d150a4ba...17a2 | IOCs
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification:
Spyware
Dropper
Threat Names:
DeepScan:Generic.Ransom.Amnesia.74779263
Trojan.GenericKD.40753240
DeepScan:Generic.Ransom.Amnesia.371EF7D9
...

ramqlu.exe

Windows Exe (x86-32)

Created 5 years ago

...

Remarks (1/1)

(0x02000004): The operating system was rebooted during the analysis because the sample installed a startup script, task or application for persistence.

Indicators

File (31)
»
Filename Hash Operations Category Severity
C:\Users\5P5NRG~1\AppData\Local\Temp\$TMP$001.exe MD5: e603742dcae0d272ed49008790b07f7b
SHA1: add2d1f39c5ee009f54d96e4af34f119096e67f7
SHA256: 540d7f4889d3e95a8954632c67ba6f15b764a0166c7e3ca7bb15347d08932f4e
SSDeep: 768:/JYexV6NuL038yygBjUONACNYld/k/qWPaQJOVoQfCWeOf4BQbXz8DdSDAu/UeSC:xdVFm8yygBArCNr/qXFa7O08IDm/Ue
ImpHash: 0f7e0afc968061034b76c2f876e906c7 		Access, Create, Delete, Write Dropped File
Malicious
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\ramqlu.exe MD5: f7f642888f9476ff3488e52dda012637
SHA1: b5bb9049398afd7aa9ea5cc58900c75d9e816bac
SHA256: d150a4ba9d3b7c6b6978c3059b56d3034400da16164ccf1ea2dd88351b7017a2
SSDeep: 3072:Cuaw/oz5dI4+T1Bnj9VaYqWdi+89WrjnaUksdKmi0BE7bA6RN52kyWOKoMbPF:CuajzI4y+WdwIj1dKjX7brDdd
ImpHash: 41ab3b57095526e2ac45d205061100f9 		Access, Create, Delete Sample File
Malicious
C:\Program Files\Common Files\Microsoft Shared\EQUATION\AzQX0q5p4V3C2CA2Q4gBgngW2woDnQ.scarry MD5: 45ee3dde04ea2c4d4f7acc1a23177df1
SHA1: b5b8ead3956c531039c8e8e6afb4031f44fd468b
SHA256: 5e61a01351ed137dfcc03f1bb554a12d1b1a4da2ebd9e455f9ec7d9ce7cdb7a2
SSDeep: 192:AJlRPcBQopfePzVjByblCnHxyazof8mLjpOe2qZNS:AZoazVw5eHxEPLZN
ImpHash: - 		Access, Create, Delete Dropped File
Unknown
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.HLP MD5: eba7d8d262288309e27870176be888b6
SHA1: 4c5f2730fdfa5479687416cb824f111614ff9147
SHA256: 1444bfe2f447c85e6b5595931b9de4cd0639526977eeb6ef22f954b7d7a4ac16
SSDeep: 3072:VX3LwVcEANAsHeEiZs81WdXyrSxGjcwmv:VXkV2BeEiZs81O4SxGjcwmv
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
C:\Program Files\Common Files\Microsoft Shared\EQUATION\JbFtmXNWtNN7aOjxZaYO12Z6l3wT581+.scarry MD5: fdb7be0a48ee774468b63d7da2070c10
SHA1: 8e4914a3ab382e59c57d2c3b6aa0f0c86c9e2098
SHA256: 14efe15fb522db2b4f435ecb1314817dd33fe4fd834e79de193e401d275a1b58
SSDeep: 48:CW1lVzlDP/P0WMdxnDGDUqV3PsNvELbgxa9refHQJsEapdkzhi/3/NB+ZZdqnRhX:CQVxDPH0ddxDiANvzOr/JApdkzhQVB+C
ImpHash: - 		Access, Create, Delete Dropped File
Unknown
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FLT MD5: 249d9f970269493fe87a341a827ddb26
SHA1: c580d80f1d2178bd269c346bee2e7db4d3f70a9c
SHA256: 62366382552c9f3c8aa68057bea08309b712cc3d8e35460c88bc2d5129c4ba51
SSDeep: 6144:YF0S8XiWWThUDZOuOiFGR4bRStylR1TLg9gBjHnmbl0/8:a8XGThUDZLOVR4bRS+LoC8
ImpHash: - 		Access, Create, Delete, Read, Write Modified File
Unknown
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FNT MD5: aeb03924bae1c81c8f9e11d57a7465bd
SHA1: 57b0ee5797a2c3da9448fc8676cea1d584355981
SHA256: 96d12a19c17e3e71ca22f5c949c4876ea9eeac5d28b60eeb295168770be43bdb
SSDeep: 12288:gm8EEYHb8868cVAiZQIC6Giut8raCcqaF5NlKvffESck:r8EEmTLcugPrrbcq4+
ImpHash: - 		Access, Create, Delete, Read, Write Modified File
Unknown
C:\wQT5YbokHxgHQayDYCLssrH4mrekabF0.scarry MD5: f19d12414c11d9e02d9d9c8fd4a81208
SHA1: 5fe392a73deef2c580d53997820aa2ac5f048999
SHA256: 2d73aed789215129137d580d9eb1b15d600fc115838daf5afd7274b7223d5cdd
SSDeep: 192:GvROG9te3VXLT350Qz9aplQ9nbMOFsZtKbuco+cPf8ick:eJ8R3q1bQJoZOo+cMk
ImpHash: - 		Access, Create, Delete Dropped File
Unknown
C:\Èíñòðóêöèÿ ïî ðàñøèôðîâêå ôàéëîâ.TXT MD5: b27c9adc46983fb90d61fbb69128d0b9
SHA1: 07027514b1f2a846929831e79034baa0ca56f720
SHA256: 7862778588860a84095f6c10fa0194aad05c5d9b46426b4ed1e9df85c0a88802
SSDeep: 96:jWZt8B0eplz/E5t8yK/cHbr0bHbWZt8B0eT:jWcB0eDg5t/re7WcB0eT
ImpHash: - 		Access, Create, Read, Write Dropped File
Unknown
C:\Program Files\Common Files\Microsoft Shared\EQUATION\Cr5RDwmwHs8MynVqdU5DcZE45mqoEc8m6vr8ArB=GSpuRTe9BYpCgPmO.scarry MD5: ddfd9afa54d20919ae66441a744336f9
SHA1: 32724e6f76182615e538e6eee7271051ee0a017d
SHA256: 5ee22d093851bc73da6dacfcb95436d732c09c90e009b201e0183a5b35918b50
SSDeep: 3::
ImpHash: - 		Access, Create, Delete Dropped File
Whitelisted
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\EPSIMP32.FLT MD5: 74664df957c3940d8dff961659aac1c5
SHA1: 423071ca3fba60a9cb98aa426440fd004add1e35
SHA256: 38ef4b871398148a86cff6f382c98dd0f965545d325431d7e6e554acfe78eaa1
SSDeep: 12288:yTopnBnmoAcyDYo/bJuCqZ5GYLVZTSiR/vjYEsFfhs9BJTzsz44:3BnmoAcyDYo/bYCqZc2jl/vjYEsFfhs4
ImpHash: 31d87328c86414d73c639f4ccb5974e1 		Access, Read, Write Modified File
Whitelisted
C:\f4Bw=XvJqdf6BYP1mVw.scarry MD5: 259525cfb422e6ac8e87bc9777b1df73
SHA1: 7a2ac87b31aa40a1ea92eb34410305fac9f8bc6a
SHA256: 0769a292114dfe181dc4931159c24cd7adb6a3f3823177e40eb45ee59688ea4a
SSDeep: 6144:lSjzP3sVgTkndKzy1mVsEdUISLEoad8k33TW45/vPB1dTM3BMnOb:4vPnTk89VfdUPEJBTW45X/dTM3m4
ImpHash: - 		Access, Create, Delete Dropped File
Whitelisted
C:\я MD5: 93b885adfe0da089cdf634904fd59f71
SHA1: 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA256: 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
SSDeep: 3::
ImpHash: - 		Access, Create, Delete, Write Dropped File
Whitelisted
C:\ - Access
Not Available
C:\BOOTSECT.BAK - Access, Read
Not Available
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.CNT - Access, Read
Not Available
C:\Program Files\Common Files\Microsoft Shared\EQUATION\MTEXTRA.TTF - Access, Read
Not Available
C:\Program Files\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest - Access, Read
Not Available
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.CFG - Access, Delete, Read
Not Available
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\M5ypzeCTIrtZy92aImbFKa6HFij6LHUq.scarry - Access, Create
Not Available
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop - Access
Not Available
C:\Windows\SysWOW64\cmd.exe - Access
Not Available
C:\Windows\SysWOW64\mshta.exe - Access
Not Available
C:\Windows\SysWOW64\mshtml.dll - Access
Not Available
C:\Windows\system32 - Access
Not Available
C:\bootmgr - Access
Not Available
System Paging File - Access, Read, Write
Not Available
Win.ini - Access, Read
Not Available
c:\insidetm - Access
Not Available
c:\sample.exe - Access
Not Available
ramqlu.exe - Access, Delete
Not Available
Registry (93)
»
Registry Key Name Operations
HKEY_CLASSES_ROOT\clsid\{25336920-03f9-11cf-8fd0-00aa00686f13}\InProcServer32 Access, Read
HKEY_CURRENT_USER\Software Access
HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Access
HKEY_CURRENT_USER\Software\Borland\Locales Access
HKEY_CURRENT_USER\Software\Microsoft\Command Processor Access
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl Access
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ADDITIONAL_IE8_MEMORY_CLEANUP Access
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALLOW_EXPANDURI_BYPASS Access
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ARIA_SUPPORT Access
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BODY_SIZE_IN_EDITABLE_IFRAME_KB943245 Access
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CLEANUP_AT_FLS Access
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CSS_DATA_RESPECTS_XSS_ZONE_SETTING_KB912120 Access
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CSS_SHOW_HIDE_EVENTS Access
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DATABINDING_SUPPORT Access
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISPLAY_NODE_ADVISE_KB833311 Access
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DOCUMENT_COMPATIBLE_MODE Access
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_DYNAMIC_OBJECT_CACHING Access
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_OM_SCREEN_ORIGIN_DISPLAY_PIXELS Access
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENFORCE_BSTR Access
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_EXTERNAL_STYLE_SHEET_FIX_FOR_SMARTNAVIGATION_KB926131 Access
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LEGACY_DISPPARAMS Access
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LEGACY_TOSTRING_IN_COMPATVIEW Access
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MANAGE_SCRIPT_CIRCULAR_REFS Access
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MSHTML_AUTOLOAD_IEFRAME Access
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PRIVATE_FONT_SETTING Access
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_CRASH_RECOVERY_SAVE_KB978454 Access
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION Access
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SHOW_FAILED_CONNECT_CONTENT_KB942615 Access
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_DOCUMENT_ZOOM Access
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_XSSFILTER Access
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PageSetup Access
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\PageSetup\Print_Background Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileMenu Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Access, Create
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce Access, Create
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\pmleb Access, Write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update Manager Access, Write
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl Access
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System Access
HKEY_CURRENT_USER\Software\[M[ZF Access, Create, Delete
HKEY_CURRENT_USER\Software\[M[ZF\HMEYE Access, Read, Write
HKEY_CURRENT_USER\Software\pmleb Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM\Log File Max Size Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM\Logging Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM\Logging Directory Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script\Features Access
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Access
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 Access, Read
HKEY_LOCAL_MACHINE\Software\Borland\Locales Access
HKEY_LOCAL_MACHINE\Software\Microsoft\COM3 Access
HKEY_LOCAL_MACHINE\Software\Microsoft\COM3\COM+Enabled Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\AutoRun Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\CompletionChar Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DefaultColor Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DelayedExpansion Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DisableUNCCheck Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\EnableExtensions Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\PathCompletionChar Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ADDITIONAL_IE8_MEMORY_CLEANUP Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALLOW_EXPANDURI_BYPASS Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ARIA_SUPPORT Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BODY_SIZE_IN_EDITABLE_IFRAME_KB943245 Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CLEANUP_AT_FLS Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CSS_DATA_RESPECTS_XSS_ZONE_SETTING_KB912120 Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CSS_SHOW_HIDE_EVENTS Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DATABINDING_SUPPORT Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISPLAY_NODE_ADVISE_KB833311 Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DOCUMENT_COMPATIBLE_MODE Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_DYNAMIC_OBJECT_CACHING Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_OM_SCREEN_ORIGIN_DISPLAY_PIXELS Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENFORCE_BSTR Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_EXTERNAL_STYLE_SHEET_FIX_FOR_SMARTNAVIGATION_KB926131 Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LEGACY_DISPPARAMS Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LEGACY_TOSTRING_IN_COMPATVIEW Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MANAGE_SCRIPT_CIRCULAR_REFS Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MSHTML_AUTOLOAD_IEFRAME Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PRIVATE_FONT_SETTING Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_CRASH_RECOVERY_SAVE_KB978454 Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SHOW_FAILED_CONNECT_CONTENT_KB942615 Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_DOCUMENT_ZOOM Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_XSSFILTER Access
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl Access
Mutex (4)
»
Mutex Name Operations
Local\!PrivacIE!SharedMemory!Mutex Access
^X@%E5~PB,23-A@M_B!P9O<>T/+= Access
pmleb Access
{46E4D4E6-8B81-84CA-93DA-BB29377B2AC0} Access
Export to TXT Export to JSON
VMRay - Analyzer - www.vmray.com
Legal Note
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image