1e751530...58d7

File (17)

»

Filename	Hash	Operations	Category	Severity
C:\Users\FD1HVy\AppData\Roaming\guard.exe	MD5: bcf68fc7b257c2d255dc2d398884d0cd SHA1: 970df639d3d4b32123e461b66fd3b46d033270bc SHA256: 7a29cd4e548323a74f28854ce4115dabb874334025abac084fed50f7902d54b3 SSDeep: 192:KFaQ090n4k/hX0hK8Q5fbFPcQInE5YrY/gi45OCE53x7jIrfmOG:6alTk+hKV5zFpIE5h/gv5OpLjqft ImpHash: f34d5f2d4577ed6d9ceec516c1f5a744	Access, Create, Write	Dropped File	Malicious
C:\Users\FD1HVy\Desktop\Creepy Ransomware.exe	MD5: 4ee61d7f7480583c3552296597b1f160 SHA1: 13aee3c6a19022d0fbd0c5f3d768f4db848a10d4 SHA256: 1e751530eccc5c6424c1e5611d2b17b2fe3e8879ef01395aa9809ef6472b58d7 SSDeep: 1536:sq9dtmb8FK9leDN5qAiIAUWTy+UCKmnYJp47+A9NWCWBXz:s2dtm6KHeDN5qAiIVWWHtmYJp47+A9N8 ImpHash: f34d5f2d4577ed6d9ceec516c1f5a744		Sample File	Malicious
C:\ProgramData\Datas	-	Access		Not Available
C:\ProgramData\Datas\Creepy Ransomware.exe	-	Access, Delete		Not Available
C:\Users\FD1HVy\AppData\Local\Docs	-	Access		Not Available
C:\Users\FD1HVy\AppData\Local\Docs\Creepy Ransomware.exe	-	Access, Delete		Not Available
C:\Users\FD1HVy\AppData\Local\Temp\Traces	-	Access		Not Available
C:\Users\FD1HVy\AppData\Local\Temp\Traces\Creepy Ransomware.exe	-	Access, Delete		Not Available
C:\Users\FD1HVy\AppData\Local\Temp\powkdsx	-	Access		Not Available
C:\Users\FD1HVy\AppData\Local\Temp\powkdsx\Creepy Ransomware.exe	-	Access, Delete		Not Available
C:\Users\FD1HVy\AppData\Roaming\eu29	-	Access		Not Available
C:\Users\FD1HVy\AppData\Roaming\eu29\Creepy Ransomware.exe	-	Access, Delete		Not Available
C:\Users\FD1HVy\AppData\Roaming\guard.exe.config	-	Access		Not Available
C:\Users\FD1HVy\Desktop	-	Access		Not Available
C:\Users\FD1HVy\Desktop\Creepy Ransomware.exe.config	-	Access		Not Available
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config	-	Access, Read		Not Available
C:\Windows\System32\cmd.exe	-	Access		Not Available

Registry (41)

»

Registry Key Name	Operations
HKEY_CURRENT_USER	Access
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Access
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	Access
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\creepyranware	Access, Delete, Read, Write
HKEY_CURRENT_USER\Software\Microsoft\Command Processor	Access
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun	Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar	Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor	Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion	Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck	Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions	Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar	Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System	Access, Create
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr	Access, Read, Write
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	Access
HKEY_LOCAL_MACHINE	Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework	Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\AppContext	Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\LegacyWPADSupport	Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh	Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\W. Europe Standard Time	Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\W. Europe Standard Time\Dynamic DST	Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\W. Europe Standard Time\MUI_Display	Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\W. Europe Standard Time\MUI_Dlt	Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\W. Europe Standard Time\MUI_Std	Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\W. Europe Standard Time\TZI	Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Access
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	Access
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework	Access
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\DbgJITDebugLaunchSetting	Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\DbgManagedDebugger	Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\AutoRun	Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\CompletionChar	Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DefaultColor	Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DelayedExpansion	Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DisableUNCCheck	Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\EnableExtensions	Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\PathCompletionChar	Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion	Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\InstallationType	Access, Read

Domain (1)

»

Domain	Sources	Severity
google.com	Function Log, PCAP	Unknown

IP (1)

»

IP	Protocols	Sources
172.217.18.174	DNS	Function Log, PCAP

Indicators

Before

After