9748e28c...c471 | IOCs
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification:
Downloader
Ransomware
Threat Names:
Djvu
STOP
Trojan.GenericKD.33626843
...

CUsersabdoAppDataLocalde14c4d4-af10-40ba-b2e7-b7cd78dfba75FCEB.tmp.exe

Windows Exe (x86-32)

Created at 2020-04-09T13:25:00

...

Remarks (2/3)

(0x0200000E): The overall sleep time of all monitored processes was truncated from "1 minute, 50 seconds" to "10 seconds" to reveal dormant functionality.

(0x02000004): The operating system was rebooted during the analysis because the sample installed a startup script, task or application for persistence.

(0x0200003A): 2 tasks were rescheduled ahead of time to reveal dormant functionality.

Indicators

File (12)
»
Filename Hash Operations Category Severity
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\6c6aafd4-f7f7-4f0c-8b07-1dd41571cbc8\5.exe MD5: bd63937c9ca3c907d6e100e7107f1f66
SHA1: 4bcb94650158006f88e99560698a64f8b99e171d
SHA256: 92a8aa2f94b814cb84731e3b948914fbdcbd40b38c0ea615a7b51820892452dd
SSDeep: 6144:F4HGZVbZQ0ckUCtFWBqFWzLfBXm+411d1SkgnJjyEhB+BfcEQWofOOMLpi6:qyVxUCrW0FWJap1u4sYkcFi
ImpHash: 36c83c23bc96c8bbc62702d703c95343 		Access, Create, Write Downloaded File
Malicious
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\6c6aafd4-f7f7-4f0c-8b07-1dd41571cbc8\updatewin1.exe MD5: 5b4bd24d6240f467bfbc74803c9f15b0
SHA1: c17f98c182d299845c54069872e8137645768a1a
SHA256: 14c7bec7369d4175c6d92554b033862b3847ff98a04dfebdf9f5bb30180ed13e
SSDeep: 6144:7qZQGv0d4dW6efSyahstfKVkW5XXnXXfXXXWXXXXHXXXXBXXXXgXXXXX5XXXXiXk:2ZQGXdPe6qU6W5XXnXXfXXXWXXXXHXXE
ImpHash: 0bcca924efe6e6fa741675d8e687fbb3 		Access, Create, Write Downloaded File
Malicious
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\6c6aafd4-f7f7-4f0c-8b07-1dd41571cbc8\updatewin2.exe MD5: 996ba35165bb62473d2a6743a5200d45
SHA1: 52169b0b5cce95c6905873b8d12a759c234bd2e0
SHA256: 5caffdc76a562e098c471feaede5693f9ead92d5c6c10fb3951dd1fa6c12d21d
SSDeep: 6144:vLgbC0mVQlY+3aKn7n4CTHcXXnXXfXXXWXXXXHXXXXBXXXXgXXXXX5XXXXiXXXXP:vGCtQlb3aKzvT8XXnXXfXXXWXXXXHXXf
ImpHash: 5921adaaf66f8c259aeda9e22686cd4b 		Access, Create, Write Downloaded File
Malicious
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\CUsersabdoAppDataLocalde14c4d4-af10-40ba-b2e7-b7cd78dfba75FCEB.tmp.exe MD5: ba9f55ce820b48d6f1c78c10e7434db7
SHA1: b4e5b48f0a19ff733caa0a25d4cd3930b8cee023
SHA256: 9748e28cd2e2a1a06ed9a5125b085e3e72654aa7cfc9d2f8400b7355ecd0c471
SSDeep: 12288:+OSzSJpSkJFVxPlySItIuTrVbOTUs/yDGzQHYX/eeS9NE6bmInNqrXWSk13c31In:Q6pSGPT2FOTU3DjHeeeANEe9ArXk3cFQ
ImpHash: 99620e57ed01ce72a65e18fd03f25b2b 		Access, Create, Delete Sample File
Malicious
C:\Windows\System32\drivers\etc\hosts MD5: 360d265eddea8679c434a205f7ade7ad
SHA1: e17d843f610e0283904e201195360525ae449a68
SHA256: 5a1597c0d29dd475e33cd8889d7d848037a8c17bad0f3daa022fb889e0db7ead
SSDeep: 96:vDZEurK9q3WlSyU0FXmGZll0TOHyF9fAHLmttA/ZKTKdIlMHqzoCGbXx:RrK9FU0FXmGZll06m9fAH6AhKTK9Cax
ImpHash: - 		Access, Write Modified File
Malicious
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\bowsakkdestx.txt MD5: 157d95011a4ee17bc03363c225dea722
SHA1: b3501a46302831f3fb4f4217f023a34aaae8e9fd
SHA256: 4df818945a818ecc360a627cb4eb55bad33f2553f9de5018887cb75ee7f12ad7
SSDeep: 12:YGJ68AW8KO5+Pdxa8uzKYQmkMvOpv2V5BDbMU:YgJAWhdwCuVvbMU
ImpHash: - 		Access, Create, Write Downloaded File
Unknown
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\script.ps1 MD5: f972c62f986b5ed49ad7713d93bf6c9f
SHA1: 4e157002bdb97e9526ab97bfafbf7c67e1d1efbf
SHA256: b47f85974a7ec2fd5aa82d52f08eb0f6cea7e596a98dd29e8b85b5c37beca0a8
SSDeep: 3:uIHeGAFcX5wTnl:/eGgHTl
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\SystemID\PersonalID.txt MD5: c183857770364b05c2011bdebb914ed3
SHA1: 040e5ac904de86328cca053a15596e118fc5da24
SHA256: 094c4931fdb2f2af417c9e0322a9716006e8211fe9017f671ac6e3251300acca
SSDeep: 3::
ImpHash: - 		Access, Create Dropped File
Whitelisted
C:\SystemID - Access, Create
Not Available
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\0cf16e90-25f3-4a59-b809-8330957d8bce - Access, Create
Not Available
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\6c6aafd4-f7f7-4f0c-8b07-1dd41571cbc8 - Access, Create
Not Available
I:\5d2860c89d774.jpg - Access
Not Available
Registry (4)
»
Registry Key Name Operations
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion Access
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Access
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper Access, Read, Write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\SysHelper Access, Read, Write
Mutex (1)
»
Mutex Name Operations
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} Access
Domain (2)
»
Domain Sources Severity
api.2ip.ua Function Log
Unknown
blvd.top Function Log, PCAP
Unknown
URL (8)
»
URL Operations Category Severity
http://blvd.top/files/penelop/3.exe GET Contacted
Blacklisted
http://blvd.top/files/penelop/4.exe GET Contacted
Blacklisted
http://blvd.top/files/penelop/5.exe GET Contacted
Blacklisted
http://blvd.top/files/penelop/updatewin.exe GET Contacted
Blacklisted
http://blvd.top/files/penelop/updatewin1.exe GET Contacted
Blacklisted
http://blvd.top/files/penelop/updatewin2.exe GET Contacted
Blacklisted
http://blvd.top/ydtftysdtyftysdfsdpen3/get.php?pid=9A523923862794A7075459032DF51D89&first=true GET Contacted
Unknown
https://api.2ip.ua/geo.json GET Contacted
Unknown
IP (2)
»
IP Protocols Sources
77.123.139.189 HTTPS, TCP Function Log, PCAP
80.249.145.69 HTTP, TCP Function Log, PCAP
Export to TXT Export to JSON
VMRay - Analyzer - www.vmray.com
Legal Note
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image