Registry Run Keys / Startup Folder
US-2020-03-03-16-18-40-0C03624B-9417807A-3C69D917-C6C250EF-C4987959.com.exe
Windows Exe (x86-32)
Created 5 years ago
Remarks (2/2)
(0x0200000E): The overall sleep time of all monitored processes was truncated from "1 minute, 56 seconds" to "20 seconds" to reveal dormant functionality.
VMRay Threat Identifiers (7 rules, 18 matches)
| Severity | Category | Operation | Count | Classification | |
|---|---|---|---|---|---|
5/5 | Antivirus | Malicious content was detected by heuristic scan | 1 | - | |
4/5 | System Modification | Disables a crucial system tool | 1 | - | |
4/5 | User Data Modification | Modifies content of user files | 1 | Ransomware | |
4/5 | User Data Modification | Renames user files | 1 | Ransomware | |
1/5 | Persistence | Installs system startup script or application | 1 | - | |
1/5 | System Modification | Modifies application directory | 2 | - | |
1/5 | Hide Tracks | Changes folder appearance | 11 | - |
Screenshots
Monitored Processes
MITRE ATT&CK™ Matrix - Windows
ActiveAll
Version: 2019-04-25 20:53:07.719000
Initial Access
Execution
Persistence
Privilege Escalation
Defense Evasion
Modify Registry
Masquerading
Credential Access
Discovery
Lateral Movement
Collection
Command and Control
Exfiltration
Impact
Inhibit System Recovery
Data Encrypted for Impact
Sample Information
| ID | #497486 |
| MD5 | |
| SHA1 | |
| SHA256 | |
| SSDeep | |
| ImpHash | |
| Filename | US-2020-03-03-16-18-40-0C03624B-9417807A-3C69D917-C6C250EF-C4987959.com.exe |
| File Size | 156.50 KB |
| Sample Type | Windows Exe (x86-32) |
Analysis Information
| Creation Time | 2020-03-04 06:03 (UTC+) |
| Analysis Duration | 00:04:00 |
| Number of Monitored Processes | 1 |
| Execution Successful |  |
| Reputation Enabled | |
| WHOIS Enabled |  |
| Local AV Enabled | |
| Local AV Applied On | Sample Files, PCAP File, Downloaded Files, Dropped Files, Modified Files, Memory Dumps |
| YARA Enabled | |
| YARA Applied On | Sample Files, PCAP File, Downloaded Files, Dropped Files, Modified Files, Memory Dumps |
| Number of AV Matches | 1 |
| Number of YARA Matches | 0 |
| Termination Reason | Timeout |
