24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2e:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4f9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 8dcca8c720fd… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 8dcca8c720fd…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 22/26 AV engines flagged this file. 11 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8dcca8c720fdb9833455427cd9b2146e2e9581e3bc595e8d97e562854133542b","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","8dcca8c720fdb9833455427cd9b2146e2e9581e3bc595e8d97e562854133542b"],"about":{"@type":"SoftwareApplication","name":"8dcca8c720fdb9833455427cd9b2146e2e9581e3bc595e8d97e562854133542b","applicationCategory":["peexe","executable"],"identifier":"8dcca8c720fdb9833455427cd9b2146e2e9581e3bc595e8d97e562854133542b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":22,"total":26},"behavioralIndicators":{"malicious":11,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T9b6,".exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") ".exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") ".exe" touched "Previous Versions Property Page" (Path: "HKCU\WOW6432NODE\CLSID\{596AB062-B4D2-4215-9F74-E9109B0A8153}\SHELLEX\MAYCHANGEDEFAULTMENU") ".exe" touched "Microsoft SendTo Service" (Path: "HKCU\WOW6432NODE\CLSID\{7BA4C740-9E81-11CF-99D3-00AA004AE837}\SHELLEX\MAYCHANGEDEFAULTMENU") ".exe" touched "Copy as Path Menu" (Path: "HKCU\WOW6432NODE\CLSID\{F3D06E7C-1E45-4A26-847E-F9FCDEE59BE0}\SHELLEX\MAYCHANGEDEFAULTMENU") ".exe" touched "Start Menu Pin" (Path: "HKCU\WOW6432NODE\CLSID\{A2A9545D-A0C2-42B4-9708-A0B2BADD77C8}\SHELLEX\MAYCHANGEDEFAULTMENU") ".exe" touched "Taskband Pin" (Path: "HKCU\WOW6432NODE\CLSID\{90AA3A4E-1CBA-4233-B8BB-535773D48449}\SHELLEX\MAYCHANGEDEFAULTMENU") ".exe" touched "Shell extensions for sharing" (Path: "HKCU\WOW6432NODE\CLSID\{F81E9010-6EA4-11CE-A7FF-00AA003CA9F6}\SHELLEX\MAYCHANGEDEFAULTMENU") ".exe" touched "Encryption Context Menu" (Path: "HKCU\WOW6432NODE\CLSID\{A470F8CF-A1E8-4F65-8335-227475AA5C46}\SHELLEX\MAYCHANGEDEFAULTMENU") ".exe" touched "Open With Context Menu Handler" (Path: "HKCU\WOW6432NODE\CLSID\{09799AFB-AD67-11D1-ABCD-00C04FC30936}\SHELLEX\MAYCHANGEDEFAULTMENU") ".exe" touched "Property System Both Class Factory" (Path: "HKCR\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") ".exe" touched "Briefcase" (Path: "HKCU\WOW6432NODE\CLSID\{85BBD920-42A0-1069-A2E4-08002B30309D}\SHELLEX\MAYCHANGEDEFAULTMENU") ".exe" touched "7-Zip Shell Extension" (Path: "HKCU\WOW6432NODE\CLSID\{23170F69-40C1-278A-1000-000100020000}\SHELLEX\MAYCHANGEDEFAULTMENU") ".exe" touched "CompatContextMenu Class" (Path: "HKCU\WOW6432NODE\CLSID\{1D27F844-3A1F-4410-85AC-14651078412D}\SHELLEX\MAYCHANGEDEFAULTMENU") ".exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "DismHost.exe" touched "PSDispatch" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{00020420-0000-0000-C000-000000000046}") "DismHost.exe" touched "PSSupportErrorInfo" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{DF0B3D60-548F-101B-8E65-08002B2BD119}\TREATAS")26:T513,Process "winlogon.exe" (UID: 00065178-00002380) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "winlogon.exe" (UID: 00065178-00002380) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "iexplore.exe" (UID: 00068907-00003364) was launched with modified environment variables: "Path" Process "iexplore.exe" (UID: 00068961-00003480) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "iexplore.exe" (UID: 00068961-00003480) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "DismHost.exe" (UID: 00072114-00002068) was launched with modified environment variables: "Path, LOCALAPPDATA, USERDOMAIN, TEMP, APPDATA, USERPROFILE, TMP" Process "DismHost.exe" (UID: 00072114-00002068) was launched with missing environment variables: "LOGONSERVER, HOMEPATH, HOMEDRIVE" Process "iexplore.exe" (UID: 00073538-00000920) was launched with new environment variables: "LOGONSERVER="\\HAPUBWS-PC", HOMEPATH="\Users\FHhHjzb", HOMEDRIVE="C:"" Process "iexplore.exe" (UID: 00073538-00000920) was launched with modified environment variables: "Path, LOCALAPPDATA, USERDOMAIN, TEMP, APPDATA, USERPROFILE, TMP"27:T911,Spawned process "winlogon.exe" (UID: 00065178-00002380) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c ""%PUBLIC%\desktop.bat" "" (UID: 00065612-00003428) Spawned process "reg.exe" with commandline "REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVer ..." (UID: 00065619-00003448), Spawned process "reg.exe" with commandline "REG DELETE "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Current ..." (UID: 00068830-00001772) Spawned process "reg.exe" with commandline "REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVer ..." (UID: 00068832-00001968), Spawned process "iexplore.exe" with commandline "%USERPROFILE%\Desktop\DECRYPT_INFORMATION.html" (UID: 00068907-00003364), Spawned process "iexplore.exe" with commandline "SCODEF:3364 CREDAT:275457 /prefetch:2" (UID: 00068961-00003480), Spawned process "iexplore.exe" with commandline "SCODEF:3364 CREDAT:537602 /prefetch:2" (UID: 00070084-00002952), Spawned process "iexplore.exe" with commandline "SCODEF:3364 CREDAT:472067 /prefetch:2" (UID: 00070146-00002252), Spawned process "iexplore.exe" with commandline "SCODEF:3364 CREDAT:275471 /prefetch:2" (UID: 00072010-00002652), Spawned process "DismHost.exe" with commandline "{86225F72-7ACC-41C6-AD6F-F889AEC7699B}" (UID: 00072114-00002068), Spawned process "iexplore.exe" with commandline "SCODEF:3364 CREDAT:406547 /prefetch:2" (UID: 00073538-00000920), Spawned process "iexplore.exe" with commandline "SCODEF:3364 CREDAT:275481 /prefetch:2" (UID: 00073541-00001216), Spawned process "iexplore.exe" with commandline "SCODEF:3364 CREDAT:472073 /prefetch:2" (UID: 00073927-00002296), Spawned process "iexplore.exe" with commandline "SCODEF:3364 CREDAT:340996 /prefetch:2" (UID: 00073932-00003512), Spawned process "iexplore.exe" with commandline "SCODEF:3364 CREDAT:209930 /prefetch:2" (UID: 00075852-00000296), Spawned process "iexplore.exe" with commandline "SCODEF:3364 CREDAT:537624 /prefetch:2" (UID: 00075858-00002448), Spawned process "iexplore.exe" with commandline "SCODEF:3364 CREDAT:341019 /prefetch:2" (UID: 00077890-00000320), Spawned process "iexplore.exe" with commandline "SCODEF:3364 CREDAT:537633 /prefetch:2" (UID: 00077895-00003800), Spawned process "iexplore.exe" with commandline "SCODEF:3364 CREDAT:406565 /prefetch:2" (UID: 00079161-00003420)28:T911,Spawned process "winlogon.exe" (UID: 00065178-00002380) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c ""%PUBLIC%\desktop.bat" "" (UID: 00065612-00003428) Spawned process "reg.exe" with commandline "REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVer ..." (UID: 00065619-00003448), Spawned process "reg.exe" with commandline "REG DELETE "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Current ..." (UID: 00068830-00001772) Spawned process "reg.exe" with commandline "REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVer ..." (UID: 00068832-00001968), Spawned process "iexplore.exe" with commandline "%USERPROFILE%\Desktop\DECRYPT_INFORMATION.html" (UID: 00068907-00003364), Spawned process "iexplore.exe" with commandline "SCODEF:3364 CREDAT:275457 /prefetch:2" (UID: 00068961-00003480), Spawned process "iexplore.exe" with commandline "SCODEF:3364 CREDAT:537602 /prefetch:2" (UID: 00070084-00002952), Spawned process "iexplore.exe" with commandline "SCODEF:3364 CREDAT:472067 /prefetch:2" (UID: 00070146-00002252), Spawned process "iexplore.exe" with commandline "SCODEF:3364 CREDAT:275471 /prefetch:2" (UID: 00072010-00002652), Spawned process "DismHost.exe" with commandline "{86225F72-7ACC-41C6-AD6F-F889AEC7699B}" (UID: 00072114-00002068), Spawned process "iexplore.exe" with commandline "SCODEF:3364 CREDAT:406547 /prefetch:2" (UID: 00073538-00000920), Spawned process "iexplore.exe" with commandline "SCODEF:3364 CREDAT:275481 /prefetch:2" (UID: 00073541-00001216), Spawned process "iexplore.exe" with commandline "SCODEF:3364 CREDAT:472073 /prefetch:2" (UID: 00073927-00002296), Spawned process "iexplore.exe" with commandline "SCODEF:3364 CREDAT:340996 /prefetch:2" (UID: 00073932-00003512), Spawned process "iexplore.exe" with commandline "SCODEF:3364 CREDAT:209930 /prefetch:2" (UID: 00075852-00000296), Spawned process "iexplore.exe" with commandline "SCODEF:3364 CREDAT:537624 /prefetch:2" (UID: 00075858-00002448), Spawned process "iexplore.exe" with commandline "SCODEF:3364 CREDAT:341019 /prefetch:2" (UID: 00077890-00000320), Spawned process "iexplore.exe" with commandline "SCODEF:3364 CREDAT:537633 /prefetch:2" (UID: 00077895-00003800), Spawned process "iexplore.exe" with commandline "SCODEF:3364 CREDAT:406565 /prefetch:2" (UID: 00079161-00003420)29:T4c8,".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db" "winlogon.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "winlogon.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "winlogon.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "winlogon.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "winlogon.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db" "cmd.exe" touched file "C:\Windows\SysWOW64\en-US\cmd.exe.mui" "reg.exe" touched file "C:\Windows\SysWOW64\en-US\reg.exe.mui" "reg.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "reg.exe" touched file "C:\Windows\SysWOW64\en-US\KernelBase.dll.mui"2a:T19c9,"rticle>

All your important files are encrypted

Your files has been encrypted using RSA2048 algorithm with unique public-key stored on your PC.

There is only one way to get your files back: contact with us, pay, and get decryptor software.

You have "UNIQUE_ID_DO_NOT_REMOVE" file on your desktop also it duplicated in some folders,

its your unique idkey, attach it to letter when contact with us. Also you can decrypt 3 files for test.

We accept Bitcoin, you can find exchangers on https://www.bitcoin.com/buy-bitcoin and others.

Contact information:

HERMES RANSOMWARE

All your important files are encrypted

Your files has been encrypted using RSA2048 algorithm with unique public-key stored on your PC.

There is only one way to get your files back: contact with us, pay, and get decryptor software.

You have "UNIQUE_ID_DO_NOT_REMOVE" file on your desktop also it duplicated in some folders,

its your unique idkey, attach it to letter when contact with us. Also you can decrypt 3 files for test.

We accept Bitcoin, you can find exchangers on https://www.bitcoin.com/buy-bitcoin and others.

Contact information:

primary email: BM-2cTS5JCRd3c1NDtXHmHGzxiPjCprGjJiWW@bitmessage.ch

reserve email: x2837503827@india.com

" (Source: DECRYPT_INFORMATION.html, Indicator: "files are encrypted") "HERMES RANSOMWARE

All your important files are encrypted

Your files has been encrypted using RSA2048 algorithm with unique public-key stored on your PC.

There is only one way to get your files back: contact with us, pay, and get decryptor software.

You have "UNIQUE_ID_DO_NOT_REMOVE" file on your desktop also it duplicated in some folders,

its your unique idkey, attach it to letter when contact with us. Also you can decrypt 3 files for test.

We accept Bitcoin, you can find exchangers on https://www.bitcoin.com/buy-bitcoin and others.

Contact information:

primary email: BM-2cTS5JCRd3c1NDtXHmHGzxiPjCprGjJiWW@bitmessage.ch

reserve email: x2837503827@india.com