4deff7d8...399c | VTI
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Target: win8.1_64 | exe
Classification: Riskware, Downloader, Wiper, Ransomware

4deff7d8434583ea8e5c3ef9b4c64674dfb165b1720ddf63b5abdd8ed6a7399c (SHA256)

sous.exe

Windows Exe (x86-64)

Created at 2018-04-13 00:34:00

...

Notifications (2/2)

Due to a reputation service error, no query could be made to determine the reputation status of any contacted URL.

The operating system was rebooted during the analysis.

Severity Category Operation Classification
5/5
File System Encrypts content of user files Ransomware
  • Encrypts the content of multiple user files. This is an indicator for ransomware.
    ...
5/5
Device Writes to Master Boot Record (MBR) -
4/5
OS Modifies Windows automatic backups -
3/5
Kernel Executes code with kernel privileges -
  • Executes code with kernel privileges to perform system level actions. This can sometimes be used to perform malicious actions and to avoid detection.
    ...
1/5
Anti Analysis Tries to detect debugger -
1/5
Process Creates process with hidden window -
  • The process "C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn 3123635631 /rl highest /tr C:\PROGRA~1\COMMON~1\sous.exe" starts with hidden window.
    ...
  • The process "C:\Windows\system32\cmd.exe /C title 7652158|vssadmin.exe Delete Shadows /All /Quiet" starts with hidden window.
    ...
  • The process "C:\Windows\system32\cmd.exe /C title 3988795|bcdedit /set {default} recoveryenabled No" starts with hidden window.
    ...
  • The process "C:\Windows\system32\cmd.exe /C title 9579842|bcdedit /set {default} bootstatuspolicy ignoreallfailures" starts with hidden window.
    ...
1/5
Anti Analysis Resolves APIs dynamically to possibly evade static detection -
1/5
Masquerade Changes folder appearance Riskware
  • Folder "c:\users\5jghkoaofdp\documents\my shapes" has a changed appearance.
    ...
  • Folder "c:\users\5jghkoaofdp\favorites\links" has a changed appearance.
    ...
  • Folder "c:\users\5jghkoaofdp\saved games" has a changed appearance.
    ...
1/5
Device Monitors mouse movements and clicks -
1/5
File System Creates an unusually large number of files -
1/5
Network Downloads data Downloader
1/5
Network Connects to HTTP server -
1/5
Persistence Installs system service -
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image