d4de58e7...ea2c | VTI
Try VMRay Analyzer
VTI SCORE: 100/100
Target: win7_64_sp1 | exe
Classification: Riskware, Wiper, Ransomware

d4de58e79bfcf66ea933e50fbeada266fe32ee2ce0636419ed9ec0f60a99ea2c (SHA256)

d4de58e79bfcf66ea933e50fbeada266fe32ee2ce0636419ed9ec0f60a99ea2c.exe

Windows Exe (x86-32)

Created at 2018-07-02 12:52:00

Severity Category Operation Classification
5/5
File System Encrypts content of user files Ransomware
  • Encrypts the content of multiple user files. This is an indicator for ransomware.
1/5
Anti Analysis Resolves APIs dynamically to possibly evade static detection -
1/5
Anti Analysis Tries to detect debugger -
1/5
Process Creates system object -
1/5
Process Creates process with hidden window -
  • The process "C:\Windows\system32\cmd.exe /c schtasks /create /sc onlogon /tn 2620738370 /rl highest /tr C:\PROGRA~2\COMMON~1\D4DE58~1.EXE" starts with hidden window.
1/5
Masquerade Changes folder appearance Riskware
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\feeds cache\1nbur4hr" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\feeds cache\6asvn7j7" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\feeds cache\d68g7bij" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\feeds cache" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\feeds cache\kqmhsvkd" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\burn\burn" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\burn\burn1" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\burn\burn2" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\history" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\history\history.ie5" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\history\low" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\history\low\history.ie5" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\mm5o9xqs" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\pmmr5k9k" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\rijuql1c" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\x9ohk109" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\abv8l7my" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\ikqeepzr" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\yg1r61z8" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\stationery" has a changed appearance.
1/5
Persistence Installs system service -
  • Installs service "2620738370" by using the sc.exe utility.
Function Logfile
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".


    
Before

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".


    
After

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".


    
Screenshot
Expand-Icon
Exit-Icon
icon_left
icon_left
image