efe7e143...67d8 | IOCs
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification:
Ransomware
Threat Names:
Gen:Variant.Razy.760416

Clean.exe

Windows Exe (x86-32)

Created at 2020-10-26T18:29:00

...

Remarks (1/1)

(0x0200000E): The overall sleep time of all monitored processes was truncated from "1 hour" to "10 seconds" to reveal dormant functionality.

Indicators

File (45)
»
Filename Hash Operations Category Severity
C:\Users\FD1HVy\Desktop\Clean.exe MD5: 6a31e618496d7423ba2ebe54d460bafb
SHA1: cf103bf47b19bf7c346e761ab141a46904928188
SHA256: efe7e143ae91dee769a7d039b00015a9c4972378060b9dd62d1c0f85e03267d8
SSDeep: 6144:yX+Eo955ry777H6Q31gFsR0c6Q31gFsR0SGDCOi5LXq:C+vXyvzF14cF14SGnix6
ImpHash: f34d5f2d4577ed6d9ceec516c1f5a744 		Access, Create, Read Sample File
Malicious
C:\Users\FD1HVy\Desktop\-lEaF9KQ86xnw2Yu.bmp MD5: 0ca9610351f127413853082df5f197d0
SHA1: 41d562040b265db85955b67f0e006adbf15ee6f3
SHA256: f792a2017db22b8f99fb36083c1105e72f0e67fb56f3bf4fbe42e9bd89464411
SSDeep: 1536:B1aVjKD1K4oByk/a5C+U0fjFZE41zBBcciY3l+r1Y35cpBtTS:udKD1KJgk/acvijFZNzxNl+xeD
ImpHash: - 		Access, Create, Read, Write Modified File
Unknown
C:\Users\FD1HVy\Desktop\2iz1JGsz8rVWP2JeDG_Z.bmp MD5: 0dced8dc077aab5494d8dacfd363a8a6
SHA1: aacf6bec353b9ceac1e1d8759b14ac994f39801c
SHA256: 27422bdb82140268afdd32fa89ad7cfa6460a6bf01dec922d124d67d85b34cd4
SSDeep: 384:ne/qyNlV0SZSTNa1ia9nVihMUuEjB7jQHnyZfHFu6awMi+1LpIRzBB2yK:nKmZa/pVgMUuw5QHyDIrLpI9ub
ImpHash: - 		Access, Create, Read, Write Modified File
Unknown
C:\Users\FD1HVy\Desktop\3nnYT8jqppvejc.swf MD5: c84e0953c67a8445fb2a779374698461
SHA1: 69b7014d65da01dba47ec24beb31aeeafc60bb41
SHA256: aefa0d767fb4356464baa1ca7203b76a35b60c3c80f9204a875d9f13bf6e4381
SSDeep: 1536:a4E4bx+lQaN6keBeJ4cjWHf/LeTaCVtvvlCklG:2VQaNDGQWHf6aCz5lG
ImpHash: - 		Access, Create, Read, Write Modified File
Unknown
C:\Users\FD1HVy\Desktop\3qs KZTKQGR8wlvOJt.mp3 MD5: 22ea61ef5decc4d4f1179a1591645109
SHA1: 981e93ce99bf67752c83b40a9d50dbb3ba993c4d
SHA256: a3aaa947810d938ee6e7a58f25e57416e91dbd447422559474687af80ccbd696
SSDeep: 1536:QIHpBp791NecXxySYFRbb7tg1OAzeEpdN/5hDjxwN:f5McB9Y3NlIJ/Px6
ImpHash: - 		Access, Create, Read, Write Modified File
Unknown
C:\Users\FD1HVy\Desktop\4G1ed.png MD5: f3184d9837faa7821b019fb8ec7eea0c
SHA1: 3f98a918b9bec25a1a90b23b12be58437528e71a
SHA256: a06aac7ffc8d9217018f113b6798eaeeb1c5101aeea005fac00035bc5dfa957f
SSDeep: 768:gm9sId7Ns3hKuKJRPk5F8NcPxr4sRMEV4VzPrg7HDfRfiLH8AHjn:gvQ1uykn8NoR/1UPr4H9e/H7
ImpHash: - 		Access, Create, Read, Write Modified File
Unknown
C:\Users\FD1HVy\Desktop\55qp-QsmRD0Zs.mkv MD5: 4cf419f664d4c616163037c10b9c5e3c
SHA1: 3549ea78c6673c88f51aa43c68400c5ac848708e
SHA256: 84270badf451b861124a4a846ad3bae06d651ea8e4e4c89ea91ddd1187a84ef6
SSDeep: 384:b0Aulb8j+LEQIozpTNkTEO213PAQDR+xjF0:b1086LNzvisoQDijF0
ImpHash: - 		Access, Create, Read, Write Modified File
Unknown
C:\Users\FD1HVy\Desktop\5Jd_WK88oqH.jpg MD5: ec50ed2688aa950a3c83208bf0e7564a
SHA1: 29a2f02fc99f6f7f205de605aed5593edf3d6686
SHA256: 6377ab6c2073f67dc3d9642d0f7787dae7e84306871f1c411f0f5cdc69137164
SSDeep: 768:dl38sFzgENKXOA2AYVe1mSJJS/qcCtR/CgXi8vRTVSc18+O+pXF0fqApiXCrC:nLzgENK+AxYVe1m4S+DXfewtqfqApBC
ImpHash: - 		Access, Create, Read, Write Modified File
Unknown
C:\Users\FD1HVy\Desktop\6aMMGtRTQCK.png MD5: 083fe8da60b683fb0845b26120361ced
SHA1: b7a40f880d0f7bb803248c8c33440a9549e9b313
SHA256: 7f900cdf34d1e224e6b064141fc54cca0f90e3030f5e1167f5725b316d7ac098
SSDeep: 1536:bnG86EiKGuTwlx1HMmtgigINqaqKS6tBfTNm84eSH65ruL/7jhQuQQczlMpmDUD1:bGbjpXPsEEINqaRN1h9SHmruL/7iIs2F
ImpHash: - 		Access, Create, Read, Write Modified File
Unknown
C:\Users\FD1HVy\Desktop\9oohZWpC.odt MD5: 5cbc6e6e8e302b02dcd99cb76bdab769
SHA1: 2a18d6435c690d43cff951fe46addaf02c8ba8a6
SHA256: 13c56648161a8af8a0f6d2af0d6ecaab4b4ff60de5756c820ce368f30d04df24
SSDeep: 384:vFekZXH1KUhkXgPwutnIbV4TacuPWiZR7YZAKkTBPx9Zqj/+7glvN0/3mFn2zRv:9ek1VK9whIR4TKW8R7UuwyQvN0c2B
ImpHash: - 		Access, Create, Read, Write Modified File
Unknown
C:\Users\FD1HVy\Desktop\AEl7xFpzhL3MiFF2DB.gif MD5: b8177233fea38827af421144125d3fab
SHA1: f3be5e3ec0948ee31df6bc2a92a9e60ec29dadf8
SHA256: 12fda4ddda5f07d1ac4203bc7841444703c7d949ed9f105d45f7137b089ca394
SSDeep: 768:E4M41iIOle9bHvrWlkb+RUPX9/W5TNumStDM3SnKzNAir7vBUPi7:zM4Qe9bqNWPmNu7tDMiuAOUa7
ImpHash: - 		Access, Create, Read, Write Modified File
Unknown
C:\Users\FD1HVy\Desktop\BTJUhkayMP8PKsG8QSj.pptx MD5: 370c022ae7924b6262e11412fe96f4ec
SHA1: 76c7dcc901efaed2b1f2901862751033244246ee
SHA256: c248586afd1563f24823f6b5d3113e99a57ce8c9d61ec4c92f3f3191cfb3284a
SSDeep: 768:AxZprPvNodxv7nBeH5fitiXC32dleMJKe1+dpwg:ADl3NM0H5f+iS3I45dl
ImpHash: - 		Access, Create, Read, Write Modified File
Unknown
C:\Users\FD1HVy\Desktop\Clean.exe.config - Access
Not Available
C:\Users\FD1HVy\Desktop\D4AUXIN.png - Access
Not Available
C:\Users\FD1HVy\Desktop\Dgn8zd4z.docx - Access
Not Available
C:\Users\FD1HVy\Desktop\GiHF1e.gif - Access
Not Available
C:\Users\FD1HVy\Desktop\K3RMMvl3o00B_8CH.mp3 - Access
Not Available
C:\Users\FD1HVy\Desktop\Mvc0UNkdbG 7.docx - Access
Not Available
C:\Users\FD1HVy\Desktop\S7OhHlvzaAcFI.wav - Access
Not Available
C:\Users\FD1HVy\Desktop\UY7C6hp8Zv.swf - Access
Not Available
C:\Users\FD1HVy\Desktop\W2ppuu6ug.wav - Access
Not Available
C:\Users\FD1HVy\Desktop\desktop.ini - Access, Delete
Not Available
C:\Users\FD1HVy\Desktop\jTSNJcmRC8OA.mp3 - Access
Not Available
C:\Users\FD1HVy\Desktop\jzbn6Z.flv - Access
Not Available
C:\Users\FD1HVy\Desktop\knGZYlLAWrrbSI5LV 4.csv - Access
Not Available
C:\Users\FD1HVy\Desktop\mAc9OA5.mp3 - Access
Not Available
C:\Users\FD1HVy\Desktop\mEEaQb8bPec6u2a.m4a - Access
Not Available
C:\Users\FD1HVy\Desktop\nA oO 5cv_.wav - Access
Not Available
C:\Users\FD1HVy\Desktop\tAfPT-JWYe7t_wtuKkxZ.wav - Access
Not Available
C:\Users\FD1HVy\Desktop\tBLQ5HtaOB4EC8e92V.ods - Access
Not Available
C:\Users\FD1HVy\Desktop\tGWjY5voxkzX.jpg - Access
Not Available
C:\Users\FD1HVy\Desktop\tYzALiZQjyLzVgNPBXX.avi - Access
Not Available
C:\Users\FD1HVy\Desktop\u8KLHCyTJV8CZS.bmp - Access
Not Available
C:\Users\FD1HVy\Desktop\uTYipBG0tUO.pdf - Access
Not Available
C:\Users\FD1HVy\Desktop\xAoArn6sqJ-SCvTEyGf.swf - Access
Not Available
C:\Users\FD1HVy\Desktop\z3vJfGAzKPhwdB.m4a - Access
Not Available
C:\Users\FD1HVy\Downloads\desktop.ini - Access, Delete
Not Available
C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll - Access
Not Available
C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll - Access
Not Available
C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll - Access
Not Available
C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll - Access
Not Available
C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.dll - Access
Not Available
C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll - Access
Not Available
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config - Access, Read
Not Available
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll - Access
Not Available
Registry (17)
»
Registry Key Name Operations
HKEY_CURRENT_USER\Control Panel\Desktop Access
HKEY_CURRENT_USER\Control Panel\Desktop\Wallpaper Access, Read, Write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System Access, Create
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr Access, Read, Write
HKEY_LOCAL_MACHINE Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\AppContext Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\W. Europe Standard Time Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\W. Europe Standard Time\Dynamic DST Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\W. Europe Standard Time\MUI_Display Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\W. Europe Standard Time\MUI_Dlt Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\W. Europe Standard Time\MUI_Std Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\W. Europe Standard Time\TZI Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell Access, Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework Access
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\DbgJITDebugLaunchSetting Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\DbgManagedDebugger Access, Read
Export to TXT Export to JSON
VMRay - Analyzer - www.vmray.com
Legal Note - Privacy Policy
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image