7.2
高危

60b28ad78be40bbc9d08b91b21c5d4e07c6952f5be5e32eacee6d055e0279b12

a0e495354a1e55ace1c808bf7b9539a2.exe

分析耗时

97s

最近分析

文件大小

53.5KB
静态报毒 动态报毒 100% 5GKKDOE61IC A + TROJ AB@7L2S58 AGEN AI SCORE=100 AIDETECTVM ALI1000102 AUTO BSCOPE CBLHX CLASSIC CONFIDENCE CRYPTOLOCKER ELDORADO FAECQN FAKEGLOBE FILECODER GENASA GENASOM GENETIC GLOBEIMPOSTER GLOBELMPOSTER HIGH CONFIDENCE MALICIOUS PE MALWARE2 MAUVAISE NECNE R228072 RAAS RANSOMWARE RANSOMX SCORE STATIC AI UNSAFE 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Globelmposter!A0E495354A1E 20201229 6.0.6.653
Alibaba Ransom:Win32/Genasom.ali1000102 20190527 0.3.0.5
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
Baidu 20190318 1.0.0.2
Tencent Win32.Trojan.Raas.Auto 20201229 1.0.0.1
Kingsoft 20201229 2017.9.26.565
Avast Win32:RansomX-gen [Ransom] 20201229 21.1.5827.0
静态指标
行为判定
动态指标
Creates (office) documents on the filesystem (7 个事件)
file C:\Users\Administrator.Oskar-PC\Documents\WLsfzqeuZZnBCdm.doc
file C:\Users\Administrator.Oskar-PC\Documents\gNXuHputGmI.doc
file C:\Users\Administrator.Oskar-PC\Documents\GkGtzxOCYfFy.ppt
file C:\Users\Administrator.Oskar-PC\Documents\hkcWceCgZqa.doc
file C:\Users\Administrator.Oskar-PC\Documents\exkLAzLizit.ppt
file C:\Users\Administrator.Oskar-PC\Documents\nXKcuvbZnwJS.ppt
file C:\Users\Administrator.Oskar-PC\Documents\CIkOXJuIYvHGTIYU.doc
Creates executable files on the filesystem (18 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\VirtualBox Dropped Files\2021-04-11T13_03_23.134665700Z\vcredist_x64.exe
file C:\Users\Administrator.Oskar-PC\Links\Desktop.lnk
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\VirtualBox Dropped Files\2021-04-11T12_48_05.093039900Z\ChromeSetup.exe
file C:\Users\Oskar\Links\Desktop.lnk
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\VirtualBox Dropped Files\2021-04-11T12_55_56.358189200Z\dotNetFx40_Full_x86_x64.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\RarSFX1\Loader.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\VirtualBox Dropped Files\2021-04-11T13_04_00.550342800Z\python-2.7.18.amd64 (1).msi
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\RarSFX0\Loader.exe
file C:\Users\Administrator.Oskar-PC\Links\RecentPlaces.lnk
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\RarSFX1\KMS2021.msi
file C:\Users\Administrator.Oskar-PC\Links\Downloads.lnk
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\RarSFX0\KMS2021.msi
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Wintup.exe
file C:\Users\Oskar\Links\Downloads.lnk
file C:\Users\Oskar\Links\RecentPlaces.lnk
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Windows_Activator\Windows Activator.exe
file C:\Users\Public\Desktop\Google Chrome.lnk
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\VirtualBox Dropped Files\2021-04-11T12_55_50.744383200Z\vcredist_x64.exe
Creates a shortcut to an executable file (7 个事件)
file C:\Users\Administrator.Oskar-PC\Links\Desktop.lnk
file C:\Users\Oskar\Links\Desktop.lnk
file C:\Users\Administrator.Oskar-PC\Links\RecentPlaces.lnk
file C:\Users\Administrator.Oskar-PC\Links\Downloads.lnk
file C:\Users\Oskar\Links\Downloads.lnk
file C:\Users\Public\Desktop\Google Chrome.lnk
file C:\Users\Oskar\Links\RecentPlaces.lnk
网络通信
Communicates with host for which no DNS query was performed (2 个事件)
host 113.108.239.196
host 172.217.24.14
Installs itself for autorun at Windows startup (1 个事件)
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck reg_value C:\Users\Administrator.Oskar-PC\AppData\Local\a0e495354a1e55ace1c808bf7b9539a2.exe
Attempts to detect Cuckoo Sandbox through the presence of a file (2 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\VirtualBox Dropped Files\2021-04-11T13_11_43.130072200Z\agent.pyw
file C:\tmpsij43m\analyzer.py
Performs 266 file moves indicative of a ransomware file encryption process (50 out of 266 个事件)
Time & API Arguments Status Return Repeated
1619816853.1865
MoveFileWithProgressW
oldfilepath: C:\Users\desktop.ini
newfilepath: C:\Users\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\desktop.ini
success 1 0
1619816853.4985
MoveFileWithProgressW
oldfilepath: C:\Users\Public\desktop.ini
newfilepath: C:\Users\Public\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\desktop.ini
success 1 0
1619816853.7805
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Videos\desktop.ini
newfilepath: C:\Users\Public\Videos\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Videos\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Videos\desktop.ini
success 1 0
1619816853.9365
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Videos\Sample Videos\desktop.ini
newfilepath: C:\Users\Public\Videos\Sample Videos\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Videos\Sample Videos\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Videos\Sample Videos\desktop.ini
success 1 0
1619816858.3735
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Videos\Sample Videos\Wildlife.wmv
newfilepath: C:\Users\Public\Videos\Sample Videos\Wildlife.wmv.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Videos\Sample Videos\Wildlife.wmv.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Videos\Sample Videos\Wildlife.wmv
success 1 0
1619816858.3735
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Recorded TV\desktop.ini
newfilepath: C:\Users\Public\Recorded TV\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Recorded TV\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Recorded TV\desktop.ini
success 1 0
1619816858.6865
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Recorded TV\Sample Media\desktop.ini
newfilepath: C:\Users\Public\Recorded TV\Sample Media\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Recorded TV\Sample Media\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Recorded TV\Sample Media\desktop.ini
success 1 0
1619816859.7805
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv
newfilepath: C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv
success 1 0
1619816859.7805
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Pictures\desktop.ini
newfilepath: C:\Users\Public\Pictures\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Pictures\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Pictures\desktop.ini
success 1 0
1619816861.3275
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg
newfilepath: C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg
success 1 0
1619816861.7645
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Pictures\Sample Pictures\Desert.jpg
newfilepath: C:\Users\Public\Pictures\Sample Pictures\Desert.jpg.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Desert.jpg.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Desert.jpg
success 1 0
1619816861.7805
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Pictures\Sample Pictures\desktop.ini
newfilepath: C:\Users\Public\Pictures\Sample Pictures\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Pictures\Sample Pictures\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Pictures\Sample Pictures\desktop.ini
success 1 0
1619816861.9205
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg
newfilepath: C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg
success 1 0
1619816862.2175
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg
newfilepath: C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg
success 1 0
1619816862.3895
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Pictures\Sample Pictures\Koala.jpg
newfilepath: C:\Users\Public\Pictures\Sample Pictures\Koala.jpg.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Koala.jpg.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Koala.jpg
success 1 0
1619816862.7485
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg
newfilepath: C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg
success 1 0
1619816862.7955
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg
newfilepath: C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg
success 1 0
1619816863.3425
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg
newfilepath: C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg
success 1 0
1619816863.3425
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Music\desktop.ini
newfilepath: C:\Users\Public\Music\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Music\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Music\desktop.ini
success 1 0
1619816863.6395
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Large.jpg
newfilepath: C:\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Large.jpg.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Large.jpg.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Large.jpg
success 1 0
1619816863.9985
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Small.jpg
newfilepath: C:\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Small.jpg.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Small.jpg.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Small.jpg
success 1 0
1619816863.9985
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Music\Sample Music\desktop.ini
newfilepath: C:\Users\Public\Music\Sample Music\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Music\Sample Music\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Music\Sample Music\desktop.ini
success 1 0
1619816865.7645
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Music\Sample Music\Kalimba.mp3
newfilepath: C:\Users\Public\Music\Sample Music\Kalimba.mp3.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Music\Sample Music\Kalimba.mp3.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Music\Sample Music\Kalimba.mp3
success 1 0
1619816866.4985
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3
newfilepath: C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3
success 1 0
1619816867.8735
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Music\Sample Music\Sleep Away.mp3
newfilepath: C:\Users\Public\Music\Sample Music\Sleep Away.mp3.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Music\Sample Music\Sleep Away.mp3.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Music\Sample Music\Sleep Away.mp3
success 1 0
1619816867.8735
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Libraries\desktop.ini
newfilepath: C:\Users\Public\Libraries\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Libraries\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Libraries\desktop.ini
success 1 0
1619816868.0455
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Libraries\RecordedTV.library-ms
newfilepath: C:\Users\Public\Libraries\RecordedTV.library-ms.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Libraries\RecordedTV.library-ms.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Libraries\RecordedTV.library-ms
success 1 0
1619816868.0615
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Downloads\desktop.ini
newfilepath: C:\Users\Public\Downloads\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Downloads\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Downloads\desktop.ini
success 1 0
1619816868.2335
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Documents\desktop.ini
newfilepath: C:\Users\Public\Documents\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Documents\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Documents\desktop.ini
success 1 0
1619816868.3735
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Desktop\desktop.ini
newfilepath: C:\Users\Public\Desktop\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Desktop\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Desktop\desktop.ini
success 1 0
1619816868.5615
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Desktop\Google Chrome.lnk
newfilepath: C:\Users\Public\Desktop\Google Chrome.lnk.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Desktop\Google Chrome.lnk.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Desktop\Google Chrome.lnk
success 1 0
1619816868.8895
MoveFileWithProgressW
oldfilepath: C:\Users\Oskar\NTUSER.DAT
newfilepath: C:\Users\Oskar\NTUSER.DAT.KENS@TUTA.IO
newfilepath_r: C:\Users\Oskar\NTUSER.DAT.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Oskar\NTUSER.DAT
success 1 0
1619816869.2175
MoveFileWithProgressW
oldfilepath: C:\Users\Oskar\ntuser.dat.LOG1
newfilepath: C:\Users\Oskar\ntuser.dat.LOG1.KENS@TUTA.IO
newfilepath_r: C:\Users\Oskar\ntuser.dat.LOG1.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Oskar\ntuser.dat.LOG1
success 1 0
1619816869.3275
MoveFileWithProgressW
oldfilepath: C:\Users\Oskar\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
newfilepath: C:\Users\Oskar\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.KENS@TUTA.IO
newfilepath_r: C:\Users\Oskar\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Oskar\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
success 1 0
1619816869.4675
MoveFileWithProgressW
oldfilepath: C:\Users\Oskar\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
newfilepath: C:\Users\Oskar\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.KENS@TUTA.IO
newfilepath_r: C:\Users\Oskar\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Oskar\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
success 1 0
1619816869.5775
MoveFileWithProgressW
oldfilepath: C:\Users\Oskar\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
newfilepath: C:\Users\Oskar\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.KENS@TUTA.IO
newfilepath_r: C:\Users\Oskar\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Oskar\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
success 1 0
1619816869.6555
MoveFileWithProgressW
oldfilepath: C:\Users\Oskar\ntuser.ini
newfilepath: C:\Users\Oskar\ntuser.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Oskar\ntuser.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Oskar\ntuser.ini
success 1 0
1619816869.7955
MoveFileWithProgressW
oldfilepath: C:\Users\Oskar\Videos\desktop.ini
newfilepath: C:\Users\Oskar\Videos\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Oskar\Videos\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Oskar\Videos\desktop.ini
success 1 0
1619816870.1705
MoveFileWithProgressW
oldfilepath: C:\Users\Oskar\Searches\desktop.ini
newfilepath: C:\Users\Oskar\Searches\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Oskar\Searches\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Oskar\Searches\desktop.ini
success 1 0
1619816870.4985
MoveFileWithProgressW
oldfilepath: C:\Users\Oskar\Searches\Everywhere.search-ms
newfilepath: C:\Users\Oskar\Searches\Everywhere.search-ms.KENS@TUTA.IO
newfilepath_r: C:\Users\Oskar\Searches\Everywhere.search-ms.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Oskar\Searches\Everywhere.search-ms
success 1 0
1619816870.5615
MoveFileWithProgressW
oldfilepath: C:\Users\Oskar\Searches\Indexed Locations.search-ms
newfilepath: C:\Users\Oskar\Searches\Indexed Locations.search-ms.KENS@TUTA.IO
newfilepath_r: C:\Users\Oskar\Searches\Indexed Locations.search-ms.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Oskar\Searches\Indexed Locations.search-ms
success 1 0
1619816870.5615
MoveFileWithProgressW
oldfilepath: C:\Users\Oskar\Saved Games\desktop.ini
newfilepath: C:\Users\Oskar\Saved Games\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Oskar\Saved Games\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Oskar\Saved Games\desktop.ini
success 1 0
1619816870.9835
MoveFileWithProgressW
oldfilepath: C:\Users\Oskar\Pictures\desktop.ini
newfilepath: C:\Users\Oskar\Pictures\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Oskar\Pictures\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Oskar\Pictures\desktop.ini
success 1 0
1619816871.3425
MoveFileWithProgressW
oldfilepath: C:\Users\Oskar\Music\desktop.ini
newfilepath: C:\Users\Oskar\Music\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Oskar\Music\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Oskar\Music\desktop.ini
success 1 0
1619816871.6085
MoveFileWithProgressW
oldfilepath: C:\Users\Oskar\Links\desktop.ini
newfilepath: C:\Users\Oskar\Links\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Oskar\Links\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Oskar\Links\desktop.ini
success 1 0
1619816871.8735
MoveFileWithProgressW
oldfilepath: C:\Users\Oskar\Links\Desktop.lnk
newfilepath: C:\Users\Oskar\Links\Desktop.lnk.KENS@TUTA.IO
newfilepath_r: C:\Users\Oskar\Links\Desktop.lnk.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Oskar\Links\Desktop.lnk
success 1 0
1619816871.9525
MoveFileWithProgressW
oldfilepath: C:\Users\Oskar\Links\Downloads.lnk
newfilepath: C:\Users\Oskar\Links\Downloads.lnk.KENS@TUTA.IO
newfilepath_r: C:\Users\Oskar\Links\Downloads.lnk.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Oskar\Links\Downloads.lnk
success 1 0
1619816871.9675
MoveFileWithProgressW
oldfilepath: C:\Users\Oskar\Links\RecentPlaces.lnk
newfilepath: C:\Users\Oskar\Links\RecentPlaces.lnk.KENS@TUTA.IO
newfilepath_r: C:\Users\Oskar\Links\RecentPlaces.lnk.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Oskar\Links\RecentPlaces.lnk
success 1 0
1619816872.0305
MoveFileWithProgressW
oldfilepath: C:\Users\Oskar\Favorites\desktop.ini
newfilepath: C:\Users\Oskar\Favorites\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Oskar\Favorites\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Oskar\Favorites\desktop.ini
success 1 0
1619816874.0615
MoveFileWithProgressW
oldfilepath: C:\Users\Oskar\Favorites\Windows Live\Windows Live Hotmail.url
newfilepath: C:\Users\Oskar\Favorites\Windows Live\Windows Live Hotmail.url.KENS@TUTA.IO
newfilepath_r: C:\Users\Oskar\Favorites\Windows Live\Windows Live Hotmail.url.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Oskar\Favorites\Windows Live\Windows Live Hotmail.url
success 1 0
Appends a new file extension or content to 266 files indicative of a ransomware file encryption process (50 out of 266 个事件)
Time & API Arguments Status Return Repeated
1619816853.1865
MoveFileWithProgressW
oldfilepath: C:\Users\desktop.ini
newfilepath: C:\Users\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\desktop.ini
success 1 0
1619816853.4985
MoveFileWithProgressW
oldfilepath: C:\Users\Public\desktop.ini
newfilepath: C:\Users\Public\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\desktop.ini
success 1 0
1619816853.7805
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Videos\desktop.ini
newfilepath: C:\Users\Public\Videos\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Videos\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Videos\desktop.ini
success 1 0
1619816853.9365
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Videos\Sample Videos\desktop.ini
newfilepath: C:\Users\Public\Videos\Sample Videos\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Videos\Sample Videos\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Videos\Sample Videos\desktop.ini
success 1 0
1619816858.3735
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Videos\Sample Videos\Wildlife.wmv
newfilepath: C:\Users\Public\Videos\Sample Videos\Wildlife.wmv.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Videos\Sample Videos\Wildlife.wmv.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Videos\Sample Videos\Wildlife.wmv
success 1 0
1619816858.3735
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Recorded TV\desktop.ini
newfilepath: C:\Users\Public\Recorded TV\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Recorded TV\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Recorded TV\desktop.ini
success 1 0
1619816858.6865
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Recorded TV\Sample Media\desktop.ini
newfilepath: C:\Users\Public\Recorded TV\Sample Media\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Recorded TV\Sample Media\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Recorded TV\Sample Media\desktop.ini
success 1 0
1619816859.7805
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv
newfilepath: C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv
success 1 0
1619816859.7805
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Pictures\desktop.ini
newfilepath: C:\Users\Public\Pictures\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Pictures\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Pictures\desktop.ini
success 1 0
1619816861.3275
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg
newfilepath: C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg
success 1 0
1619816861.7645
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Pictures\Sample Pictures\Desert.jpg
newfilepath: C:\Users\Public\Pictures\Sample Pictures\Desert.jpg.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Desert.jpg.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Desert.jpg
success 1 0
1619816861.7805
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Pictures\Sample Pictures\desktop.ini
newfilepath: C:\Users\Public\Pictures\Sample Pictures\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Pictures\Sample Pictures\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Pictures\Sample Pictures\desktop.ini
success 1 0
1619816861.9205
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg
newfilepath: C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg
success 1 0
1619816862.2175
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg
newfilepath: C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg
success 1 0
1619816862.3895
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Pictures\Sample Pictures\Koala.jpg
newfilepath: C:\Users\Public\Pictures\Sample Pictures\Koala.jpg.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Koala.jpg.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Koala.jpg
success 1 0
1619816862.7485
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg
newfilepath: C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg
success 1 0
1619816862.7955
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg
newfilepath: C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg
success 1 0
1619816863.3425
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg
newfilepath: C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg
success 1 0
1619816863.3425
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Music\desktop.ini
newfilepath: C:\Users\Public\Music\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Music\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Music\desktop.ini
success 1 0
1619816863.6395
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Large.jpg
newfilepath: C:\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Large.jpg.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Large.jpg.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Large.jpg
success 1 0
1619816863.9985
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Small.jpg
newfilepath: C:\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Small.jpg.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Small.jpg.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Music\Sample Music\AlbumArt_{5FA05D35-A682-4AF6-96F7-0773E42D4D16}_Small.jpg
success 1 0
1619816863.9985
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Music\Sample Music\desktop.ini
newfilepath: C:\Users\Public\Music\Sample Music\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Music\Sample Music\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Music\Sample Music\desktop.ini
success 1 0
1619816865.7645
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Music\Sample Music\Kalimba.mp3
newfilepath: C:\Users\Public\Music\Sample Music\Kalimba.mp3.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Music\Sample Music\Kalimba.mp3.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Music\Sample Music\Kalimba.mp3
success 1 0
1619816866.4985
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3
newfilepath: C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3
success 1 0
1619816867.8735
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Music\Sample Music\Sleep Away.mp3
newfilepath: C:\Users\Public\Music\Sample Music\Sleep Away.mp3.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Music\Sample Music\Sleep Away.mp3.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Music\Sample Music\Sleep Away.mp3
success 1 0
1619816867.8735
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Libraries\desktop.ini
newfilepath: C:\Users\Public\Libraries\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Libraries\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Libraries\desktop.ini
success 1 0
1619816868.0455
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Libraries\RecordedTV.library-ms
newfilepath: C:\Users\Public\Libraries\RecordedTV.library-ms.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Libraries\RecordedTV.library-ms.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Libraries\RecordedTV.library-ms
success 1 0
1619816868.0615
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Downloads\desktop.ini
newfilepath: C:\Users\Public\Downloads\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Downloads\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Downloads\desktop.ini
success 1 0
1619816868.2335
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Documents\desktop.ini
newfilepath: C:\Users\Public\Documents\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Documents\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Documents\desktop.ini
success 1 0
1619816868.3735
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Desktop\desktop.ini
newfilepath: C:\Users\Public\Desktop\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Desktop\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Desktop\desktop.ini
success 1 0
1619816868.5615
MoveFileWithProgressW
oldfilepath: C:\Users\Public\Desktop\Google Chrome.lnk
newfilepath: C:\Users\Public\Desktop\Google Chrome.lnk.KENS@TUTA.IO
newfilepath_r: C:\Users\Public\Desktop\Google Chrome.lnk.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Public\Desktop\Google Chrome.lnk
success 1 0
1619816868.8895
MoveFileWithProgressW
oldfilepath: C:\Users\Oskar\NTUSER.DAT
newfilepath: C:\Users\Oskar\NTUSER.DAT.KENS@TUTA.IO
newfilepath_r: C:\Users\Oskar\NTUSER.DAT.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Oskar\NTUSER.DAT
success 1 0
1619816869.2175
MoveFileWithProgressW
oldfilepath: C:\Users\Oskar\ntuser.dat.LOG1
newfilepath: C:\Users\Oskar\ntuser.dat.LOG1.KENS@TUTA.IO
newfilepath_r: C:\Users\Oskar\ntuser.dat.LOG1.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Oskar\ntuser.dat.LOG1
success 1 0
1619816869.3275
MoveFileWithProgressW
oldfilepath: C:\Users\Oskar\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
newfilepath: C:\Users\Oskar\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.KENS@TUTA.IO
newfilepath_r: C:\Users\Oskar\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Oskar\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
success 1 0
1619816869.4675
MoveFileWithProgressW
oldfilepath: C:\Users\Oskar\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
newfilepath: C:\Users\Oskar\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.KENS@TUTA.IO
newfilepath_r: C:\Users\Oskar\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Oskar\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
success 1 0
1619816869.5775
MoveFileWithProgressW
oldfilepath: C:\Users\Oskar\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
newfilepath: C:\Users\Oskar\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.KENS@TUTA.IO
newfilepath_r: C:\Users\Oskar\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Oskar\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
success 1 0
1619816869.6555
MoveFileWithProgressW
oldfilepath: C:\Users\Oskar\ntuser.ini
newfilepath: C:\Users\Oskar\ntuser.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Oskar\ntuser.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Oskar\ntuser.ini
success 1 0
1619816869.7955
MoveFileWithProgressW
oldfilepath: C:\Users\Oskar\Videos\desktop.ini
newfilepath: C:\Users\Oskar\Videos\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Oskar\Videos\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Oskar\Videos\desktop.ini
success 1 0
1619816870.1705
MoveFileWithProgressW
oldfilepath: C:\Users\Oskar\Searches\desktop.ini
newfilepath: C:\Users\Oskar\Searches\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Oskar\Searches\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Oskar\Searches\desktop.ini
success 1 0
1619816870.4985
MoveFileWithProgressW
oldfilepath: C:\Users\Oskar\Searches\Everywhere.search-ms
newfilepath: C:\Users\Oskar\Searches\Everywhere.search-ms.KENS@TUTA.IO
newfilepath_r: C:\Users\Oskar\Searches\Everywhere.search-ms.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Oskar\Searches\Everywhere.search-ms
success 1 0
1619816870.5615
MoveFileWithProgressW
oldfilepath: C:\Users\Oskar\Searches\Indexed Locations.search-ms
newfilepath: C:\Users\Oskar\Searches\Indexed Locations.search-ms.KENS@TUTA.IO
newfilepath_r: C:\Users\Oskar\Searches\Indexed Locations.search-ms.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Oskar\Searches\Indexed Locations.search-ms
success 1 0
1619816870.5615
MoveFileWithProgressW
oldfilepath: C:\Users\Oskar\Saved Games\desktop.ini
newfilepath: C:\Users\Oskar\Saved Games\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Oskar\Saved Games\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Oskar\Saved Games\desktop.ini
success 1 0
1619816870.9835
MoveFileWithProgressW
oldfilepath: C:\Users\Oskar\Pictures\desktop.ini
newfilepath: C:\Users\Oskar\Pictures\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Oskar\Pictures\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Oskar\Pictures\desktop.ini
success 1 0
1619816871.3425
MoveFileWithProgressW
oldfilepath: C:\Users\Oskar\Music\desktop.ini
newfilepath: C:\Users\Oskar\Music\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Oskar\Music\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Oskar\Music\desktop.ini
success 1 0
1619816871.6085
MoveFileWithProgressW
oldfilepath: C:\Users\Oskar\Links\desktop.ini
newfilepath: C:\Users\Oskar\Links\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Oskar\Links\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Oskar\Links\desktop.ini
success 1 0
1619816871.8735
MoveFileWithProgressW
oldfilepath: C:\Users\Oskar\Links\Desktop.lnk
newfilepath: C:\Users\Oskar\Links\Desktop.lnk.KENS@TUTA.IO
newfilepath_r: C:\Users\Oskar\Links\Desktop.lnk.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Oskar\Links\Desktop.lnk
success 1 0
1619816871.9525
MoveFileWithProgressW
oldfilepath: C:\Users\Oskar\Links\Downloads.lnk
newfilepath: C:\Users\Oskar\Links\Downloads.lnk.KENS@TUTA.IO
newfilepath_r: C:\Users\Oskar\Links\Downloads.lnk.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Oskar\Links\Downloads.lnk
success 1 0
1619816871.9675
MoveFileWithProgressW
oldfilepath: C:\Users\Oskar\Links\RecentPlaces.lnk
newfilepath: C:\Users\Oskar\Links\RecentPlaces.lnk.KENS@TUTA.IO
newfilepath_r: C:\Users\Oskar\Links\RecentPlaces.lnk.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Oskar\Links\RecentPlaces.lnk
success 1 0
1619816872.0305
MoveFileWithProgressW
oldfilepath: C:\Users\Oskar\Favorites\desktop.ini
newfilepath: C:\Users\Oskar\Favorites\desktop.ini.KENS@TUTA.IO
newfilepath_r: C:\Users\Oskar\Favorites\desktop.ini.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Oskar\Favorites\desktop.ini
success 1 0
1619816874.0615
MoveFileWithProgressW
oldfilepath: C:\Users\Oskar\Favorites\Windows Live\Windows Live Hotmail.url
newfilepath: C:\Users\Oskar\Favorites\Windows Live\Windows Live Hotmail.url.KENS@TUTA.IO
newfilepath_r: C:\Users\Oskar\Favorites\Windows Live\Windows Live Hotmail.url.KENS@TUTA.IO
flags: 1
oldfilepath_r: C:\Users\Oskar\Favorites\Windows Live\Windows Live Hotmail.url
success 1 0
File has been identified by 59 AntiVirus engines on VirusTotal as malicious (50 out of 59 个事件)
Bkav W32.AIDetectVM.malware2
Elastic malicious (high confidence)
MicroWorld-eScan Generic.Ransom.GlobeImposter.57B14D3D
FireEye Generic.mg.a0e495354a1e55ac
CAT-QuickHeal Trojan.Mauvaise.SL1
McAfee Globelmposter!A0E495354A1E
Cylance Unsafe
SUPERAntiSpyware Ransom.FileCoder/Variant
Sangfor Malware
K7AntiVirus Trojan ( 00502c261 )
Alibaba Ransom:Win32/Genasom.ali1000102
K7GW Trojan ( 00502c261 )
CrowdStrike win/malicious_confidence_100% (W)
Arcabit Generic.Ransom.GlobeImposter.57B14D3D
BitDefenderTheta AI:Packer.D56EFFC61E
Cyren W32/S-0a10191d!Eldorado
Symantec Ransom.Cryptolocker
TrendMicro-HouseCall Ransom_FAKEGLOBE.SMB
Paloalto generic.ml
ClamAV Win.Ransomware.Globeimposter-6991673-1
Kaspersky HEUR:Trojan.Win32.Generic
BitDefender Generic.Ransom.GlobeImposter.57B14D3D
NANO-Antivirus Trojan.Win32.Encoder.faecqn
AegisLab Trojan.Win32.Generic.4!c
Tencent Win32.Trojan.Raas.Auto
Ad-Aware Generic.Ransom.GlobeImposter.57B14D3D
Sophos ML/PE-A + Troj/Ransom-EVE
Comodo TrojWare.Win32.Necne.AB@7l2s58
DrWeb Trojan.Encoder.11539
TrendMicro Ransom_FAKEGLOBE.SMB
McAfee-GW-Edition BehavesLike.Win32.Globelmposter.qh
Emsisoft Generic.Ransom.GlobeImposter.57B14D3D (B)
SentinelOne Static AI - Malicious PE
Jiangmin Trojan.Generic.cblhx
Avira HEUR/AGEN.1117723
MAX malware (ai score=100)
Antiy-AVL Trojan[Ransom]/Win32.GlobeImposter
Microsoft Ransom:Win32/Filecoder.RB!MSR
ViRobot Trojan.Win32.Ransom.75776.B
ZoneAlarm HEUR:Trojan.Win32.Generic
GData Generic.Ransom.GlobeImposter.57B14D3D
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.FileCoder.R228072
Acronis suspicious
ALYac Trojan.Ransom.GlobeImposter
TACHYON Ransom/W32.GlobeImposter.54784.O
VBA32 BScope.Trojan.Encoder
Malwarebytes Ransom.GlobeImposter
Panda Trj/Genetic.gen
APEX Malicious
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)
dead_host 172.217.24.14:443
dead_host 172.217.160.78:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2018-04-03 00:47:20

Imports

Library KERNEL32.dll:
0x401024 SetFilePointerEx
0x401028 CloseHandle
0x40102c lstrlenW
0x401030 CreateFileW
0x401034 HeapCreate
0x401038 GetCurrentProcess
0x40103c ExitProcess
0x401040 CreateThread
0x401044 GetCurrentThread
0x401048 SetThreadPriority
0x401050 Sleep
0x401054 GetLogicalDrives
0x401058 SetFilePointer
0x40105c FindClose
0x401060 lstrcmpiA
0x401064 lstrcmpiW
0x401068 lstrcpyA
0x40106c ReadFile
0x401070 lstrcatW
0x401074 GetModuleFileNameW
0x401078 CreateProcessW
0x401080 GetDriveTypeA
0x401084 GetTempPathW
0x401088 GetTempFileNameW
0x40108c SetFileAttributesW
0x401090 GetFileAttributesW
0x401094 FindFirstFileW
0x401098 FindNextFileW
0x40109c CopyFileW
0x4010a0 MoveFileExW
0x4010a4 SetPriorityClass
0x4010a8 MultiByteToWideChar
0x4010ac WideCharToMultiByte
0x4010b0 CompareStringA
0x4010b4 WriteFile
0x4010b8 GetFileSizeEx
0x4010bc GetLastError
0x4010c0 lstrlenA
0x4010c4 GetProcessHeap
0x4010c8 HeapFree
0x4010cc HeapReAlloc
0x4010d0 lstrcpyW
0x4010d4 HeapAlloc
Library ADVAPI32.dll:
0x401000 RegQueryValueExW
0x401004 RegOpenKeyExW
0x401008 RegCreateKeyExW
0x40100c RegCloseKey
0x401010 CryptGenRandom
0x401014 CryptReleaseContext
0x40101c RegSetValueExW
Library SHELL32.dll:
0x4010dc SHChangeNotify
0x4010e0 ShellExecuteExW
Library SHLWAPI.dll:
0x4010e8 PathFindFileNameW
0x4010ec PathRemoveFileSpecW
0x4010f0 PathAddBackslashW
Library ntdll.dll:
0x4010f8 _aulldiv
0x4010fc _alldiv
0x401100 _allrem
0x401104 _chkstk
0x401108 RtlUnwind

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 60384 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49713 224.0.0.252 5355
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 61680 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 65004 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 51379 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.