Modify Registry
Software Packing
PnbkiTYYJ8UbA9a3.exe
Windows Exe (x86-32)
Created 5 years ago
VMRay Threat Identifiers (12 rules, 39 matches)
| Severity | Category | Operation | Count | Classification | |
|---|---|---|---|---|---|
5/5 | Defense Evasion | Bypasses Windows User Account Control (UAC) | 1 | - | |
5/5 | User Data Modification | Encrypts content of user files | 1 | Ransomware | |
5/5 | Antivirus | Malicious content was detected by heuristic scan | 1 | - | |
4/5 | User Data Modification | Modifies Windows automatic backups | 1 | - | |
2/5 | Obfuscation | Resolves APIs dynamically to possibly evade static detection | 1 | - | |
2/5 | Anti Analysis | Tries to detect debugger | 2 | - | |
1/5 | Mutex | Creates mutex | 1 | - | |
1/5 | Discovery | Reads SMB connection information | 27 | - | |
1/5 | Network Connection | Performs DNS request | 1 | - | |
1/5 | System Modification | Creates an unusually large number of files | 1 | - | |
Screenshots
Monitored Processes
MITRE ATT&CK™ Matrix - Windows
ActiveAll
Version: 2019-04-25 20:53:07.719000
Initial Access
Execution
Persistence
Privilege Escalation
Defense Evasion
Credential Access
Discovery
Network Share Discovery
System Network Connections Discovery
System Network Configuration Discovery
Process Discovery
Lateral Movement
Collection
Command and Control
Standard Application Layer Protocol
Standard Cryptographic Protocol
Exfiltration
Impact
Data Encrypted for Impact
Inhibit System Recovery
Sample Information
| ID | #1067338 |
| MD5 | |
| SHA1 | |
| SHA256 | |
| SSDeep | |
| ImpHash | |
| Filename | PnbkiTYYJ8UbA9a3.exe |
| File Size | 2058.84 KB |
| Sample Type | Windows Exe (x86-32) |
Analysis Information
| Creation Time | 2020-06-30 14:06 (UTC+) |
| Analysis Duration | 00:03:49 |
| Number of Monitored Processes | 8 |
| Execution Successful |  |
| Reputation Enabled | |
| WHOIS Enabled |  |
| Local AV Enabled | |
| Local AV Applied On | Sample Files, PCAP File, Downloaded Files, Dropped Files, Modified Files, Memory Dumps |
| YARA Enabled | |
| YARA Applied On | Sample Files, PCAP File, Downloaded Files, Dropped Files, Modified Files, Memory Dumps |
| Number of AV Matches | 19 |
| Number of YARA Matches | 0 |
| Termination Reason | Timeout |
