f871e78a...9605 | VMRay Analyzer Report
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Ransomware, Trojan

raEMQ.exe

Windows Exe (x86-64)

Created at 2019-04-17T10:20:00

...

Remarks (2/2)

(0x2000008): One or more processes crashed during the analysis. Analysis results may be incomplete.

(0x200000e): The overall sleep time of all monitored processes was truncated from "38 minutes, 45 seconds" to "10 minutes, 20 seconds" to reveal dormant functionality.

VMRay Threat Indicators (17 rules, 213 matches)

Severity Category Operation Classification
5/5
File System Encrypts content of user files Ransomware
  • Encrypts the content of multiple user files. This is an indicator for ransomware.
    ...
5/5
Local AV Malicious content was detected by heuristic scan -
5/5
File System Known malicious file Trojan
  • File "C:\Users\FD1HVy\Desktop\raEMQ.exe" is a known malicious file.
    ...
4/5
Injection Writes into the memory of another running process -
  • "c:\users\fd1hvy\desktop\raemq.exe" modifies memory of "c:\windows\system32\sihost.exe".
    ...
  • "c:\users\fd1hvy\desktop\raemq.exe" modifies memory of "c:\windows\system32\svchost.exe".
    ...
  • "c:\users\fd1hvy\desktop\raemq.exe" modifies memory of "c:\windows\system32\runtimebroker.exe".
    ...
  • "c:\users\fd1hvy\desktop\raemq.exe" modifies memory of "c:\windows\system32\dllhost.exe".
    ...
4/5
Injection Modifies control flow of another process -
  • "c:\users\fd1hvy\desktop\raemq.exe" creates thread in "c:\windows\system32\sihost.exe".
    ...
  • "c:\users\fd1hvy\desktop\raemq.exe" creates thread in "c:\windows\system32\svchost.exe".
    ...
  • "c:\users\fd1hvy\desktop\raemq.exe" creates thread in "c:\windows\system32\taskhostw.exe".
    ...
  • "c:\users\fd1hvy\desktop\raemq.exe" creates thread in "c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe".
    ...
  • "c:\users\fd1hvy\desktop\raemq.exe" creates thread in "c:\windows\systemapps\microsoft.windows.cortana_cw5n1h2txyewy\searchui.exe".
    ...
  • "c:\users\fd1hvy\desktop\raemq.exe" creates thread in "c:\windows\system32\runtimebroker.exe".
    ...
  • "c:\users\fd1hvy\desktop\raemq.exe" creates thread in "c:\program files\microsoft office\root\office16\msoia.exe".
    ...
  • "c:\users\fd1hvy\desktop\raemq.exe" creates thread in "c:\windows\system32\apphostregistrationverifier.exe".
    ...
  • "c:\users\fd1hvy\desktop\raemq.exe" creates thread in "c:\windows\system32\dllhost.exe".
    ...
3/5
File System Possibly drops ransom note files Ransomware
  • Possibly drops ransom note files (creates 191 instances of the file "RyukReadMe.html" in different locations).
    ...
2/5
Anti Analysis Resolves APIs dynamically to possibly evade static detection -
2/5
Anti Analysis Delays execution -
2/5
Information Stealing Reads sensitive browser data -
  • Trying to read sensitive data of web browser "Internet Explorer / Edge" by file.
    ...
    • VTI Actions
1/5
Process Creates process with hidden window -
1/5
Process Creates a page with write and execute permissions -
  • Allocates a page in a foreign process with "PAGE_EXECUTE_READWRITE" permissions, often used to dynamically unpack code.
    ...
1/5
Masquerade Changes folder appearance -
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\desktop" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\desktop" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents\my pictures" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents\my videos" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\desktop" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents\my music" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents\my pictures" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents\my videos" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessibility" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessories" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\administrative tools" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\maintenance" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\startup" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\system tools" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\desktop" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents\my music" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents\my videos" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\documents\my pictures" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessibility" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessories" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessories\system tools" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\administrative tools" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\maintenance" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\startup" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\system tools" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\desktop" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\documents" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\documents\my music" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\documents\my pictures" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\documents\my videos" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessibility" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessories" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessories\system tools" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\administrative tools" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\maintenance" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\startup" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\application data\start menu\programs\system tools" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\desktop" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\documents" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\documents\my music" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\documents\my pictures" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\documents\my videos" has a changed appearance.
    ...
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\start menu" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessibility" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessories" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\start menu\programs\accessories\system tools" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\start menu\programs\administrative tools" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\start menu\programs" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\start menu\programs\maintenance" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\start menu\programs\startup" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\start menu\programs\system tools" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\desktop" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\documents" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\documents\my music" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\documents\my pictures" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\documents\my videos" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\start menu" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\start menu\programs\accessibility" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\start menu\programs\accessories" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\start menu\programs\accessories\system tools" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\start menu\programs\administrative tools" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\start menu\programs" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\start menu\programs\maintenance" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\start menu\programs\startup" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\start menu\programs\system tools" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\desktop" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\documents" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\documents\my music" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\documents\my pictures" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\documents\my videos" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\start menu" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\start menu\programs\accessibility" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\start menu\programs\accessories" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\start menu\programs\accessories\system tools" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\start menu\programs\administrative tools" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\start menu\programs" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\start menu\programs\maintenance" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\start menu\programs\startup" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\application data\start menu\programs\system tools" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\desktop" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\documents" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\documents\my music" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\documents\my pictures" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\documents\my videos" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\start menu" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\start menu\programs\accessibility" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\start menu\programs\accessories" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\start menu\programs\accessories\system tools" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\start menu\programs\administrative tools" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\start menu\programs" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\start menu\programs\maintenance" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\start menu\programs\startup" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\application data\start menu\programs\system tools" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\desktop" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\documents" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\documents\my music" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\documents\my pictures" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\documents\my videos" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\start menu" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\start menu\programs\accessibility" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\start menu\programs\accessories" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\start menu\programs\accessories\system tools" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\start menu\programs\administrative tools" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\start menu\programs" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\start menu\programs\maintenance" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\start menu\programs\startup" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\application data\start menu\programs\system tools" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\desktop" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\documents" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\documents\my music" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\documents\my pictures" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\documents\my videos" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\start menu" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\start menu\programs\accessibility" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\start menu\programs\accessories" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\start menu\programs\accessories\system tools" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\start menu\programs\administrative tools" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\start menu\programs" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\start menu\programs\maintenance" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\start menu\programs\startup" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\application data\start menu\programs\system tools" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\desktop" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\documents" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\documents\my music" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\documents\my pictures" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\documents\my videos" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\start menu" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\start menu\programs\accessibility" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\start menu\programs\accessories" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\start menu\programs\accessories\system tools" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\start menu\programs\administrative tools" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\start menu\programs" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\start menu\programs\maintenance" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\start menu\programs\startup" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\application data\start menu\programs\system tools" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\desktop" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\documents" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\documents\my music" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\documents\my pictures" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\documents\my videos" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\start menu" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\start menu\programs\accessibility" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\start menu\programs\accessories" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\start menu\programs\accessories\system tools" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\start menu\programs\administrative tools" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\start menu\programs" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\start menu\programs\maintenance" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\start menu\programs\startup" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\all users\start menu\programs\system tools" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\default\appdata\roaming\microsoft\internet explorer\quick launch" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\default\application data\microsoft\internet explorer\quick launch" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\default\start menu\programs\accessibility" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\default\sendto" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\default\start menu\programs\accessories" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\default\start menu\programs\maintenance" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\default user\appdata\roaming\microsoft\internet explorer\quick launch" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\default\start menu\programs\windows powershell" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\default\start menu\programs\system tools" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\default user\application data\microsoft\internet explorer\quick launch" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\default user\sendto" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\default user\start menu\programs\accessibility" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\default user\start menu\programs\accessories" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\default user\start menu\programs\maintenance" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\default user\start menu\programs\system tools" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\default user\start menu\programs\windows powershell" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\fd1hvy\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\history" has a changed appearance.
    ...
    • VTI Actions
  • Folder "c:\documents and settings\fd1hvy\appdata\local\application data\application data\application data\application data\application data\application data\application data\application data\application data\application data\history" has a changed appearance.
    ...
    • VTI Actions
1/5
Persistence Installs system startup script or application -
  • Adds "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\application data\microsoft\windows\start menu\programs\startup\ryukreadme.html" to Windows startup folder.
    ...
    • VTI Actions
  • Adds "c:\documents and settings\all users\application data\application data\application data\application data\application data\application data\microsoft\windows\start menu\programs\startup\ryukreadme.html" to Windows startup folder.
    ...
    • VTI Actions
  • Adds "c:\documents and settings\all users\application data\application data\application data\application data\application data\microsoft\windows\start menu\programs\startup\ryukreadme.html" to Windows startup folder.
    ...
    • VTI Actions
  • Adds "c:\documents and settings\all users\application data\application data\application data\application data\microsoft\windows\start menu\programs\startup\ryukreadme.html" to Windows startup folder.
    ...
    • VTI Actions
  • Adds "c:\documents and settings\all users\application data\application data\application data\microsoft\windows\start menu\programs\startup\ryukreadme.html" to Windows startup folder.
    ...
    • VTI Actions
1/5
File System Creates an unusually large number of files -
1/5
Static Unparsable sections in file -
  • Static analyzer was unable to completely parse the analyzed file: C:\RyukReadMe.html.
    ...
1/5
Process Process crashed -
  • Process "c:\windows\system32\sihost.exe" crashed.
    ...
  • Process "c:\windows\system32\taskhostw.exe" crashed.
    ...
  • Process "c:\windows\system32\svchost.exe" crashed.
    ...
0/5
Process Enumerates running processes -

Screenshots

Monitored Processes

Process Graph

Process Graph Legend

Sample Information

ID #608092
MD5 0d194b223e038d4c652484549f613763 Copy to Clipboard
SHA1 19d367df7f0c3530c6650fe6355e3d9da3378419 Copy to Clipboard
SHA256 f871e78adf4f918eed72ba7938c010f74197504f0a04febdb35a9f4f10c49605 Copy to Clipboard
SSDeep 3072:+3wjyokoa2mPEc8Mwo8Y4UbADMi19Vi/+8BCouGM:Gwjy5pEc8MRb3AA2f Copy to Clipboard
ImpHash 7392bf63e0480c44b4cad34b59be5fdc Copy to Clipboard
Filename raEMQ.exe
File Size 207.50 KB
Sample Type Windows Exe (x86-64)

Analysis Information

Creation Time 2019-04-17 12:20 (UTC+2)
Analysis Duration 00:04:48
Number of Monitored Processes 84
Execution Successful True
Reputation Enabled True
WHOIS Enabled True
Local AV Enabled True
YARA Enabled True
Number of AV Matches 10
Number of YARA Matches 0
Termination Reason Timeout
Tags
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image