24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 28:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T49c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.Ryuk.Generic Sample fe909d18cf0f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample fe909d18cf0f…. Malware family: Ransom.Ryuk.Generic. Threat score 100/100. 21/28 AV engines flagged this file. 6 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b","keywords":["Malicious","Ransom.Ryuk.Generic","malware analysis","sandbox report","threat intelligence","fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","64bits","executable"],"identifier":"fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom.Ryuk.Generic","antivirusDetections":{"malicious":21,"total":28},"behavioralIndicators":{"malicious":6,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Ta41,"taskhost.exe" opened "Z:\1549527710897$MAPFAILURE" with delete access "taskhost.exe" opened "Z:\1549527710897$OK" with delete access "taskhost.exe" opened "C:\Documents and Settings\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\abcpy.ini" with delete access "taskhost.exe" opened "C:\Documents and Settings\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.ini" with delete access "taskhost.exe" opened "C:\Documents and Settings\All Users\Application Data\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\AcroRdrDCUpd1800920044.msp" with delete access "taskhost.exe" opened "C:\Documents and Settings\All Users\Application Data\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Data1.cab" with delete access "taskhost.exe" opened "C:\Documents and Settings\All Users\Application Data\Application Data\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\AcroRdrDCUpd1800920044.msp" with delete access "taskhost.exe" opened "C:\Documents and Settings\All Users\Application Data\Application Data\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Data1.cab" with delete access "taskhost.exe" opened "C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\AcroRdrDCUpd1800920044.msp" with delete access "taskhost.exe" opened "C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\AcroRdrDCUpd1800920044.msp" with delete access "taskhost.exe" opened "C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\AcroRdrDCUpd1800920044.msp" with delete access "taskhost.exe" opened "C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\AcroRdrDCUpd1800920044.msp" with delete access "taskhost.exe" opened "C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\AcroRdrDCUpd1800920044.msp" with delete access "taskhost.exe" opened "C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\AcroRdrDCUpd1800920044.msp" with delete access26:T673,Found string "FlsGetValue" (Source: fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.bin, API is part of module: KERNELBASE.DLL) Found string "FlsSetValue" (Source: fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.bin, API is part of module: KERNELBASE.DLL) Found string "InitializeCriticalSectionEx" (Source: fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.bin, API is part of module: KERNELBASE.DLL) Found string "LCMapStringEx" (Source: fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.bin, API is part of module: KERNELBASE.DLL) Found string "LocaleNameToLCID" (Source: fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.bin, API is part of module: KERNELBASE.DLL) Found string "GetSystemDefaultLangID" (Source: fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.bin, API is part of module: KERNELBASE.DLL) Found string "WaitForMultipleObjects" (Source: fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.bin, API is part of module: KERNEL32.DLL) Found string "GetFileSizeEx" (Source: fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.bin, API is part of module: KERNELBASE.DLL) Found string "MoveFileExW" (Source: fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.bin, API is part of module: KERNEL32.DLL) Found string "CreateThread" (Source: fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.bin, API is part of module: KERNELBASE.DLL) Found string "IsWow64Process" (Source: fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.bin, API is part of module: KERNELBASE.DLL)27:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791518742576,"unified_at":"2026-10-09T04:05:42.576Z","metadata":{"hashes":{"sha256":"fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b","sha1":"f3fa5d5942e5085586d7fcc496d3fad7804abcc2","md5":"40492c178079e65dfd5449bf899413b6","sha512":"986881496dcdfefc0b0cd20e2f0700368caec03a4f93889b5d3b8d345bffb0562c5d3e8584b96443e5e83eb3844d8f0851299986cb8c8b1c0b51e5e1970cf67a","ssdeep":"3072:JbGinb2ko74hs/p2MbDVdXzF51dbzCqVaxNFd2FpeFOP:kIeR/p2Ghd5jEB2Fpe2","ssdeep_chunks":["3072:JbGinb2","3072:bGinb2k","3072:Ginb2ko","3072:inb2ko7","3072:nb2ko74","3072:b2ko74h","3072:2ko74hs","3072:ko74hs/","3072:o74hs/p","3072:74hs/p2","3072:4hs/p2M","3072:hs/p2Mb","3072:s/p2MbD","3072:/p2MbDV","3072:p2MbDVd","3072:2MbDVdX","3072:MbDVdXz","3072:bDVdXzF","3072:DVdXzF5","3072:VdXzF51","3072:dXzF51d","3072:XzF51db","3072:zF51dbz","3072:F51dbzC","3072:51dbzCq","3072:1dbzCqV","3072:dbzCqVa","3072:bzCqVax","3072:zCqVaxN","3072:CqVaxNF","3072:qVaxNFd","3072:VaxNFd2","3072:axNFd2F","3072:xNFd2Fp","3072:NFd2Fpe","3072:Fd2FpeF","3072:d2FpeFO","3072:2FpeFOP","6144:JbGinb2","6144:bGinb2k","6144:Ginb2ko","6144:inb2ko7","6144:nb2ko74","6144:b2ko74h","6144:2ko74hs","6144:ko74hs/","6144:o74hs/p","6144:74hs/p2","6144:4hs/p2M","6144:hs/p2Mb","6144:s/p2MbD","6144:/p2MbDV","6144:p2MbDVd","6144:2MbDVdX","6144:MbDVdXz","6144:bDVdXzF","6144:DVdXzF5","6144:VdXzF51","6144:dXzF51d","6144:XzF51db","6144:zF51dbz","6144:F51dbzC","6144:51dbzCq","6144:1dbzCqV","6144:dbzCqVa","6144:bzCqVax","6144:zCqVaxN","6144:CqVaxNF","6144:qVaxNFd","6144:VaxNFd2","6144:axNFd2F","6144:xNFd2Fp","6144:NFd2Fpe","6144:Fd2FpeF","6144:d2FpeFO","6144:2FpeFOP","3072:kIeR/p2","3072:IeR/p2G","3072:eR/p2Gh","3072:R/p2Ghd","3072:/p2Ghd5","3072:p2Ghd5j","3072:2Ghd5jE","3072:Ghd5jEB","3072:hd5jEB2","3072:d5jEB2F","3072:5jEB2Fp","3072:jEB2Fpe","3072:EB2Fpe2"],"imphash":"c7a0309d45fd007c2ce268b7218e075c"},"file_info":{"file_name":"file","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":156160,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1546408997000,"last_seen":1677901596000,"last_multi_scan":1677901596000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","criminal","filecoder","grimspider","jabaxsta","ransomware","ryuk"]},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":5},"sandbox_signatures":{"informative_count":9,"suspicious_count":14,"malicious_count":6,"total":29},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win64.Ransom","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/Win32.Cryptor","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1209841","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.Ryuk.A2C641F4","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Ransomware.Ryuk-6688842-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W64/Ransom.Ryuk.A.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.Ryuk.A2C641F4 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win64/Filecoder.Ryuk.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/LockFile.b","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Ransomware ( 00553fc91 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Ransom-Ryuk!40492C178079","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.Cryptor.flpndp","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Ransom-FAF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom.B22C76FC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom.B22C76FC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanRansom.Vigorf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Filecoder.Win64.8903","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom.Ryuk.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"malicious","value":"References suspicious system modules"},{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"},{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Injects into remote processes"},{"type":"suspicious","value":"Contains ability to create a remote thread (often used for process injection)"},{"type":"suspicious","value":"Contains ability to write to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Monitors specific registry key for changes"}],"sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 40822-223-0000000140007964\n SetUnhandledExceptionFilter@KERNEL32.dll at 40822-987-0000000140008414\n SetUnhandledExceptionFilter@KERNEL32.dll at 40822-405-000000014000823C\n SetUnhandledExceptionFilter@KERNEL32.dll at 40822-273-000000014000CAD8","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 40822-985-0000000140008120","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.dll at 40822-263-00000001400077A0\n GetVersionExW@KERNEL32.dll at 40822-316-0000000140002365","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersionExW@KERNEL32.dll directly followed by \"cmp dword ptr [rsp+24h], 05h\" and \"jne 00000001400077EEh\" at 40822-263-00000001400077A0\n Found API call GetVersionExW@KERNEL32.dll directly followed by \"cmp dword ptr [rsp+00000084h], 05h\" and \"jne 00000001400023F8h\" at 40822-316-0000000140002365","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 40822-280-0000000140002B10","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"%USERPROFILE%\\Documents\\Visual Studio 2015\\Projects\\ConsoleApplication54new crypted\\x64\\Release\\ConsoleApplication54.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"conhost.exe\" (UID: 00030171-00000348) was launched with modified environment variables: \"TEMP, TMP, USERNAME\"\n Process \"conhost.exe\" (UID: 00030171-00000348) was launched with missing environment variables: \"LOCALAPPDATA, COMPUTERNAME, USERDOMAIN, LOGONSERVER, ALLUSERSPROFILE, ProgramData, HOMEPATH, APPDATA, HOMEDRIVE, USERPROFILE, PUBLIC\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%WINDIR%\\System32\\rsaenh.dll\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\".exe\" at 00029924-00003916-00000033-41387271809","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\".exe\" queried SystemProcessInformation at 00029924-00003916-00000033-5290017666","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 63 calls to GetProcAddress@KERNEL32.dll at 40822-240-0000000140005C60","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"taskhost.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"taskhost.exe\" read file \"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\abcpy.ini\"\n \"taskhost.exe\" read file \"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\setup.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Contains ability to create a remote thread (often used for process injection)","description":"CreateRemoteThread@KERNEL32.dll at 40822-277-0000000140003130","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1055","relevance":8,"id":"stream-5","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Contains ability to write to a remote process","description":"WriteProcessMemory@KERNEL32.dll at 40822-277-0000000140003130","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1055","relevance":8,"id":"stream-34","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\".exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\HwOrder\" (Filter: 4; Subtree: 0)\n \"taskhost.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\HwOrder\" (Filter: 4; Subtree: 0)\n \"dwm.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\HwOrder\" (Filter: 4; Subtree: 0)\n \"conhost.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\HwOrder\" (Filter: 4; Subtree: 0)","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.dll at 40822-280-0000000140002B10","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1215","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$25","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"OpenProcessToken\n CreateToolhelp32Snapshot\n VirtualAllocEx\n GetModuleFileNameW\n GetVersionExW\n IsDebuggerPresent\n LoadLibraryA\n CreateRemoteThread\n WriteProcessMemory\n OpenProcess\n GetCommandLineW\n UnhandledExceptionFilter\n LoadLibraryExW\n GetStartupInfoW\n DeleteFileW\n GetProcAddress\n Process32FirstW\n Process32NextW\n GetModuleHandleA\n FindNextFileW\n GetCommandLineA\n TerminateProcess\n FindFirstFileExW\n GetModuleHandleW\n GetModuleHandleExW\n WriteFile\n CreateFileW\n Sleep","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$26","origin":"File/Memory","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.bin\" has a section named \".gfids\"","origin":"Static Parser","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.bin\" (Offset: 31066)","origin":"Binary File","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"44/69 Antivirus vendors marked sample as malicious (63% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"44/69 Antivirus vendors marked sample as malicious (63% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into remote processes","description":"Injected into \"taskhost.exe\" at 2019-2-7.09:22:31.611 (UID: 00030100-00001640)\n Injected into \"dwm.exe\" at 2019-2-7.09:22:33.189 (UID: 00030134-00001880)\n Injected into \"conhost.exe\" at 2019-2-7.09:22:33.955 (UID: 00030171-00000348)\n Injected into \"conhost.exe\" at 2019-2-7.09:22:34.783 (UID: 00030215-00001512)\n Injected into \"conhost.exe\" at 2019-2-7.09:22:35.236 (UID: 00030292-00003688)","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":6,"id":"target-0","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\".exe\" wrote 3710976 bytes to a remote process \"%WINDIR%\\System32\\taskhost.exe\" (Handle: 172)\n \".exe\" wrote 3710976 bytes to a remote process \"%WINDIR%\\System32\\dwm.exe\" (Handle: 248)\n \".exe\" wrote 3710976 bytes to a remote process \"%WINDIR%\\System32\\conhost.exe\" (Handle: 256)\n \".exe\" wrote 3710976 bytes to a remote process \"%WINDIR%\\System32\\conhost.exe\" (Handle: 264)\n \".exe\" wrote 3710976 bytes to a remote process \"%WINDIR%\\System32\\conhost.exe\" (Handle: 272)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"level":"malicious","category":"Unusual Characteristics","name":"References suspicious system modules","description":"\"csrss.exe\"","origin":"File/Memory","mitre_attack_id":"T1215","relevance":5,"id":"string-24","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]}],"incidents":[{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Injects into remote processes"}],"sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"The input sample contains a known anti-VM trick"}],"sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]}]},"activity":{"stats":{"process_count":6,"spawned_processes_count":6,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":26,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":45,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["commodity","criminal","filecoder","grimspider","jabaxsta","ransomware","ryuk"],"sample_flags":["Multi-Process","TOR analysis"],"sandbox_reports":[{"id":"5c2c55037ca3e159525279d7","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Generic.Ransom.Ryuk2","submit_name":"fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe","analysis_start_time":"2019-02-07T09:21:30+00:00","indicators_count":{"informative":9,"suspicious":14,"malicious":9},"tags":["Multi-Process","TOR analysis"],"is_in_unified_schema":true},{"id":"5c2c54257ca3e158851182fd","environment_id":100,"environment_description":"Windows 7 32 bit","state":"ERROR","error_type":"Cannot run a 64-bit native file on a 32-bit virtual machine","verdict":"undetected","submit_name":"fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe","analysis_start_time":"2019-01-13T19:43:06+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}],"processes":[{"pid":3916,"ppid":0,"name":"fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe","command_line":"","sha256":"fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b","normalized_path":"C:\\fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe","uid":"00029924-00003916","icon":"$27"},{"pid":1640,"ppid":3916,"name":"taskhost.exe","command_line":"","normalized_path":"%WINDIR%\\System32\\taskhost.exe","parent_uid":"00029924-00003916","uid":"00030100-00001640"},{"pid":1880,"ppid":3916,"name":"dwm.exe","command_line":"","normalized_path":"%WINDIR%\\System32\\dwm.exe","parent_uid":"00029924-00003916","uid":"00030134-00001880"},{"pid":348,"ppid":3916,"name":"conhost.exe","command_line":"\"8750381091782183694132184434-13172598703858131146389722013726589371021822205","normalized_path":"%WINDIR%\\System32\\conhost.exe","parent_uid":"00029924-00003916","uid":"00030171-00000348"},{"pid":1512,"ppid":3916,"name":"conhost.exe","command_line":"\"-573597799216803429-1460793423-10470059681244051894-52842799510065539582043202737","normalized_path":"%WINDIR%\\System32\\conhost.exe","parent_uid":"00029924-00003916","uid":"00030215-00001512"},{"pid":3688,"ppid":3916,"name":"conhost.exe","command_line":"\"652992061-1554441168-4572025961276226002-1992435954-1116754706-618620088544317023","normalized_path":"%WINDIR%\\System32\\conhost.exe","parent_uid":"00029924-00003916","uid":"00030292-00003688"}],"all_imported_dlls":["shlwapi.dll","gdi32.dll","imm32.dll","msctf.dll","rsaenh.dll","ntdll.dll","shell32.dll","user32.dll","lpk.dll","mpr.dll","nsi.dll","userenv.dll","profapi.dll","msvcrt.dll","usp10.dll","api-ms-win-core-synch-l1-2-0.dll","ole32.dll","winnsi.dll","cryptbase.dll","kernel32.dll","KernelBase.dll","IPHLPAPI.DLL","cryptsp.dll","advapi32.dll","sechost.dll","rpcrt4.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%PUBLIC%\\sys","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"%APPDATA%\\Microsoft\\Crypto","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-686412048-2446563785-1323799475-1001\\08e575673cce10c72090304839888e02_6b06490d-f9fd-424c-8b6d-83edc4369e89","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto\\RSA","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto\\RSA\\MachineKeys","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto\\RSA\\MachineKeys\\08e575673cce10c72090304839888e02_6b06490d-f9fd-424c-8b6d-83edc4369e89","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"C:\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"C:\\Users\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"%ALLUSERSPROFILE%\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\AIR\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\AIR\\Updater\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\ARM\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\RyukReadMe.txt","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"C:\\share\\1549527710897$MAPFAILURE","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"C:\\share\\1549527710897$OK","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\abcpy.ini","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\AcroRdrDCUpd1800920044.msp","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\AcroRead.msi","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\Data1.cab","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\setup.ini","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\abcpy.ini.RYK","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"%ALLUSERSPROFILE%\\Application Data\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\AcroRdrDCUpd1800920044.msp","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"%ALLUSERSPROFILE%\\Application Data\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\Data1.cab","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\setup.ini.RYK","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"%ALLUSERSPROFILE%\\Application Data\\Application Data\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\AcroRdrDCUpd1800920044.msp","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"%ALLUSERSPROFILE%\\Application Data\\Application Data\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\Data1.cab","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"%ALLUSERSPROFILE%\\Application Data\\Application Data\\Application Data\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\AcroRdrDCUpd1800920044.msp","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"%ALLUSERSPROFILE%\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\AcroRdrDCUpd1800920044.msp","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"%ALLUSERSPROFILE%\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\AcroRdrDCUpd1800920044.msp","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"%ALLUSERSPROFILE%\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\AcroRdrDCUpd1800920044.msp","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"%ALLUSERSPROFILE%\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\AcroRdrDCUpd1800920044.msp","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"%ALLUSERSPROFILE%\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\AcroRdrDCUpd1800920044.msp","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\AcroRdrDCUpd1800920044.msp.RYK","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\AcroRead.msi.RYK","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]},{"path":"%ALLUSERSPROFILE%\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\Data1.cab.RYK","sources":[{"report_type":"sandbox","report_id":"5c2c55037ca3e159525279d7"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5c2c55037ca3e159525279d7"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Ransom.Ryuk.Generic Sample fe909d18cf0f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample fe909d18cf0f…. Malware family: Ransom.Ryuk.Generic. Threat score 100/100. 21/28 AV engines flagged this file. 6 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom.Ryuk.Generic Sample fe909d18cf0f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample fe909d18cf0f…. Malware family: Ransom.Ryuk.Generic. Threat score 100/100. 21/28 AV engines flagged this file. 6 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom.Ryuk.Generic Sample fe909d18cf0f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample fe909d18cf0f…. Malware family: Ransom.Ryuk.Generic. Threat score 100/100. 21/28 AV engines flagged this file. 6 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L28","11",{}]]