72ebc223...29a4

VTI SCORE: 91/100

Target:

win8.1_64 | exe

Classification:

Trojan, Dropper, Ransomware

72ebc223bef1bf4cabad9c7eb6e520f0d93554f2807d4c8875be24dc3ab129a4 (SHA256)

FRS.exe

Windows Exe (x86-32)

Created at 2018-03-11 10:08:00

Severity	Category	Operation	Classification
4/5	File System	Renames user files	Ransomware
Renames multiple user files. This is an indicator for an encryption attempt. ... VTI Actions Go to Function Call
4/5	File System	Associated with malicious files	Trojan
File "c:\users\5jghkoaofdp\desktop\FRS.exe" is a known malicious file. ... VTI Actions Go to File Details
3/5	Process	Creates an unusally large number of processes	-
Above average number of processes were monitored. ... VTI Actions Go to Function Call
2/5	File System	Associated with suspicious files	Trojan
File "c:\users\5jghko~1\appdata\local\temp\ccep00el.bat" is a known suspicious file. ... VTI Actions Go to File Details Go to Function Call
1/5	Anti Analysis	Resolves APIs dynamically to possibly evade static detection	-
Resolves an unusually high number of APIs. ... VTI Actions Go to Function Call
1/5	Process	Creates process with hidden window	-
The process "cmd.exe /c ""C:\Users\5JGHKO~1\AppData\Local\Temp\CCEP00EL.bat" "C:\Users\5JgHKoaOfdp\Desktop\FRS.exe" "" starts with hidden window. ... VTI Actions Go to Function Call
The process "cmd.exe /c ""C:\Users\5JGHKO~1\AppData\Local\Temp\CBUG7MRD.bat" C:\Users\5JgHKoaOfdp\AppData\Local\qb1143663.0F\FRS_Decryptor.exe "" starts with hidden window. ... VTI Actions Go to Function Call
1/5	Network	Performs DNS request	-
Resolves host name "127.1". ... VTI Actions Go to Function Call
Resolves IP "127.0.0.1" to host name "127.0.0.1". ... VTI Actions Go to Function Call
1/5	PE	Drops PE file	Dropper
Drops file "c:\users\5jghkoaofdp\appdata\local\qb1143663.0f\frs_decryptor.exe". ... VTI Actions Go to File Details Go to Function Call
1/5	PE	Executes dropped PE file	-
Executes dropped file "c:\users\5jghkoaofdp\appdata\local\qb1143663.0f\frs_decryptor.exe". ... VTI Actions Go to File Details Go to Function Call

Function Logfile

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".

Before

After