ec94faf1...3dc3 | VTI
Try VMRay Analyzer
VTI SCORE: 97/100
Target: win7_64_sp1 | exe
Classification: Riskware, Ransomware

ec94faf102fb59ac77927c3c971656e37bcfbf8bdc5d67e898a8dc860fe83dc3 (SHA256)

RansomAES.exe

Windows Exe (x86-32)

Created at 2018-05-06 09:18:00

Notifications (1/1)

Some extracted files may be missing in the report since the maximum number of extracted files was reached during the analysis. You can increase the limit in the configuration settings.

Severity Category Operation Classification
4/5
File System Modifies content of user files Ransomware
  • Modifies the content of multiple user files. This is an indicator for an encryption attempt.
4/5
File System Renames user files Ransomware
  • Renames multiple user files. This is an indicator for an encryption attempt.
4/5
OS Modifies Windows automatic backups -
1/5
Masquerade Changes folder appearance Riskware
  • Folder "c:\users\5p5nrgjn0js halpmcxz\desktop" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\documents\my shapes" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\documents" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\music" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\history\history.ie5" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\history\low" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\history\low\history.ie5" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\history" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\downloads" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\pictures" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\videos" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\feeds cache" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\feeds cache\1nbur4hr" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\feeds cache\6asvn7j7" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\feeds cache\d68g7bij" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\feeds cache\kqmhsvkd" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\burn\burn" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\burn\burn1" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\burn\burn2" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\mm5o9xqs" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\pmmr5k9k" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\rijuql1c" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\content.ie5\x9ohk109" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\9qh4s0gz" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\abv8l7my" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\ikqeepzr" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\yg1r61z8" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\microsoft\windows mail\stationery" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\history\history.ie5" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\temporary internet files\content.ie5" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\temporary internet files\content.ie5\03j4uqw0" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\temporary internet files\content.ie5\ketajp6d" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\temporary internet files\content.ie5\vb18b0kb" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\local\temp\temporary internet files\content.ie5\xt1rpyg9" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\internet explorer\quick launch" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\taskbar" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\libraries" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\recent" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\sendto" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\accessories" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\administrative tools" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\maintenance" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\startup" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\contacts" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\favorites" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\favorites\links" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\links" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\saved games" has a changed appearance.
  • Folder "c:\users\5p5nrgjn0js halpmcxz\searches" has a changed appearance.
  • Folder "c:\programdata\microsoft\windows\ringtones" has a changed appearance.
  • Folder "c:\programdata\microsoft\windows\start menu" has a changed appearance.
  • Folder "c:\programdata\microsoft\windows\start menu\programs" has a changed appearance.
  • Folder "c:\programdata\microsoft\windows\start menu\programs\accessories" has a changed appearance.
  • Folder "c:\programdata\microsoft\windows\start menu\programs\accessories\accessibility" has a changed appearance.
  • Folder "c:\programdata\microsoft\windows\start menu\programs\accessories\system tools" has a changed appearance.
  • Folder "c:\programdata\microsoft\windows\start menu\programs\accessories\tablet pc" has a changed appearance.
  • Folder "c:\programdata\microsoft\windows\start menu\programs\accessories\windows powershell" has a changed appearance.
  • Folder "c:\programdata\microsoft\windows\start menu\programs\administrative tools" has a changed appearance.
  • Folder "c:\programdata\microsoft\windows\start menu\programs\games" has a changed appearance.
  • Folder "c:\programdata\microsoft\windows\start menu\programs\maintenance" has a changed appearance.
  • Folder "c:\programdata\microsoft\windows\start menu\programs\startup" has a changed appearance.
  • Folder "c:\users\all users\microsoft\windows\ringtones" has a changed appearance.
  • Folder "c:\users\all users\microsoft\windows\start menu" has a changed appearance.
  • Folder "c:\users\all users\microsoft\windows\start menu\programs" has a changed appearance.
  • Folder "c:\users\all users\microsoft\windows\start menu\programs\accessories" has a changed appearance.
  • Folder "c:\users\all users\microsoft\windows\start menu\programs\accessories\accessibility" has a changed appearance.
  • Folder "c:\users\all users\microsoft\windows\start menu\programs\accessories\system tools" has a changed appearance.
  • Folder "c:\users\all users\microsoft\windows\start menu\programs\accessories\tablet pc" has a changed appearance.
  • Folder "c:\users\all users\microsoft\windows\start menu\programs\accessories\windows powershell" has a changed appearance.
  • Folder "c:\users\all users\microsoft\windows\start menu\programs\administrative tools" has a changed appearance.
  • Folder "c:\users\all users\microsoft\windows\start menu\programs\games" has a changed appearance.
  • Folder "c:\users\all users\microsoft\windows\start menu\programs\maintenance" has a changed appearance.
  • Folder "c:\users\all users\microsoft\windows\start menu\programs\startup" has a changed appearance.
  • Folder "c:\users\default\appdata\local\microsoft\feeds cache" has a changed appearance.
  • Folder "c:\users\default\appdata\local\microsoft\feeds cache\1nbur4hr" has a changed appearance.
  • Folder "c:\users\default\appdata\local\microsoft\feeds cache\6asvn7j7" has a changed appearance.
  • Folder "c:\users\default\appdata\local\microsoft\feeds cache\d68g7bij" has a changed appearance.
  • Folder "c:\users\default\appdata\local\microsoft\feeds cache\kqmhsvkd" has a changed appearance.
  • Folder "c:\users\default\appdata\local\microsoft\windows\burn\burn" has a changed appearance.
  • Folder "c:\users\default\appdata\local\microsoft\windows\history" has a changed appearance.
  • Folder "c:\users\default\appdata\local\microsoft\windows\history\history.ie5" has a changed appearance.
  • Folder "c:\users\default\appdata\local\microsoft\windows\temporary internet files" has a changed appearance.
  • Folder "c:\users\default\appdata\local\microsoft\windows\temporary internet files\content.ie5" has a changed appearance.
  • Folder "c:\users\default\appdata\local\microsoft\windows\temporary internet files\content.ie5\mm5o9xqs" has a changed appearance.
  • Folder "c:\users\default\appdata\local\microsoft\windows\temporary internet files\content.ie5\pmmr5k9k" has a changed appearance.
  • Folder "c:\users\default\appdata\local\microsoft\windows\temporary internet files\content.ie5\rijuql1c" has a changed appearance.
  • Folder "c:\users\default\appdata\local\microsoft\windows\temporary internet files\content.ie5\x9ohk109" has a changed appearance.
  • Folder "c:\users\default\appdata\local\microsoft\windows mail\stationery" has a changed appearance.
  • Folder "c:\users\default\appdata\roaming\microsoft\internet explorer\quick launch" has a changed appearance.
  • Folder "c:\users\default\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\taskbar" has a changed appearance.
  • Folder "c:\users\default\appdata\roaming\microsoft\windows\libraries" has a changed appearance.
  • Folder "c:\users\default\appdata\roaming\microsoft\windows\recent" has a changed appearance.
  • Folder "c:\users\default\appdata\roaming\microsoft\windows\sendto" has a changed appearance.
  • Folder "c:\users\default\appdata\roaming\microsoft\windows\start menu" has a changed appearance.
  • Folder "c:\users\default\appdata\roaming\microsoft\windows\start menu\programs" has a changed appearance.
  • Folder "c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories" has a changed appearance.
  • Folder "c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\accessibility" has a changed appearance.
  • Folder "c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\system tools" has a changed appearance.
  • Folder "c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\administrative tools" has a changed appearance.
  • Folder "c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\maintenance" has a changed appearance.
  • Folder "c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\startup" has a changed appearance.
  • Folder "c:\users\default\contacts" has a changed appearance.
  • Folder "c:\users\default\desktop" has a changed appearance.
  • Folder "c:\users\default\documents" has a changed appearance.
  • Folder "c:\users\default\downloads" has a changed appearance.
  • Folder "c:\users\default\favorites" has a changed appearance.
  • Folder "c:\users\default\favorites\links" has a changed appearance.
  • Folder "c:\users\default\links" has a changed appearance.
  • Folder "c:\users\default\music" has a changed appearance.
  • Folder "c:\users\default\pictures" has a changed appearance.
  • Folder "c:\users\default\saved games" has a changed appearance.
  • Folder "c:\users\default\searches" has a changed appearance.
  • Folder "c:\users\default\videos" has a changed appearance.
  • Folder "c:\users\public" has a changed appearance.
  • Folder "c:\users\public\desktop" has a changed appearance.
  • Folder "c:\users\public\documents" has a changed appearance.
  • Folder "c:\users\public\downloads" has a changed appearance.
  • Folder "c:\users\public\libraries" has a changed appearance.
  • Folder "c:\users\public\music" has a changed appearance.
  • Folder "c:\users\public\music\sample music" has a changed appearance.
  • Folder "c:\users\public\pictures" has a changed appearance.
  • Folder "c:\users\public\pictures\sample pictures" has a changed appearance.
  • Folder "c:\users\public\recorded tv" has a changed appearance.
  • Folder "c:\users\public\recorded tv\sample media" has a changed appearance.
  • Folder "c:\users\public\videos" has a changed appearance.
  • Folder "c:\users\public\videos\sample videos" has a changed appearance.
  • Folder "c:\users" has a changed appearance.
1/5
Persistence Installs system startup script or application -
  • Adds "c:\users\5p5nrgjn0js halpmcxz\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini" to Windows startup folder.
  • Adds "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini" to Windows startup folder.
  • Adds "c:\users\all users\microsoft\windows\start menu\programs\startup\desktop.ini" to Windows startup folder.
  • Adds "c:\users\default\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini" to Windows startup folder.
1/5
Process Creates process with hidden window -
  • The process ""cmd.exe" /c vssadmin.exe delete shadows /all /quiet" starts with hidden window.
1/5
Device Monitors mouse movements and clicks -
1/5
File System Creates an unusually large number of files -
Function Logfile
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".


    
Before

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".


    
After

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".


    
Screenshot
Expand-Icon
Exit-Icon
icon_left
icon_left
image