d0abcf56...b05c | IOCs
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: -
Threat Names:
DeepScan:Generic.Ransom.Fonix.2.57D59D3A
DeepScan:Generic.Ransom.Fonix.2.7637E1D3
Gen:Variant.Ulise.156743

26SDlxCbvJlumPMe.exe

Windows Exe (x86-64)

Created at 2021-01-24T23:30:00

...

Remarks (1/1)

(0x02000004): The operating system was rebooted during the analysis because the sample installed a startup script, task or application for persistence.

Indicators

File (21)
»
Filename Hash Operations Category Severity
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\26SDlxCbvJlumPMe.exe MD5: f7730883c85cf8dd32203177f58ad932
SHA1: de5269bee7bbebb221f900feadb7c5b51ea0c7cd
SHA256: d0abcf560468841fbfc9f728c655be8394bd078adca4cb37025c3681b429b05c
SSDeep: 24576:fMemBqGcSZtoTznQq779o63ZkuyidpAkTOmNDyN:EemBtZeTDQc7/WBikkT5
ImpHash: d6af38ba6817ff9c3d8530259fd555fb 		Access, Create Sample File
Malicious
C:\ProgramData\Cpriv.key MD5: afd950b87483c90737cdfbc00fe8e094
SHA1: 3394ad8dd8dab6894d7f61b9b31f2aa0610285e5
SHA256: 59dc447e1704bf232f2eb7d98c020c4aeadc0402f373f2f5d7989819fc5986b9
SSDeep: 48:nxOhK6JF0JQhFOlJEgaABjoYOhjDsO5GBajK47fFl5:nkhrJaUOlJE0OhvsOFK47fv5
ImpHash: - 		Access, Create Dropped File
Unknown
C:\ProgramData\Cpub.key MD5: 52c090bacd9a04a8fd5e04f256681e0c
SHA1: e453a0367a4c75ec68f64a80acc253f6569051b9
SHA256: c610676c4542a0b529903fefabd454a922ab902fb1498f3addbd7a058ef856f4
SSDeep: 6:sLT7fFNnYIXsjYksFvgC8CN3NgPmnerRwaXyGllHlQtOVPn:uViI8NsFvghO3yYerRwcyslFQk
ImpHash: - 		Access, Create, Read, Write Dropped File
Unknown
C:\ProgramData\How To Decrypt Files.hta MD5: 8a902683185fef7310c47d7a3119eda4
SHA1: 3e9b6ce7b4e16610487e73de60e92bab91d62109
SHA256: 2c00bd0cf3e83753e157b7f8f21b57d3634b65569f47ffe8000447eac50a3182
SSDeep: 96:hy+PMNs2CEWQOIwz5Y545YUcqtBadPuLVVFe9IQWhM4cMO1a5:vPcsIOIw5Y545TrXadcVHQWhMrL+
ImpHash: - 		Access, Create Dropped File
Unknown
C:\ProgramData\SystemID MD5: 07336ecfd35657e661857296cd24c744
SHA1: 63be15d8a9a099593409cfe95bc1670835093b94
SHA256: e33d60720d0153469673afb2ef97a579d0b6d01ddcfab5259512e3072c13f42c
SSDeep: 3:OxT:OxT
ImpHash: - 		Access, Create, Read Dropped File
Unknown
Cpriv.key MD5: 20ed96b7e92f983f591ba0b42630d0c4
SHA1: 8ed1fe32cdc6276f8ad578dfdb8df2cd687dbfbe
SHA256: 16caf23acfe21903319bedfe2361151ec63d4c2b19b66af9e8d1076a79dd2486
SSDeep: 24:dcj9GjRrZ/xL3bosehjofb6LHNrynD9amIi9C2zfrW7Son9T5QD5el:d8sjjdQhjo+pOnBaS8QPYU8
ImpHash: - 		Access, Create, Read, Write Dropped File
Unknown
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.exe MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SSDeep: 3::
ImpHash: - 		Access, Create
Not Queried
C:\ProgramData\Help.txt - Access, Create
Not Available
C:\ProgramData\XINOFALERT.png - Access, Create
Not Available
C:\ProgramData\XINOFLOGO.SVG - Access
Not Available
C:\ProgramData\XINOFLOGO.png - Access, Create
Not Available
C:\ProgramData\nons - Access
Not Available
C:\ProgramData\xinofconfig.txt - Access, Create
Not Available
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop - Access
Not Available
C:\Windows\System32\shutdown.exe - Access, Delete
Not Available
C:\Windows\system32\cmd.exe - Access
Not Available
C:\Windows\system32\schtasks.exe - Access
Not Available
Help.txt - Access
Not Available
System Paging File - Access
Not Available
c:\windows\explorer.exe - Access
Not Available
xinofconfig.txt - Access
Not Available
Registry (35)
»
Registry Key Name Operations
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Access, Create
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Access, Create
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Michael Gillespie Access, Read, Write
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Michael Gillespie Access, Read, Write
HKEY_CURRENT_USER\Software\Microsoft\Command Processor Access
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System Access, Create
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr Access, Read, Write
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System Access
HKEY_CURRENT_USER\System\CurrentControlSet\Control\SafeBoot Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Access, Create
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections Access, Read, Write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Access, Create
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Access, Create
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Michael Gillespie Access, Read, Write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Michael Gillespie Access, Read, Write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Access, Create
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware Access, Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\AutoRun Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\CompletionChar Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DefaultColor Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DelayedExpansion Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DisableUNCCheck Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\EnableExtensions Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\PathCompletionChar Access, Read
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot Access
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot\AlternateShell Access, Delete
Mutex (1)
»
Mutex Name Operations
XINOF4MUTEX Access
Export to TXT Export to JSON
VMRay - Analyzer - www.vmray.com
Legal Note - Privacy Policy
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image