24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 28:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T49d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.Ryuk.Generic Sample 501e925e5de6… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 501e925e5de6…. Malware family: Ransom.Ryuk.Generic. Threat score 100/100. 20/28 AV engines flagged this file. 6 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/501e925e5de6c824b5eeccb3ccc5111cf6e312258c0877634935df06b9d0f8b9","keywords":["Malicious","Ransom.Ryuk.Generic","malware analysis","sandbox report","threat intelligence","501e925e5de6c824b5eeccb3ccc5111cf6e312258c0877634935df06b9d0f8b9"],"about":{"@type":"SoftwareApplication","name":"1.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"501e925e5de6c824b5eeccb3ccc5111cf6e312258c0877634935df06b9d0f8b9","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom.Ryuk.Generic","antivirusDetections":{"malicious":20,"total":28},"behavioralIndicators":{"malicious":6,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T860,"taskhost.exe" opened "Z:\1549528737201$MAPFAILURE" with delete access "taskhost.exe" opened "Z:\1549528737201$OK" with delete access "taskhost.exe" opened "C:\Documents and Settings\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\abcpy.ini" with delete access "taskhost.exe" opened "C:\Documents and Settings\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.ini" with delete access "taskhost.exe" opened "C:\Documents and Settings\All Users\Application Data\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Data1.cab" with delete access "taskhost.exe" opened "C:\Documents and Settings\All Users\Application Data\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.ini" with delete access "taskhost.exe" opened "C:\Documents and Settings\All Users\Application Data\Application Data\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.ini" with delete access "taskhost.exe" opened "C:\Documents and Settings\All Users\Application Data\Application Data\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Data1.cab" with delete access "taskhost.exe" opened "C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.ini" with delete access "taskhost.exe" opened "C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Data1.cab" with delete access "taskhost.exe" opened "C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Data1.cab" with delete access "taskhost.exe" opened "C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Data1.cab" with delete access "taskhost.exe" opened "C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Data1.cab" with delete access26:T673,Found string "FlsGetValue" (Source: 501e925e5de6c824b5eeccb3ccc5111cf6e312258c0877634935df06b9d0f8b9.bin, API is part of module: KERNELBASE.DLL) Found string "FlsSetValue" (Source: 501e925e5de6c824b5eeccb3ccc5111cf6e312258c0877634935df06b9d0f8b9.bin, API is part of module: KERNELBASE.DLL) Found string "InitializeCriticalSectionEx" (Source: 501e925e5de6c824b5eeccb3ccc5111cf6e312258c0877634935df06b9d0f8b9.bin, API is part of module: KERNELBASE.DLL) Found string "LCMapStringEx" (Source: 501e925e5de6c824b5eeccb3ccc5111cf6e312258c0877634935df06b9d0f8b9.bin, API is part of module: KERNELBASE.DLL) Found string "LocaleNameToLCID" (Source: 501e925e5de6c824b5eeccb3ccc5111cf6e312258c0877634935df06b9d0f8b9.bin, API is part of module: KERNELBASE.DLL) Found string "GetSystemDefaultLangID" (Source: 501e925e5de6c824b5eeccb3ccc5111cf6e312258c0877634935df06b9d0f8b9.bin, API is part of module: KERNELBASE.DLL) Found string "WaitForMultipleObjects" (Source: 501e925e5de6c824b5eeccb3ccc5111cf6e312258c0877634935df06b9d0f8b9.bin, API is part of module: KERNEL32.DLL) Found string "GetFileSizeEx" (Source: 501e925e5de6c824b5eeccb3ccc5111cf6e312258c0877634935df06b9d0f8b9.bin, API is part of module: KERNELBASE.DLL) Found string "MoveFileExW" (Source: 501e925e5de6c824b5eeccb3ccc5111cf6e312258c0877634935df06b9d0f8b9.bin, API is part of module: KERNEL32.DLL) Found string "CreateThread" (Source: 501e925e5de6c824b5eeccb3ccc5111cf6e312258c0877634935df06b9d0f8b9.bin, API is part of module: KERNELBASE.DLL) Found string "IsWow64Process" (Source: 501e925e5de6c824b5eeccb3ccc5111cf6e312258c0877634935df06b9d0f8b9.bin, API is part of module: KERNELBASE.DLL)27:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"501e925e5de6c824b5eeccb3ccc5111cf6e312258c0877634935df06b9d0f8b9","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791535068689,"unified_at":"2026-10-09T08:37:48.689Z","metadata":{"hashes":{"sha256":"501e925e5de6c824b5eeccb3ccc5111cf6e312258c0877634935df06b9d0f8b9","sha1":"9db96b1a4bff1ffc6b945360cc5cc363642ffc94","md5":"7a7b1300e8b5a10424e08958a6fc15c1","sha512":"ce80e5313fad830387fb758ebfbe5c77976532acfece81fc57978399261a5b6ffb3a89f0ded288483ce38f21bf9fa8f6052e4afeeec1ab202a809ecb7722eb30","ssdeep":"3072:4w+uP+koiS95i/V24DSIXmLIduzCqVFJNFcoh1P:zMe/V3+IW0Pm","ssdeep_chunks":["3072:4w+uP+k","3072:w+uP+ko","3072:+uP+koi","3072:uP+koiS","3072:P+koiS9","3072:+koiS95","3072:koiS95i","3072:oiS95i/","3072:iS95i/V","3072:S95i/V2","3072:95i/V24","3072:5i/V24D","3072:i/V24DS","3072:/V24DSI","3072:V24DSIX","3072:24DSIXm","3072:4DSIXmL","3072:DSIXmLI","3072:SIXmLId","3072:IXmLIdu","3072:XmLIduz","3072:mLIduzC","3072:LIduzCq","3072:IduzCqV","3072:duzCqVF","3072:uzCqVFJ","3072:zCqVFJN","3072:CqVFJNF","3072:qVFJNFc","3072:VFJNFco","3072:FJNFcoh","3072:JNFcoh1","3072:NFcoh1P","6144:4w+uP+k","6144:w+uP+ko","6144:+uP+koi","6144:uP+koiS","6144:P+koiS9","6144:+koiS95","6144:koiS95i","6144:oiS95i/","6144:iS95i/V","6144:S95i/V2","6144:95i/V24","6144:5i/V24D","6144:i/V24DS","6144:/V24DSI","6144:V24DSIX","6144:24DSIXm","6144:4DSIXmL","6144:DSIXmLI","6144:SIXmLId","6144:IXmLIdu","6144:XmLIduz","6144:mLIduzC","6144:LIduzCq","6144:IduzCqV","6144:duzCqVF","6144:uzCqVFJ","6144:zCqVFJN","6144:CqVFJNF","6144:qVFJNFc","6144:VFJNFco","6144:FJNFcoh","6144:JNFcoh1","6144:NFcoh1P","3072:zMe/V3+","3072:Me/V3+I","3072:e/V3+IW","3072:/V3+IW0","3072:V3+IW0P","3072:3+IW0Pm"],"imphash":"c7a0309d45fd007c2ce268b7218e075c"},"file_info":{"file_name":"1.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":155648,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1546461145000,"last_seen":1753895271000,"last_multi_scan":1753895271000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","criminal","filecoder","grimspider","jabaxsta","ransomware","ryuk"]},"stats":{"av":{"malicious_count":20,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":5},"sandbox_signatures":{"informative_count":9,"suspicious_count":14,"malicious_count":6,"total":29},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win64.Ransom","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[APT]/Win32.Ryuk","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1317641","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.Ryuk.0F4EF9A6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Ransomware.Ryuk-6688842-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.Ryuk.0F4EF9A6 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win64/Filecoder.Ryuk.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/LockFile.b","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Ransomware ( 00553fc91 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Ransom-Ryuk!7A7B1300E8B5","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.Cryptor.flsitr","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Trojan.GenericIH.S27775676","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Ransom-FAF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/Ransom.Ryuk.A.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanRansom.Cryptor","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_46.5","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Filecoder.Win64.47","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom.Ryuk.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"malicious","value":"References suspicious system modules"},{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"},{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"malicious","value":"Injects into remote processes"},{"type":"suspicious","value":"Contains ability to create a remote thread (often used for process injection)"},{"type":"suspicious","value":"Contains ability to write to a remote process"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Monitors specific registry key for changes"}],"sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 49081-223-0000000140007964\n SetUnhandledExceptionFilter@KERNEL32.dll at 49081-993-0000000140008414\n SetUnhandledExceptionFilter@KERNEL32.dll at 49081-409-000000014000823C\n SetUnhandledExceptionFilter@KERNEL32.dll at 49081-273-000000014000CAD8","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 49081-991-0000000140008120","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.dll at 49081-321-0000000140002365\n GetVersionExW@KERNEL32.dll at 49081-263-00000001400077A0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersionExW@KERNEL32.dll directly followed by \"cmp dword ptr [rsp+00000084h], 05h\" and \"jne 00000001400023F8h\" at 49081-321-0000000140002365\n Found API call GetVersionExW@KERNEL32.dll directly followed by \"cmp dword ptr [rsp+24h], 05h\" and \"jne 00000001400077EEh\" at 49081-263-00000001400077A0","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 49081-280-0000000140002B10","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"%USERPROFILE%\\Documents\\Visual Studio 2015\\Projects\\ConsoleApplication54new crypted\\x64\\Release\\ConsoleApplication54.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"conhost.exe\" (UID: 00029005-00002288) was launched with modified environment variables: \"TEMP, TMP, USERNAME\"\n Process \"conhost.exe\" (UID: 00029005-00002288) was launched with missing environment variables: \"LOCALAPPDATA, COMPUTERNAME, USERDOMAIN, LOGONSERVER, ALLUSERSPROFILE, ProgramData, HOMEPATH, APPDATA, HOMEDRIVE, USERPROFILE, PUBLIC\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%WINDIR%\\System32\\rsaenh.dll\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\".exe\" at 00028796-00003932-00000033-40997190640","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\".exe\" queried SystemProcessInformation at 00028796-00003932-00000033-4309326893","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 63 calls to GetProcAddress@KERNEL32.dll at 49081-240-0000000140005C60","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"taskhost.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"taskhost.exe\" read file \"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\abcpy.ini\"\n \"taskhost.exe\" read file \"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\setup.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Contains ability to create a remote thread (often used for process injection)","description":"CreateRemoteThread@KERNEL32.dll at 49081-277-0000000140003130","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1055","relevance":8,"id":"stream-5","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Contains ability to write to a remote process","description":"WriteProcessMemory@KERNEL32.dll at 49081-277-0000000140003130","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1055","relevance":8,"id":"stream-34","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\".exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\HwOrder\" (Filter: 4; Subtree: 0)\n \"taskhost.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\HwOrder\" (Filter: 4; Subtree: 0)\n \"dwm.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\HwOrder\" (Filter: 4; Subtree: 0)\n \"conhost.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\HwOrder\" (Filter: 4; Subtree: 0)","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.dll at 49081-280-0000000140002B10","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1215","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$25","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"OpenProcessToken\n CreateToolhelp32Snapshot\n VirtualAllocEx\n GetModuleFileNameW\n GetVersionExW\n IsDebuggerPresent\n LoadLibraryA\n CreateRemoteThread\n WriteProcessMemory\n OpenProcess\n GetCommandLineW\n UnhandledExceptionFilter\n LoadLibraryExW\n GetStartupInfoW\n DeleteFileW\n GetProcAddress\n Process32FirstW\n Process32NextW\n GetModuleHandleA\n FindNextFileW\n GetCommandLineA\n TerminateProcess\n FindFirstFileExW\n GetModuleHandleW\n GetModuleHandleExW\n WriteFile\n CreateFileW\n Sleep","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$26","origin":"File/Memory","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"501e925e5de6c824b5eeccb3ccc5111cf6e312258c0877634935df06b9d0f8b9.bin\" has a section named \".gfids\"","origin":"Static Parser","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"501e925e5de6c824b5eeccb3ccc5111cf6e312258c0877634935df06b9d0f8b9.bin\" (Offset: 31066)","origin":"Binary File","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"49/70 Antivirus vendors marked sample as malicious (70% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"49/70 Antivirus vendors marked sample as malicious (70% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into remote processes","description":"Injected into \"taskhost.exe\" at 2019-2-7.09:39:13.330 (UID: 00028937-00001640)\n Injected into \"dwm.exe\" at 2019-2-7.09:39:14.533 (UID: 00028970-00001880)\n Injected into \"conhost.exe\" at 2019-2-7.09:39:15.611 (UID: 00029005-00002288)\n Injected into \"conhost.exe\" at 2019-2-7.09:39:16.252 (UID: 00029044-00000628)\n Injected into \"conhost.exe\" at 2019-2-7.09:39:16.548 (UID: 00029083-00001200)","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":6,"id":"target-0","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\".exe\" wrote 3706880 bytes to a remote process \"%WINDIR%\\System32\\taskhost.exe\" (Handle: 172)\n \".exe\" wrote 3706880 bytes to a remote process \"%WINDIR%\\System32\\dwm.exe\" (Handle: 244)\n \".exe\" wrote 3706880 bytes to a remote process \"%WINDIR%\\System32\\conhost.exe\" (Handle: 252)\n \".exe\" wrote 3706880 bytes to a remote process \"%WINDIR%\\System32\\conhost.exe\" (Handle: 260)\n \".exe\" wrote 3706880 bytes to a remote process \"%WINDIR%\\System32\\conhost.exe\" (Handle: 268)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"level":"malicious","category":"Unusual Characteristics","name":"References suspicious system modules","description":"\"csrss.exe\"","origin":"File/Memory","mitre_attack_id":"T1215","relevance":5,"id":"string-24","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]}],"incidents":[{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Injects into remote processes"}],"sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"The input sample contains a known anti-VM trick"}],"sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]}]},"activity":{"stats":{"process_count":6,"spawned_processes_count":6,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":26,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":47,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["commodity","criminal","filecoder","grimspider","jabaxsta","ransomware","ryuk"],"sample_flags":["Multi-Process","Sample not shared","TOR analysis"],"sandbox_reports":[{"id":"5c3b94c67ca3e1145e3396f4","environment_id":100,"environment_description":"Windows 7 32 bit","state":"ERROR","error_type":"Cannot run a 64-bit native file on a 32-bit virtual machine","verdict":"undetected","submit_name":"501e925e5de6c824b5eeccb3ccc5111cf6e312258c0877634935df06b9d0f8b9","analysis_start_time":"2019-01-15T11:52:20+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"5c2d1fd87ca3e15f4b004e33","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Generic.Ransom.Ryuk2","submit_name":"1.exe","analysis_start_time":"2019-02-07T09:38:35+00:00","indicators_count":{"informative":9,"suspicious":14,"malicious":9},"tags":["Multi-Process","Sample not shared","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}],"processes":[{"pid":3932,"ppid":0,"name":"501e925e5de6c824b5eeccb3ccc5111cf6e312258c0877634935df06b9d0f8b9.exe","command_line":"","sha256":"501e925e5de6c824b5eeccb3ccc5111cf6e312258c0877634935df06b9d0f8b9","normalized_path":"C:\\501e925e5de6c824b5eeccb3ccc5111cf6e312258c0877634935df06b9d0f8b9.exe","uid":"00028796-00003932","icon":"$27"},{"pid":1640,"ppid":3932,"name":"taskhost.exe","command_line":"","normalized_path":"%WINDIR%\\System32\\taskhost.exe","parent_uid":"00028796-00003932","uid":"00028937-00001640"},{"pid":1880,"ppid":3932,"name":"dwm.exe","command_line":"","normalized_path":"%WINDIR%\\System32\\dwm.exe","parent_uid":"00028796-00003932","uid":"00028970-00001880"},{"pid":2288,"ppid":3932,"name":"conhost.exe","command_line":"\"8750381091782183694132184434-13172598703858131146389722013726589371021822205","normalized_path":"%WINDIR%\\System32\\conhost.exe","parent_uid":"00028796-00003932","uid":"00029005-00002288"},{"pid":628,"ppid":3932,"name":"conhost.exe","command_line":"\"-573597799216803429-1460793423-10470059681244051894-52842799510065539582043202737","normalized_path":"%WINDIR%\\System32\\conhost.exe","parent_uid":"00028796-00003932","uid":"00029044-00000628"},{"pid":1200,"ppid":3932,"name":"conhost.exe","command_line":"\"1366905141-418065807-16347867571223282755-294672603145719928-11202326211796901888","normalized_path":"%WINDIR%\\System32\\conhost.exe","parent_uid":"00028796-00003932","uid":"00029083-00001200"}],"all_imported_dlls":["shell32.dll","user32.dll","usp10.dll","msctf.dll","IPHLPAPI.DLL","nsi.dll","kernel32.dll","rpcrt4.dll","shlwapi.dll","lpk.dll","cryptsp.dll","rsaenh.dll","profapi.dll","cryptbase.dll","gdi32.dll","imm32.dll","ole32.dll","winnsi.dll","KernelBase.dll","msvcrt.dll","sechost.dll","api-ms-win-core-synch-l1-2-0.dll","mpr.dll","userenv.dll","ntdll.dll","advapi32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%PUBLIC%\\sys","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"%APPDATA%\\Microsoft\\Crypto","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-686412048-2446563785-1323799475-1001\\08e575673cce10c72090304839888e02_6b06490d-f9fd-424c-8b6d-83edc4369e89","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto\\RSA","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto\\RSA\\MachineKeys","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto\\RSA\\MachineKeys\\08e575673cce10c72090304839888e02_6b06490d-f9fd-424c-8b6d-83edc4369e89","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"C:\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"C:\\Users\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"%ALLUSERSPROFILE%\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\AIR\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\AIR\\Updater\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\ARM\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"C:\\share\\1549528737201$MAPFAILURE","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"C:\\share\\1549528737201$OK","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\abcpy.ini","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\AcroRead.msi","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\AcroRdrDCUpd1800920044.msp","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\Data1.cab","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\setup.ini","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"%ALLUSERSPROFILE%\\Application Data\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\setup.ini","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"%ALLUSERSPROFILE%\\Application Data\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\Data1.cab","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"%ALLUSERSPROFILE%\\Application Data\\Application Data\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\setup.ini","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"%ALLUSERSPROFILE%\\Application Data\\Application Data\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\Data1.cab","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"%ALLUSERSPROFILE%\\Application Data\\Application Data\\Application Data\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\setup.ini","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"%ALLUSERSPROFILE%\\Application Data\\Application Data\\Application Data\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\Data1.cab","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\abcpy.ini.RYK","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\setup.ini.RYK","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"%ALLUSERSPROFILE%\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\Data1.cab","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"%ALLUSERSPROFILE%\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\Data1.cab","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"%ALLUSERSPROFILE%\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\Data1.cab","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\AcroRead.msi.RYK","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\AcroRdrDCUpd1800920044.msp.RYK","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"%ALLUSERSPROFILE%\\Application Data\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\AcroRead.msi.RYK","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"%ALLUSERSPROFILE%\\Application Data\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\AcroRdrDCUpd1800920044.msp.RYK","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"%ALLUSERSPROFILE%\\Application Data\\Application Data\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\AcroRead.msi.RYK","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\Data1.cab.RYK","sources":[{"report_type":"sandbox","report_id":"5c2d1fd87ca3e15f4b004e33"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5c2d1fd87ca3e15f4b004e33"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Ransom.Ryuk.Generic Sample 501e925e5de6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 501e925e5de6…. Malware family: Ransom.Ryuk.Generic. Threat score 100/100. 20/28 AV engines flagged this file. 6 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/501e925e5de6c824b5eeccb3ccc5111cf6e312258c0877634935df06b9d0f8b9"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom.Ryuk.Generic Sample 501e925e5de6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 501e925e5de6…. Malware family: Ransom.Ryuk.Generic. Threat score 100/100. 20/28 AV engines flagged this file. 6 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/501e925e5de6c824b5eeccb3ccc5111cf6e312258c0877634935df06b9d0f8b9"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom.Ryuk.Generic Sample 501e925e5de6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 501e925e5de6…. Malware family: Ransom.Ryuk.Generic. Threat score 100/100. 20/28 AV engines flagged this file. 6 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L28","11",{}]]