encrypts the content of multiple user files. This is an indicator for ransomware.
3/5
Hide Tracks Hides data in extended file attributes 1 -
  • Sets extended file attributes for "c:\programdata\foo.db" to possibly hide the file.
3/5
File System Possibly drops ransom note files 1 Ransomware
  • Possibly drops ransom note files (creates 81 instances of the file "DECRYPT-FILES.html" in different locations).
2/5
Anti Analysis Resolves APIs dynamically to possibly evade static detection 1 -
2/5
Anti Analysis Tries to detect debugger 1 -
2/5
Information Stealing Reads sensitive browser data 2 -
  • Trying to read sensitive data of web browser "Internet Explorer / Edge" by file.
  • Trying to read sensitive data of web browser "Google Chrome" by file.
2/5
Local AV Suspicious content was detected by heuristic scan 1 -
2/5
Reputation Known suspicious file 1 Trojan
  • File "C:\Users\FD1HVy\Desktop\27BC.TMP.exe" is a known suspicious file.
1/5
Process Creates system object 1 -
1/5
Persistence Installs system startup script or application 2 -
  • Adds "c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\startup\q25ghrj1.dat" to Windows startup folder.
  • Adds "c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\startup\decrypt-files.html" to Windows startup folder.
1/5
File System Creates an unusually large number of files 1 -
1/5
Process Overwrites code 1 -
1/5
Process Process crashed 1 -
0/5
Process Enumerates running processes 1 -

Screenshots

Monitored Processes

Sample Information

ID #649235
MD5 248c960c1ae54103dea5bfae924f28e2 Copy to Clipboard
SHA1 504ce8efee0f7f8329c09c6d045a21c795a84b42 Copy to Clipboard
SHA256 3885589a3c94d0475a6d994e4644e682f4cff93f8b4d65f37508ffe706861363 Copy to Clipboard
SSDeep 6144:/P2vVfY9RbTrI5Tm6oUAcEtKY/e8lmceEoAE77OvaHhdRwc9/P2wdAn7gJRKKRqX:aVw9prIVpb3F8ltQlBwc9/P2l7gT6 Copy to Clipboard
ImpHash fed6080d5570a9033baa7765bc13e05e Copy to Clipboard
Filename 27BC.TMP.exe
File Size 453.50 KB
Sample Type Windows Exe (x86-32)

Analysis Information

Creation Time 2019-05-15 02:21 (UTC+2)
Analysis Duration 00:05:31
Number of Monitored Processes 1
Execution Successful True
Reputation Enabled True
WHOIS Enabled True
Local AV Enabled True
YARA Enabled True
Number of AV Matches 1
Number of YARA Matches 0
Termination Reason Timeout
Tags
Function Logfile
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".


    
Before

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".


    
After

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".


    
Screenshot
Expand-Icon
Exit-Icon
icon_left
icon_left
image