ee51d6f1...b0af

VTI SCORE: 100/100

Dynamic Analysis Report

Classification:

Ransomware

Threat Names:

Gen:Variant.Razy.760416

Mal/Generic-S

Rasomware2.0.exe

Windows Exe (x86-32)

Created at 2020-10-23T03:24:00

Remarks (1/1)

Anti-Sleep Triggered (0x0200000E): The overall sleep time of all monitored processes was truncated from "1 hour" to "10 seconds" to reveal dormant functionality.

Indicators

File (49)

Filename	Hash	Operations	Category	Severity
C:\Users\FD1HVy\Desktop\Rasomware2.0.exe	MD5: 0385420851811ec54932ff743742821d SHA1: 85b921db2110988862c69fa3f236fc4ff3663172 SHA256: ee51d6f18eed049428097cce7f44fb1a6dca363adca30680de17918232b0b0af SSDeep: 1536:lc5v/WteGQjUho9JdZ582KJcocH9wVcl:CJ/geNEo9JdZ5rOvM9qY ImpHash: f34d5f2d4577ed6d9ceec516c1f5a744	Access, Create, Read	Sample File	Malicious
C:\Users\FD1HVy\Desktop\-z0XYs6oEVkt9.wav	MD5: 621e75bf247a96ca11a48a57500c1322 SHA1: bf0d387e9bc1803009dcdc507521d6f1589fb314 SHA256: acab28fdf6682529a67d89389410a3cd659d984659be1834c235c280d77a6251 SSDeep: 768:uwnVOW90OnF7y+lQ3CQMsvs9V36Yfb0ZSX0TLo1sKzeUZvOK1sriyQ73:vnqAVLlQSQrq3XC20P8sKztvOmsWyQ73 ImpHash: -	Access, Create, Read, Write	Modified File	Unknown
C:\Users\FD1HVy\Desktop\2zV0.jpg	MD5: bd496561c2c9e1e24096a3507b33d4aa SHA1: fea0b67d8d3d30c5e4dd55673bbdd85445886a5c SHA256: cd5a8da6e92d73e3329c9c8765ec9a4450da1ea35937cc5cf7201a4b7097ce46 SSDeep: 384:6TflkQhxT4FKx+MSC11OGBFSsTmGMmOpbXAyEtamM3TQOXzevg0jZwOG:shxTa8Sik//m2XDYamMZK7jO5 ImpHash: -	Access, Create, Read, Write	Modified File	Unknown
C:\Users\FD1HVy\Desktop\3iHHVrwcraP1neeYOpU3.bmp	MD5: 5a34e5c278d4b088daa981cf841228f8 SHA1: 2fc626a816da868175e2689a9dea29e638f1886d SHA256: fcc68ca57bbe70e07b2fd8f6677f7d2c657e6c023b94f495fe89fc9469e84e5f SSDeep: 384:SntbqYGA7KU7X5Sn4iwwty18hX5TRbz5Tffn801yjpw0NLfMA90lkS:g17GESnLq18nRbt80GJNzMflkS ImpHash: -	Access, Create, Read, Write	Modified File	Unknown
C:\Users\FD1HVy\Desktop\5623PlKQ4_NtpnJC.mkv	MD5: 4d862dafb02236465dd043dcb6771917 SHA1: ca51867c973de0250a158b9452a082cf2016844c SHA256: 55f0f9e62e69e067f19921abba3696bfc28c14bc403c777ee6673d52fde72cd0 SSDeep: 1536:VKe/uoGAMY9rnb5KuHIc+podLtt1F38DD9xiScPhDJTFuN5:QeaAb9RKFc+pot1ASS44N5 ImpHash: -	Access, Create, Read, Write	Modified File	Unknown
C:\Users\FD1HVy\Desktop\5HcXrIfdR_G.ots	MD5: 852c9a3804256f9e175b651576d27bd3 SHA1: d82d7c6797341637ab9b2851578d177ce0308b3d SHA256: 6c5a245c0ef874a352fe71a5a3a6327fff9606c06b69b0058e6d96328857b8c2 SSDeep: 768:8sjaLvr9REycRrg7mWiRpEJ1LY7y98mkd0ryESJSdPdlJUOXUVOlWL9//kAtWqn:bCREycRMRiRCYE8ksJSdF1YCWp/cAPn ImpHash: -	Access, Create, Read, Write	Modified File	Unknown
C:\Users\FD1HVy\Desktop\5Pmr8xVJ.gif	MD5: 4323e0c7e7c74e717397c4070a7b14e4 SHA1: 0ab76ee8aa79f523eb79bfa0af94dd522b484846 SHA256: faba99de52613779b31df7c9772dfc57b1ef816daddde2477900e1debfff23cc SSDeep: 192:5y/VpIkR7IbUx2SzfRUGCHbKFWazXAMyvZkPqbaWlY670L8egLtxzGb:5y/vBESzLCHIvzjeFaX67RegLm ImpHash: -	Access, Create, Read, Write	Modified File	Unknown
C:\Users\FD1HVy\Desktop\83It0-B2eHk.flv	MD5: 7f724aa682357b4d57a4c480d3bc8c93 SHA1: c17c424023438e4757c508d4fc613e7d4fde805b SHA256: db22274a0c55f32490ca76724118460624ad963a04e0e04f5c0c9ad7c367e1e2 SSDeep: 384:fMy/p9iZZlB1bDGw1cIU3VQ1MwN4VNWDFEgGViJ4aSJr9zq1cHFK04NTh:Uy0zewS61MwN6NWx2zJr9zq1PVh ImpHash: -	Access, Create, Read, Write	Modified File	Unknown
C:\Users\FD1HVy\Desktop\DgK7ZNohbvb5IcTg.mp3	MD5: 7c3c5fd5be232452045c753fef18e398 SHA1: 6c99040f2436f4a428bc15690a685deb26bd0ab8 SHA256: 1090f0a6c0dfbfe7d7a2e1f4dcb75b29aa19af158e111398b6bbcbb2dd5c465c SSDeep: 768:PKv1Tc0ZbM+zSZG3K7KY4GVkyOqyu+uLWnlOFh9:glc0ZpqAGHFvVFh9 ImpHash: -	Access, Create, Read, Write	Modified File	Unknown
C:\Users\FD1HVy\Desktop\HRGcqObyJsxzi-7huX.swf	MD5: 25c2307e04395a88059d0a815984d9d9 SHA1: cf6f98b28a4f7ed0f720ce2c53e714223778046a SHA256: 639da1ffb77f1c0550deda37a84be3d121364c31b626cbdfb17bc80e90aa0eed SSDeep: 1536:P9aecaQiPvZxWYI6kipX2+uWvkMcOrAThVO:xcaT5x7uXersc ImpHash: -	Access, Create, Read, Write	Modified File	Unknown
C:\Users\FD1HVy\Desktop\HSkbeSfEv.ots	MD5: 3e43e5bc41fac091dba97ad97167b795 SHA1: 29390d23568de48f12fe5567d9c716f0df0180d6 SHA256: 63d02a2df7f46cd94376a1ab8033272f7d4748a6f4e0b333b7eaf3ed216002b1 SSDeep: 1536:O3MLwaU9xGvtEcj+Ox8bTXkbKsR1QglctR8:YeMGvw68bT0bKCgR8 ImpHash: -	Access, Create, Read, Write	Modified File	Unknown
C:\Users\FD1HVy\Desktop\H_jDXCrf-cuJnW -96LQ.bmp	MD5: 02873fbf66fffbc9adf4668f5b31abfb SHA1: 9352ffdb57fcc01aa0d92326fbc11cad416833e5 SHA256: 2643d9a02127b2db12edec86543468538df024b0572d1344c1b87a9ea0b9a3b6 SSDeep: 3072:dORQjoYnlay9NrWKg9mY12gXsDY+NIuzOY2Msk:dO3ulTrWP9m73dNPsk ImpHash: -	Access, Create, Read, Write	Modified File	Unknown
C:\Users\FD1HVy\Desktop\IXcswmhtslD2.wav	MD5: 525aee83866d503cbbe2e1bc74c1da04 SHA1: 9024bbef9cd9c739943f0450b6aee792e09073be SHA256: b13f6f2a6868f88d5cf0d9fa156c6a39b095675edb253a946b1048e01fd76d34 SSDeep: 384:SMzkR2qpYAwPMqL68o4AQ9+fYwyxqDMU/sWSSdBOlLNG9cS35eUxzY/TfhzBxQay:BgmpZc4AZYw6bcSYOxNKpYUF+Wj ImpHash: -	Access, Create, Read, Write	Modified File	Unknown
C:\Users\FD1HVy\Desktop\MjbyvFlCi9rG5Ow2.png	MD5: 7474f628939616743df42f86fa305664 SHA1: b59178fe877beb72bc4f02d2c8675bf71252cc4e SHA256: 05d304cf9010b1521cea810e5be5d5bfc38eb36ea0f06841f7dd2c15ccc2e774 SSDeep: 768:HgAv3W4lgN/zDXHENHhpcftj0n1MQLdZdQPSA8keC5g8j6F52Ugye:AAPLoD+HhSftgn1MYd3QDg8Ykd ImpHash: -	Access, Create, Read, Write	Modified File	Unknown
C:\Users\FD1HVy\Desktop\Mk0YDtC.xls	MD5: e9d098a2fd8a299049e74fa587459583 SHA1: 5ade359a47a1ffbcb6eb4d9f135699876db80b4c SHA256: 8b243d30fadeb02d93bd44de00bcb7b28d98e5b37401d31425a3e679609b7c2d SSDeep: 1536:yj3rAC+xsj7R2kKuEO1nfr/4Gu8pE2Xg33GG0:mP92jC1D7TpE2XIGG0 ImpHash: -	Access, Create, Read, Write	Modified File	Unknown
C:\Users\FD1HVy\Desktop\Q1QY.pdf	MD5: e6b3bf5b34e892085f35cc9fffbe8ed4 SHA1: d3196a373e6c2d7bd5737bf869727dfd97e5b1c1 SHA256: 841fd2e203466c38095dcc3b562c297fff165a2899e43fdd9c1ec265f3439122 SSDeep: 768:JyW5WSiN/QK86JLJjKqWZsxXay323jnXZzyH0hwmrPX8icpWV/RxF:JXPIQKxpJhj23zJzyo1UiAWVF ImpHash: -	Access, Create, Read, Write	Modified File	Unknown
C:\Users\FD1HVy\Desktop\e13mm.bmp	MD5: fb84ab3d74825b0fe01374c0a0ac44a9 SHA1: 9b2afb685d8403321762d70e045ca1fd95d78b66 SHA256: 27c2fcf48dd196ed572623865713d0f60ad32038ea8ab68fa5942713852daccd SSDeep: 768:RrS+S+SN6UlMpQsEKaiJki1oGOyVczITPN/rTMP4Vd8eoHThTwkpZOkMFZxDt1kp:RrSX6aJsEK1JkE1U8PNDTMP4VdXoeQZ/ ImpHash: -	Access, Create, Read, Write	Modified File	Unknown
C:\Users\FD1HVy\Desktop\i8cpofRRCu1dKEyssD.mkv	MD5: 703932f43f812d039232ec65c8cf83d4 SHA1: 5afe16091bd99f4dc8241eee0bc3751ab9f9593a SHA256: c155e19182840362d08fd45d910c72536ae0cfbe4c978cf69af50ebfe89e5100 SSDeep: 384:M48YOzmw41MMgGbJcrovTBsOHUPO8yx607KdxDS:cY3xCMFbJceNsl2W07KW ImpHash: -	Access, Create, Read, Write	Modified File	Unknown
C:\Users\FD1HVy\Desktop\kiveb7IVy.bmp	MD5: 46b147413116bb3e2ceb027fd2a34d47 SHA1: 6dd9a144d993a49141e1a9e395a8e5779095438b SHA256: c0a5f4b3a6b45303eb924d29ee0e385a8bb100bd732af3f586c47ae9eda71788 SSDeep: 1536:EkjT4jRB5Teh7+0C0Adnv5HAFq9Xom0ocb6iu5pxJeoFRDaCCo+zTjOQtrOnB6EH:EgT4jRB5US0C0Adv5HAw9Fcb9WpxJe4n ImpHash: -	Access, Create, Read, Write	Modified File	Unknown
C:\Users\FD1HVy\Desktop\l By-atPMKplpd.flv	MD5: e53294127dd0a3044c139a654dcdec4b SHA1: 91afe805ccf2ab372254232b0c7d69f6cc24c95c SHA256: cc3b15e9363e6364773e260a438962c7fb8a971852ea8114afd70af0d63ad5c5 SSDeep: 1536:/1el+fjiJE10nPp4cYxhNPHeNgoU8qCKM5EadTLULkuNKPJWMprBSs38PdSMqNE:tB+JPR4c8rP2uCKM5E0QNKxJBSVPdSMD ImpHash: -	Access, Create, Read, Write	Modified File	Unknown
C:\Users\FD1HVy\Desktop\lkgK1pNcuJo2OuszsQzM.jpg	MD5: 02cfd3fa21880037c38c26d48057de40 SHA1: 50a22ee684b2a18cc91f1d4be322cc872acdb452 SHA256: 271beee88377d81ecdf570596c90a1677a96bc2366752ee1b3937aaa6121fd72 SSDeep: 768:hJyCXdMiiMh3lWsKNf/Q8XjqHZNAzmZNiDVmLuTOrmQU1fW8no:6CXdviMcdjqXAzVmLuao+8o ImpHash: -	Access, Create, Read, Write	Modified File	Unknown
C:\Users\FD1HVy\Desktop\mrKNxFW.avi	MD5: 71cb066ab770c635fc3891fff6e3eca4 SHA1: e5442f6c3d8e64b16b33932eaaf79bf10014f359 SHA256: 9a1c58ac69f8537c4d26009a54594d8ab0e9018f402675a399a6bc67f838c195 SSDeep: 384:+CpRGZPzU7Uu/8944/X2Wpuy6wBHpNN8tJ4GyJU0zRTtlizABc7J+jl:+CpcPQ7189D2Wpuyzlp3SwzRTtlizAmq ImpHash: -	Access, Create, Read, Write	Modified File	Unknown
C:\Users\FD1HVy\Desktop\nZNWzQABBJvmhgW.swf	MD5: 3b308d45079c3a16c45ce60d408fc476 SHA1: b6bfa4e6011e2df3f9e1418c85d5dd2b0d1821fa SHA256: 79ef5e2147885bdab7415b34698f2142b58a75e884ed4311cdd5b5cc57557303 SSDeep: 1536:6YMBIV5YIPY/+IRgZUG4Xh/LX9Bd4TL+xJFa9nhFLWpq/64vat2E:yB+5Y2YIZ6Xh/79Bd4TixJFaXcqdnE ImpHash: -	Access, Create, Read, Write	Modified File	Unknown
C:\Users\FD1HVy\Desktop\pQHEld3UBh TxJQ4.m4a	MD5: 52922547bc252fdedc860fd779dfb49f SHA1: b200d2cf2af337f7d758dc4c01084ad5eade4342 SHA256: 25f0e679c1288498da45be8f6538ef6c108fd536a8d310190703d2c211616882 SSDeep: 1536:jRY8+i0x8GmwWcaLqXfkOJaXvaX1IT6wJ15/9GhbzqD7GrhNru6ZriOMI3nbN7Hp:j6TbxE1x+f0SXI3GbeDqrDrlZDMI3bFJ ImpHash: -	Access, Create, Read, Write	Modified File	Unknown
C:\Users\FD1HVy\Desktop\qg1lOzUm-LhSqtQAZ9.mp3	MD5: fa2444ea2979265749ea7143c52eb147 SHA1: 7b4a1972e90f0707b91dcbf76c8945042861a020 SHA256: 8588fcb9bc98266ecec482b8df36837a0b7664f2ce4106d6d436a51d8640a1c1 SSDeep: 1536:6hwgZz6yUcU84Ca4cta4cFyHRExAvQSdTKlWdLXd/0:ZYz69cN4CauyHRESvndkWp90 ImpHash: -	Access, Create, Read, Write	Modified File	Unknown
C:\Users\FD1HVy\Desktop\qvrbrV_qe6.mkv	MD5: aeaa8b58c1a3ee26a3d539a2339f2099 SHA1: fd0b6401b95738b098433be19f33584276307a26 SHA256: 740c73e93acf40af2a5b7f1a1a17a9d904cb65a17492cf13b84b2ddf804ee9e6 SSDeep: 1536:zjtr4/la9jyO2VORuPQJvfsce/cjJsWQevW6HpQd0lSAYgJMpKFvCSktL0Cj:HtE/latyOdRuPQJnsP82WHadSkkvvCZ7 ImpHash: -	Access, Create, Read, Write	Modified File	Unknown
C:\Users\FD1HVy\Desktop\r7msq.bmp	MD5: e96a20c054db9142f608063d35c976d1 SHA1: 4d4a87fd833a6f7f0329d5ab9cfc85168f43edd0 SHA256: 5623248be4a46ca3c781948d0fa2fa1265c20977069cf5f788748698ddfd00d4 SSDeep: 3072:5x7bpMZbw0LKVyLpK2D32O2qhI+jGOvkMSp7:DbpM6O9s2D32O/a+BkBp7 ImpHash: -	Access, Create, Read, Write	Modified File	Unknown
C:\Users\FD1HVy\Desktop\RMat.ods	-	Access		Not Available
C:\Users\FD1HVy\Desktop\RVps_ONpPWdrxSZk.odp	-	Access		Not Available
C:\Users\FD1HVy\Desktop\Rasomware2.0.exe.config	-	Access		Not Available
C:\Users\FD1HVy\Desktop\T dIQUZiixg5wc-UcUgJ.mp3	-	Access		Not Available
C:\Users\FD1HVy\Desktop\Tf97nd3BvG- Vk.png	-	Access		Not Available
C:\Users\FD1HVy\Desktop\UtoJYwxZ WcDil.mp3	-	Access		Not Available
C:\Users\FD1HVy\Desktop\XvhhJwcm4O.swf	-	Access		Not Available
C:\Users\FD1HVy\Desktop\Y1v_Mc8oMe.xlsx	-	Access		Not Available
C:\Users\FD1HVy\Desktop\_ dfqIVXR25Z6uG5IpC.flv	-	Access		Not Available
C:\Users\FD1HVy\Desktop\desktop.ini	-	Access, Delete		Not Available
C:\Users\FD1HVy\Desktop\sPQwE0hnhoe7xDbnP.rtf	-	Access		Not Available
C:\Users\FD1HVy\Desktop\utMcykXhTi0.mkv	-	Access		Not Available
C:\Users\FD1HVy\Desktop\v3omnIh.wav	-	Access		Not Available
C:\Users\FD1HVy\Downloads\desktop.ini	-	Access, Delete		Not Available
C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll	-	Access		Not Available
C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll	-	Access		Not Available
C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll	-	Access		Not Available
C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll	-	Access		Not Available
C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.dll	-	Access		Not Available
C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll	-	Access		Not Available
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config	-	Access, Read		Not Available
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll	-	Access		Not Available

Registry (17)

Registry Key Name	Operations
HKEY_CURRENT_USER\Control Panel\Desktop	Access
HKEY_CURRENT_USER\Control Panel\Desktop\Wallpaper	Access, Read, Write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System	Access, Create
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr	Access, Read, Write
HKEY_LOCAL_MACHINE	Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\AppContext	Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\W. Europe Standard Time	Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\W. Europe Standard Time\Dynamic DST	Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\W. Europe Standard Time\MUI_Display	Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\W. Europe Standard Time\MUI_Dlt	Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\W. Europe Standard Time\MUI_Std	Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\W. Europe Standard Time\TZI	Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell	Access, Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework	Access
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\DbgJITDebugLaunchSetting	Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\DbgManagedDebugger	Access, Read

Export to TXT Export to JSON

Function Logfile

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".

Remarks (1/1)

Indicators

Before

After