5de1fbd1...ddd9

VTI SCORE: 100/100

Dynamic Analysis Report

Classification:

Trojan

Ransomware

Threat Names:

Ryuk

DeepScan:Generic.EmotetU.AD004203

Win32.Trojan.Kryptik

sBgovWhZhlan.exe

Windows Exe (x86-32)

Created 5 years ago

Remarks (2/2)

Process Crash (0x02000008): One or more processes crashed during the analysis. Analysis results may be incomplete.

Anti-Sleep Triggered (0x0200000E): The overall sleep time of all monitored processes was truncated from "1 minute, 40 seconds" to "20 seconds" to reveal dormant functionality.

Grouped Sequential

Monitored Processes

Process Overview

Behavior Information - Grouped by Category

Process #1: sbgovwhzhlan.exe

3753

Process #3: dtubbzkmmlan.exe

294

Process #4: ddvrmurselan.exe

Process #5: ddvrmurselan.exe

Process #6: werfault.exe

Process #7: cmd.exe

Process #8: cmd.exe

Process #9: cmd.exe

Process #10: cmd.exe

Process #11: icacls.exe

Process #17: taskkill.exe

Process #18: taskkill.exe

Process #21: taskkill.exe

Process #22: taskkill.exe

Process #25: net.exe

Process #26: net.exe

Process #28: vssadmin.exe

Process #30: wmic.exe

Process #31: net.exe

Process #33: net.exe

Process #34: net1.exe

Process #36: net1.exe

Process #37: net1.exe

Function Logfile

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".

Remarks (2/2)

Monitored Processes

Behavior Information - Grouped by Category

Before

After