4b007073...5d29 | VMRay Analyzer Report
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Ransomware, Trojan

VMRay Threat Indicators (10 rules, 11 matches)

Severity Category Operation Count Classification
5/5
Local AV Malicious content was detected by heuristic scan 1 -
5/5
Reputation Known malicious file 1 Trojan
  • File "C:\Users\FD1HVy\Desktop\Hades666.exe" is a known malicious file.
4/5
File System Renames user files 1 Ransomware
  • Renames multiple user files. This is an indicator for an encryption attempt.
4/5
OS Modifies Windows automatic backups 1 -
4/5
YARA YARA match 2 -
  • Rule "JS_High_Entropy" from ruleset "Generic" has matched on the modified file "C:\Windows10Upgrade\resources\ux\Microsoft.WinJS\js\base.js".
  • Rule "JS_High_Entropy" from ruleset "Generic" has matched on the modified file "C:\Windows10Upgrade\resources\ux\Microsoft.WinJS\js\ui.js".
3/5
File System Possibly drops ransom note files 1 Ransomware
  • Possibly drops ransom note files (creates 59 instances of the file "HOW TO BACK YOUR FILES.txt" in different locations).
2/5
Anti Analysis Tries to detect virtual machine 1 -
  • Possibly trying to detect VM via rdtsc.
1/5
Persistence Installs system startup script or application 1 -
  • Adds "C:\Users\FD1HVy\Desktop\Hades666.exe" to Windows startup via registry.
1/5
Process Creates process with hidden window 1 -
  • The process "C:\WINDOWS\system32\cmd.exe" starts with hidden window.
1/5
File System Creates an unusually large number of files 1 -

Screenshots

Monitored Processes

Sample Information

ID #118325
MD5 4340a57818605f3ede85daa24beb132c Copy to Clipboard
SHA1 7eed81b7d741fc234e3af275cacc979d7e717aec Copy to Clipboard
SHA256 4b007073586ededba08b535b724703e0ac59806fae66bbfdb5a098e4d8cc5d29 Copy to Clipboard
SSDeep 3072:9yljy9Vx18RQBDiu4+GZA4ws8SWgq0RjzUyP9OyKh3VcwScqF2ldT5:slEx2y9++f30xQyP9sSv Copy to Clipboard
ImpHash 8e6b4ad47eb29c92233d9fd7fb3d6154 Copy to Clipboard
Filename Hades666.exe
File Size 182.50 KB
Sample Type Windows Exe (x86-32)

Analysis Information

Creation Time 2019-07-22 13:32 (UTC+2)
Analysis Duration 00:04:32
Number of Monitored Processes 2
Execution Successful True
Reputation Enabled True
WHOIS Enabled False
Local AV Enabled True
YARA Enabled True
Number of AV Matches 1
Number of YARA Matches 2
Termination Reason Timeout
Tags
Function Logfile
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".


    
Before

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".


    
After

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".


    
Screenshot
Expand-Icon
Exit-Icon
icon_left
icon_left
image