d60dc696...b455 | IOCs
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification:
Dropper
Threat Names:
Trojan.Ransomware.GenericKDS.33676718
Trojan.RanSerKD.42996837
Mal/Generic-S

worker 5 -t.exe

Windows Exe (x86-64)

Created at 2020-04-18T01:53:00

...

Remarks (2/2)

(0x0200000E): The overall sleep time of all monitored processes was truncated from "2 minutes" to "20 seconds" to reveal dormant functionality.

(0x02000004): The operating system was rebooted during the analysis because the sample installed a startup script, task or application for persistence.

Indicators

File (101)
»
Filename Hash Operations Category Severity
C:\Users\FD1HVy\Desktop\worker 5 -t.exe MD5: 823e4c4e47e8dabe32fc700409a78537
SHA1: f973a6495b33941be62a59ee17085051cfca4719
SHA256: d60dc6965f6d68a3e7c82d42e90bfda7ad3c5874d2c59a66df6212aef027b455
SSDeep: 24576:W88lWqXTOlAiZLkk7g9WWYNranPdeDk7bE0KdYqTAK:WTl3XTOl6ag90cPdX/Ad9TA
ImpHash: 365b1d12b684a96b167a74679ec9e4e3 		Access, Delete Sample File
Malicious
C:\windows\utox.exe MD5: 79665e97a47865f317dd9eda3ceaaed0
SHA1: c3d14050fac0ef7c69d1071b05277824fdbd662d
SHA256: 0a563967a7d48e702adaa6f21f22a80b7db6aae7b7149ede51b0fde583e37283
SSDeep: 49152:0iDfMNI3G8kWkAniB1aDhSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSF:0iDfMNIW8kh11aDhSSSSSSSSSSSSSSSZ
ImpHash: 9cd2e74d3fa189f6948d3ef4996e5be7 		Access, Create, Write Dropped File
Malicious
C:\WINDOWS\pghdn.txt MD5: 336db8f33233e23ff1adf1a4aca7b51f
SHA1: 174d03d1ff8b2d41a90654b31f1bd66a5683e6f3
SHA256: 7f88c5ad2c437eecffd4e4b8013dc2ec551292dd9d5071c9760cc7d63fefc51f
SSDeep: 3:pMCMn:3Mn
ImpHash: - 		Access, Create, Write Dropped File
Unknown
C:\WINDOWS\rwjfk.bat MD5: 4e714e2aa7f0c6a762c4d9a5162e3173
SHA1: ed3b8509ff3f9e849f2c2450d14f09a33ea1785e
SHA256: 593d002c58bbcab7a6fee250b15b360552e360a08995e9057646493184f47b76
SSDeep: 3:QwZYpBgvFN6JErFN8BLiIVdks0yoNKpov95Q0cL+VOpVy:QEGBtJEItTFoN/v3fc+
ImpHash: - 		Access, Create, Write Dropped File
Unknown
\\?\C:\$Recycle.Bin\ReadMe.hta MD5: b9f743f09d281a0b3094df4f8d0953e4
SHA1: 816898e22d1e88ee037346ecf2b49340b67b802a
SHA256: cecdd739295742e5644713ecbcce37e243e54790c9c149c259d5121b76c70cd8
SSDeep: 192:M3mzxU1UPRHPEXyBYet2yXTWXnhLxmoLlfzfM8uaG3UN7tMs+OqdOgzZLPFVo:MDMRECCy+nZLlJdGEN7tMbNJdVo
ImpHash: - 		Access, Create, Write Dropped File
Unknown
\\?\C:\$Recycle.Bin\S-1-5-18\desktop.ini YTYUQOSV5.waiting MD5: 94c5f7873e190141a6277b67db5e25bf
SHA1: 8c33028515c0dc075e6d5dc871d1b665f0da9796
SHA256: 62d793959341aed7a06acf3a68bf1f4b2e6c01f4d0de79ad76145b03cb3d2aaf
SSDeep: 48:x+cpNJJ5KELHypcTbQfc6zyaFD8HaXRYamZ/kW9f+0:3pN5BjAAWkERYa+cW9h
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
\\?\C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini YTYUQOSV5.waiting MD5: f75c4f8eea3abf7e97475d17ffa716f5
SHA1: a1b63e5642f4bc71d72aaabaecc0beedd7a8582f
SHA256: 7df59eba05c7c353c7fc1d891897f83ff2315439a44f964d8a3489493873aad3
SSDeep: 48:pXalr/qPeHnMTSL4pLHypcTbQfc6zyaFD8HaXRYamZ/kW9f+0:B6OejLQjAAWkERYa+cW9h
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
\\?\C:\588bce7c90097ed212\1025\LocalizedData.xml YTYUQOSV5.waiting MD5: 8c1892694057111653afbf17bde987bf
SHA1: cf8f7354cf28e8e20eb6d312a557db4edb1f1032
SHA256: 3274ae9e9dd0b589aa3fca9bfd2f31976994fb757a72d8ed583911428591671c
SSDeep: 1536:yEUEyyoOWhUTTLPOXOtyrPuVeikCw0GxlW2OhDl49ycULD:3UEyypnLP9tyrWLdGKD6ZcD
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
\\?\C:\588bce7c90097ed212\1025\SetupResources.dll YTYUQOSV5.waiting MD5: 97aa1598a1a55e626af418e92f85fd3f
SHA1: 1747e261eab333f1a32d6950f209d8dce3f97b2f
SHA256: 99b0b8afc1f320f1898dca818a1664e8fd53ffd2dbfb553342a53a7f14cc32f6
SSDeep: 384:bNlSPym1sqXvZFLhSpgf7HwNGWMCv8n3ZwJsqaSazf4OSxcHhFlZ5Vrtkui:gsmBF1SGrwNGWRvgqJIj4pcHvPW
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
\\?\C:\588bce7c90097ed212\1025\eula.rtf YTYUQOSV5.waiting MD5: d0f857180a754a61d32ac001eec180e0
SHA1: 2080464be521b385ee4acbe4bebb37e8e0dde80a
SHA256: 5c4b37aa558c0e05bb66aefaff74bb9ec08883a143b8b9452dc8f3222fbdf9a2
SSDeep: 192:G31xuHmc+EZr/ZVTlJoOXercw9vEMCbqCOMp/2ypD:+xqmc+EZr/ZVT/oOXerjEYCXui
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
\\?\C:\588bce7c90097ed212\1028\SetupResources.dll YTYUQOSV5.waiting MD5: 9fe271a8e0a701f39bf5c66ab6718e73
SHA1: 56c1883dee370778a1d8d21113228f5478fd2902
SHA256: b970c278f96d72a050212c73620334e800ab5ff0b9d4023772610fdddbcac530
SSDeep: 384:QkvgttFA/SPSgYBJR0PpyWJQ9lgoVnsoQui:boeKPSgAJO7nmnz8
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
\\?\C:\588bce7c90097ed212\1028\eula.rtf YTYUQOSV5.waiting MD5: 2d97235748ba0f634c147e9f73fd8c48
SHA1: b9588a8446eda31cc6c9c209303e850e221795e9
SHA256: d8019c91fcd3d71f81e8714775604b5ce0033084ec8993d9a484308094474078
SSDeep: 96:At70zeg4S9NzIWu1gxS1AKRRCkJst/v8TUJJadp/BVifa9QiuWll0hGANELdyjAs:bn4S9vkt1AOMAW8TUXaH2fXVacp/2ypD
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
\\?\C:\588bce7c90097ed212\1029\LocalizedData.xml YTYUQOSV5.waiting MD5: ad46e262146ce8d934a7a55507450032
SHA1: 7ba133b6c635df97496263166b2d8d301373cd8b
SHA256: 5d07a89d5e5802dea6e41e755ee1536a9fb8427744a9d5c7b23d501595c46a3c
SSDeep: 1536:83Z67g8d7XkRkTH9tJXltXwTXQr4iKIZp0IVsvVtNo1nPYq+hvMGty1PdBury:87wXTdnXltg0PTZp0ZVfo1nAThvVty1p
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
\\?\C:\588bce7c90097ed212\1029\SetupResources.dll YTYUQOSV5.waiting MD5: 7837d95e0e52fced9e7ff27640e39bb1
SHA1: 6cfd0d1daf7a12fe48e28f1a17ae93b5bc75b318
SHA256: 72f111f45f366e15ff0771f30a0e88b7e1bfc4d30b29659aebf61d0c691d3d81
SSDeep: 384:9Zz88Bo6lvZMQZV82xxcL7ocTG7kdvGSKglHqCyEN4yzCKl3UDmAui:fF15ZyNjG70lKCH3lq
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
\\?\C:\588bce7c90097ed212\1029\eula.rtf YTYUQOSV5.waiting MD5: 6167deb096de109e9ea5c222271f6c37
SHA1: a0a5b4ebdc37eef77e975416e5b42732d747406c
SHA256: 1aa1855c4e0944c54a62c474cf8c6be9da5b6f39d38538dbd132cf2aa7d5f8e2
SSDeep: 96:hhXqEXCoHMbPgr8xpiiKrikEnxZpg/OtXHMJyTkMecw0fddjAAWkERYa+cW9h:hhXD3HMccg2pgqsJyKcnfHp/2ypD
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
\\?\C:\BOOTSECT.BAK YTYUQOSV5.waiting MD5: 275c2feea54317df4ca05a491edf3d70
SHA1: ccef6a2222b911cc7e8ab2d5b04da9f82440d186
SHA256: a9d23051373204399ce6f5d0d96906c616fe79a493ba61639c86975cbe39f606
SSDeep: 192:/WmJlBYPMeZGXHlu3mnOMI1Yka9TeCgInUsVZ11K5csJLq1p/2ypD:xlBYPMe6lNYYka9KjmUsVZ101L4ui
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
\\?\C:\Logs\Application.evtx YTYUQOSV5.waiting MD5: 15420969bc9ae3fdb23117e7439ea07a
SHA1: a4308a26bbec1a62f710b4da6a65606843c1bfd4
SHA256: 26e87871fac813c29e0ea142fa7b1d7731fba638d1cb3f7fa93a63776bb76f5b
SSDeep: 1536:wI34y+kN0PuBk649uFZVs9/qhwOVMW0WMc2Xs22eGyCwTPdor:wIoZVGBK9MM/qZGXWkXspwT2r
ImpHash: - 		Access, Create, Delete, Read, Write Dropped File
Unknown
\\?\C:\bootmgr MD5: 01f5b115d847ea315b4027f218f38adb
SHA1: b1432e03feb51c75c78df2917c7fccaf9dbfca2a
SHA256: 106866f949214c045917afff1c8296f119f21660dca4346034a78bc45b9f3362
SSDeep: 6144:7B+4OS2OPqf/hy+H/ekrMXrCVU4qeTF2cvgIQ7wNhdGG+sAR20Hq1dKkKItWW1Yn:7V+QVr4qeT09I5DwkYB9F
ImpHash: - 		Access, Create, Delete Dropped File
Unknown
C:\Users\FD1HVy\Desktop\worker 5 -t.exe MD5: 2116368f8365ad9e8f217e7708f6ae7f
SHA1: 3f763601d1080bc27ba69a8a56b9a4ec84108e43
SHA256: f90930753fbadb07a4d30122e196147df7df15ea475af82b52d0592f40b118cb
SSDeep: 3::
ImpHash: - 		Modified File
Whitelisted
\\?\C:\588bce7c90097ed212\1028\LocalizedData.xml YTYUQOSV5.waiting MD5: 967a6d769d849c5ed66d6f46b0b9c5a4
SHA1: c0ff5f094928b2fa8b61e97639c42782e95cc74f
SHA256: 0bc010947bff6ec1ce9899623ccfdffd702eee6d2976f28d9e06cc98a79cf542
SSDeep: 384:4wCGbCWB6rFk+2jP8lxtrzh1hsPN7ODPnPgQy50sJCXnofDPiv:tbCWYFrewYTJCf
ImpHash: - 		Access, Create, Delete, Read Dropped File
Whitelisted
"C:\WINDOWS\rwjfk.bat" - Access
Not Available
C:\WINDOWS\system32 - Access
Not Available
C:\WINDOWS\system32\cmd.exe - Access
Not Available
\\?\C:\$GetCurrent\ReadMe.hta - Access
Not Available
\\?\C:\$Recycle.Bin\ReadMe.hta - Access
Not Available
\\?\C:\$Recycle.Bin\S-1-5-18\ReadMe.hta - Access
Not Available
\\?\C:\$Recycle.Bin\S-1-5-18\desktop.ini - Access
Not Available
\\?\C:\$Recycle.Bin\S-1-5-18\desktop.ini YTYUQOSV5.waiting - Access
Not Available
\\?\C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\ReadMe.hta - Access
Not Available
\\?\C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini - Access
Not Available
\\?\C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini YTYUQOSV5.waiting - Access
Not Available
\\?\C:\588bce7c90097ed212\1025\LocalizedData.xml - Access
Not Available
\\?\C:\588bce7c90097ed212\1025\LocalizedData.xml YTYUQOSV5.waiting - Access
Not Available
\\?\C:\588bce7c90097ed212\1025\SetupResources.dll - Access
Not Available
\\?\C:\588bce7c90097ed212\1025\SetupResources.dll YTYUQOSV5.waiting - Access
Not Available
\\?\C:\588bce7c90097ed212\1025\eula.rtf - Access
Not Available
\\?\C:\588bce7c90097ed212\1025\eula.rtf YTYUQOSV5.waiting - Access
Not Available
\\?\C:\588bce7c90097ed212\1028\LocalizedData.xml - Access
Not Available
\\?\C:\588bce7c90097ed212\1028\SetupResources.dll - Access
Not Available
\\?\C:\588bce7c90097ed212\1028\SetupResources.dll YTYUQOSV5.waiting - Access
Not Available
\\?\C:\588bce7c90097ed212\1028\eula.rtf - Access
Not Available
\\?\C:\588bce7c90097ed212\1028\eula.rtf YTYUQOSV5.waiting - Access
Not Available
\\?\C:\588bce7c90097ed212\1029\LocalizedData.xml - Access
Not Available
\\?\C:\588bce7c90097ed212\1029\SetupResources.dll - Access
Not Available
\\?\C:\588bce7c90097ed212\1029\eula.rtf - Access
Not Available
\\?\C:\588bce7c90097ed212\1029\eula.rtf YTYUQOSV5.waiting - Access
Not Available
\\?\C:\BOOTSECT.BAK - Access
Not Available
\\?\C:\BOOTSECT.BAK YTYUQOSV5.waiting - Access
Not Available
\\?\C:\Boot\BCD - Access
Not Available
\\?\C:\Boot\BCD - Access, Delete
Not Available
\\?\C:\Boot\BCD YTYUQOSV5.waiting - Access, Create
Not Available
\\?\C:\Boot\BCD.LOG - Access
Not Available
\\?\C:\Boot\BCD.LOG - Access, Delete
Not Available
\\?\C:\Boot\BCD.LOG YTYUQOSV5.waiting - Access, Create
Not Available
\\?\C:\Boot\BOOTSTAT.DAT - Access
Not Available
\\?\C:\Boot\BOOTSTAT.DAT - Access, Delete
Not Available
\\?\C:\Boot\BOOTSTAT.DAT YTYUQOSV5.waiting - Access, Create
Not Available
\\?\C:\Boot\bootspaces.dll - Access
Not Available
\\?\C:\Boot\bootspaces.dll - Access, Delete
Not Available
\\?\C:\Boot\bootspaces.dll YTYUQOSV5.waiting - Access, Create
Not Available
\\?\C:\Boot\bootvhd.dll - Access
Not Available
\\?\C:\Boot\bootvhd.dll - Access, Delete
Not Available
\\?\C:\Boot\bootvhd.dll YTYUQOSV5.waiting - Access, Create
Not Available
\\?\C:\Documents and Settings\ReadMe.hta - Access, Create
Not Available
\\?\C:\ESD\ReadMe.hta - Access
Not Available
\\?\C:\Logs\Application.evtx - Access
Not Available
\\?\C:\PerfLogs\ReadMe.hta - Access, Create
Not Available
\\?\C:\Program Files (x86)\desktop.ini - Access
Not Available
\\?\C:\Program Files (x86)\desktop.ini - Access, Delete
Not Available
\\?\C:\Program Files (x86)\desktop.ini YTYUQOSV5.waiting - Access, Create
Not Available
\\?\C:\Program Files\desktop.ini - Access
Not Available
\\?\C:\Program Files\desktop.ini - Access, Delete
Not Available
\\?\C:\Program Files\desktop.ini YTYUQOSV5.waiting - Access, Create
Not Available
\\?\C:\ReadMe.hta - Access, Create
Not Available
\\?\C:\Recovery\ReadMe.hta - Access, Create
Not Available
\\?\C:\System Volume Information\ReadMe.hta - Access, Create
Not Available
\\?\C:\Users\ReadMe.hta - Access, Create
Not Available
\\?\C:\Users\desktop.ini - Access
Not Available
\\?\C:\Users\desktop.ini - Access, Delete
Not Available
\\?\C:\Users\desktop.ini YTYUQOSV5.waiting - Access, Create
Not Available
\\?\C:\Windows10Upgrade\Configuration.ini - Access
Not Available
\\?\C:\Windows10Upgrade\Configuration.ini - Access, Delete
Not Available
\\?\C:\Windows10Upgrade\Configuration.ini YTYUQOSV5.waiting - Access, Create
Not Available
\\?\C:\Windows10Upgrade\appraiserxp.dll - Access
Not Available
\\?\C:\Windows10Upgrade\appraiserxp.dll - Access, Delete
Not Available
\\?\C:\Windows10Upgrade\appraiserxp.dll YTYUQOSV5.waiting - Access, Create
Not Available
\\?\C:\Windows10Upgrade\bootsect.exe - Access
Not Available
\\?\C:\Windows10Upgrade\bootsect.exe - Access, Delete
Not Available
\\?\C:\Windows10Upgrade\bootsect.exe YTYUQOSV5.waiting - Access, Create
Not Available
\\?\C:\bootmgr - Access
Not Available
\\?\C:\bootmgr YTYUQOSV5.waiting - Access, Create
Not Available
\\?\C:\hiberfil.sys - Access
Not Available
\\?\C:\hiberfil.sys - Access, Delete
Not Available
\\?\C:\hiberfil.sys YTYUQOSV5.waiting - Access, Create
Not Available
\\?\C:\pagefile.sys - Access
Not Available
\\?\C:\pagefile.sys - Access, Delete
Not Available
\\?\C:\pagefile.sys YTYUQOSV5.waiting - Access, Create
Not Available
\\?\C:\swapfile.sys - Access
Not Available
\\?\C:\swapfile.sys - Access, Delete
Not Available
\\?\C:\swapfile.sys YTYUQOSV5.waiting - Access, Create
Not Available
wevtutil.exe - Access
Not Available
Registry (22)
»
Registry Key Name Operations
HKEY_CLASSES_ROOT\.waiting\shell\open\command\ Access, Create, Write
HKEY_CLASSES_ROOT\.waiting\shell\open\command\\en Access, Read, Write
HKEY_CLASSES_ROOT\.waiting\shell\open\command\\n Access, Read, Write
HKEY_CURRENT_USER\Software\Microsoft\Command Processor Access
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar Access, Read
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\open Access, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\AutoRun Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\CompletionChar Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DefaultColor Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DelayedExpansion Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DisableUNCCheck Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\EnableExtensions Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\PathCompletionChar Access, Read
Mutex (3)
»
Mutex Name Operations
itkdMQRO Access
itkdQPOP Access
itkdQRSN Access
Export to TXT Export to JSON
VMRay - Analyzer - www.vmray.com
Legal Note
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image