Play interactive tour

Edit tour

Analysis Report clop ransomware

Overview

General Information

Joe Sandbox Version:	28.0.0 Lapis Lazuli
Analysis ID:	196971
Start date:	18.12.2019
Start time:	11:15:13
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	clop ransomware (renamed file extension from none to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit (version 1803) with Office 2016, Adobe Reader DC 19, Chrome 70, Firefox 63, Java 8.171, Flash 30.0.0.113
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.rans.evad.winEXE@3/47@0/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 40.9% (good quality ratio 35.1%) Quality average: 72.2% Quality standard deviation: 36%
HCA Information:	Successful, ratio: 51% Number of executed functions: 27 Number of non-executed functions: 40
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): dllhost.exe, conhost.exe, CompatTelRunner.exe Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Detection

Strategy	Score	Range	Reporting	Whitelisted	Threat	Detection
Threshold	100	0 - 100		false	Clop Ransomware

Confidence

Strategy	Score	Range	Further Analysis Required?	Confidence
Threshold	5	0 - 5	false

Classification

Analysis Advice

Sample is looking for USB drives. Launch the sample with the USB Fake Disk cookbook

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Replication Through Removable Media1	Command-Line Interface2	Hidden Files and Directories1	Process Injection2	Masquerading1	Credential Dumping	System Time Discovery1	Remote File Copy1	Data from Local System	Data Encrypted11	Standard Cryptographic Protocol2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Data Encrypted for Impact1
Replication Through Removable Media	Execution through API1	Registry Run Keys / Startup Folder1	Accessibility Features	Hidden Files and Directories1	Network Sniffing	Query Registry1	Replication Through Removable Media1	Data from Removable Media	Exfiltration Over Other Network Medium	Remote File Copy1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
External Remote Services	Windows Management Instrumentation	Accessibility Features	Path Interception	Software Packing21	Input Capture	Virtualization/Sandbox Evasion2	Windows Remote Management	Data from Network Shared Drive	Automated Exfiltration	Custom Cryptographic Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Drive-by Compromise	Scheduled Task	System Firmware	DLL Search Order Hijacking	Virtualization/Sandbox Evasion2	Credentials in Files	Process Discovery3	Logon Scripts	Input Capture	Data Encrypted	Multiband Communication	SIM Card Swap		Premium SMS Toll Fraud
Exploit Public-Facing Application	Command-Line Interface	Shortcut Modification	File System Permissions Weakness	Process Injection2	Account Manipulation	Peripheral Device Discovery11	Shared Webroot	Data Staged	Scheduled Transfer	Standard Cryptographic Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Spearphishing Link	Graphical User Interface	Modify Existing Service	New Service	Deobfuscate/Decode Files or Information1	Brute Force	Security Software Discovery21	Third-party Software	Screen Capture	Data Transfer Size Limits	Commonly Used Port	Jamming or Denial of Service		Abuse Accessibility Features
Spearphishing Attachment	Scripting	Path Interception	Scheduled Task	Obfuscated Files or Information2	Two-Factor Authentication Interception	File and Directory Discovery2	Pass the Hash	Email Collection	Exfiltration Over Command and Control Channel	Uncommonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Spearphishing via Service	Third-party Software	Logon Scripts	Process Injection	DLL Side-Loading1	Bash History	System Information Discovery33	Remote Desktop Protocol	Clipboard Data	Exfiltration Over Alternative Protocol	Standard Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Signature Overview

Click to jump to signature section

AV Detection:

Antivirus detection for sample

Show sources

Source: clop ransomware.exe

Avira: detection malicious, Label: TR/Zudochka.tztrl

Multi AV Scanner detection for submitted file

Show sources

Source: clop ransomware.exe	Virustotal: Detection: 86%			Perma Link
Source: clop ransomware.exe	Metadefender: Detection: 66%			Perma Link

Machine Learning detection for sample

Show sources

Source: clop ransomware.exe

Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Show sources

Source: 0.0.clop ransomware.exe.400000.0.unpack

Avira: Label: TR/Zudochka.tztrl

Cryptography:

Uses Microsoft's Enhanced Cryptographic Provider

Show sources

Source: C:\Users\user\Desktop\clop ransomware.exe	Code function: 0_2_0040D040 WriteFile,SetErrorMode,lstrlenA,CryptStringToBinaryA,CryptDecodeObjectEx,CryptAcquireContextW,CryptImportPublicKeyInfoEx,CryptEncrypt,GlobalAlloc,CryptEncrypt,		0_2_0040D040
Source: C:\Users\user\Desktop\clop ransomware.exe	Code function: 0_2_0040D200 VirtualAlloc,SetErrorMode,CryptAcquireContextW,CryptAcquireContextW,CryptAcquireContextW,CryptGenKey,CryptExportKey,CryptExportKey,CryptDestroyKey,CryptReleaseContext,		0_2_0040D200

Public key (encryption) found

Show sources

Source: C:\Users\user\Desktop\clop ransomware.exe	Code function: -----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCpEnzYAtPzcmKnw41bLkkkDDmZ 1YB4weOpyx0lY8gVl0gvveTMKhmhYNzjc5uQfXH3fbGmbbdELle/u7YsdXkuNHRQ ThnFfs+q7SIw1nibfYa4c9KA4ftfr69dZTt4T/RzRzsISVNU1Q6me59k9bBqxgiy DRjJhl79BT65Ggn+uQIDAQAB -----END PUBL	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Code function: -----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCpEnzYAtPzcmKnw41bLkkkDDmZ 1YB4weOpyx0lY8gVl0gvveTMKhmhYNzjc5uQfXH3fbGmbbdELle/u7YsdXkuNHRQ ThnFfs+q7SIw1nibfYa4c9KA4ftfr69dZTt4T/RzRzsISVNU1Q6me59k9bBqxgiy DRjJhl79BT65Ggn+uQIDAQAB -----END PUBL	0_2_0040D9F0
Source: C:\Users\user\Desktop\clop ransomware.exe	Code function: -----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCpEnzYAtPzcmKnw41bLkkkDDmZ 1YB4weOpyx0lY8gVl0gvveTMKhmhYNzjc5uQfXH3fbGmbbdELle/u7YsdXkuNHRQ ThnFfs+q7SIw1nibfYa4c9KA4ftfr69dZTt4T/RzRzsISVNU1Q6me59k9bBqxgiy DRjJhl79BT65Ggn+uQIDAQAB -----END PUBL	0_2_0040DA20
Source: clop ransomware.exe	Binary or memory string: -----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCpEnzYAtPzcmKnw41bLkkkDDmZ 1YB4weOpyx0lY8gVl0gvveTMKhmhYNzjc5uQfXH3fbGmbbdELle/u7YsdXkuNHRQ ThnFfs+q7SIw1nibfYa4c9KA4ftfr69dZTt4T/RzRzsISVNU1Q6me59k9bBqxgiy DRjJhl79BT65Ggn+uQIDAQAB -----END PUBL

Spreading:

Checks for available system drives (often done to infect USB drives)

Show sources

Source: C:\Users\user\Desktop\clop ransomware.exe	File opened: z:	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File opened: x:	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File opened: v:	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File opened: t:	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File opened: r:	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File opened: p:	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File opened: n:	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File opened: l:	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File opened: j:	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File opened: h:	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File opened: f:	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File opened: b:	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File opened: y:	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File opened: w:	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File opened: u:	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File opened: s:	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File opened: q:	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File opened: o:	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File opened: m:	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File opened: k:	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File opened: i:	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File opened: g:	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: c:	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File opened: a:	Jump to behavior

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\Users\user\Desktop\clop ransomware.exe	Code function: 0_2_0040B480 SetErrorMode,lstrcpyW,lstrcpyW,lstrcatW,lstrcatW,lstrcpyW,lstrcatW,FindFirstFileW,StrStrW,lstrcmpW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrcmpW,lstrcmpW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,wsprintfW,lstrcpyA,lstrcpyW,lstrcpyW,CreateThread,WaitForSingleObject,FindNextFileW,lstrcmpW,lstrcmpW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,wsprintfW,lstrcpyA,lstrcpyW,lstrcpyW,CreateThread,WaitForSingleObject,FindNextFileW,FindClose,FindClose,lstrcpyW,lstrcatW,FindFirstFileW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrcmpW,lstrcmpW,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,FindNextFileW,lstrcmpW,lstrcmpW,lstrcpyW,lstrcatW	0_2_0040B480
Source: C:\Users\user\Desktop\clop ransomware.exe	Code function: 0_2_0040BE90 SetErrorMode,lstrcpyW,lstrcpyW,lstrcatW,lstrcatW,lstrcpyW,lstrcatW,FindFirstFileW,StrStrW,lstrcmpW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrcmpW,lstrcmpW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,wsprintfW,lstrcpyA,lstrcpyW,lstrcpyW,CreateThread,WaitForSingleObject,FindNextFileW,lstrcmpW,lstrcmpW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,wsprintfW,lstrcpyA,lstrcpyW,lstrcpyW,CreateThread,WaitForSingleObject,FindNextFileW,FindClose,FindClose,lstrcpyW,lstrcatW,StrStrW,StrStrW,FindFirstFileW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrcmpW,lstrcmpW,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,F	0_2_0040BE90
Source: C:\Users\user\Desktop\clop ransomware.exe	Code function: 0_2_0040D88A FindFirstFileTransactedA,	0_2_0040D88A
Source: C:\Users\user\Desktop\clop ransomware.exe	Code function: 0_2_004046B5 FindFirstFileExA,	0_2_004046B5

Networking:

Downloads files

Show sources

Source: C:\Users\user\Desktop\clop ransomware.exe

File created: C:\Documents and Settings\Default\AppData\Local\Application Data\Temporary Internet Files\ClopReadMe.txt

Jump to behavior

Urls found in memory or binary data

Show sources

Source: OpenWith.exe, 00000007.00000002.2185337136.000001FB527A6000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: OpenWith.exe, 00000007.00000002.2185337136.000001FB527A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: OpenWith.exe, 00000007.00000002.2185337136.000001FB527A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: OpenWith.exe, 00000007.00000002.2185337136.000001FB527A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: OpenWith.exe, 00000007.00000002.2185337136.000001FB527A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: OpenWith.exe, 00000007.00000002.2185337136.000001FB527A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: OpenWith.exe, 00000007.00000002.2185337136.000001FB527A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: OpenWith.exe, 00000007.00000002.2185337136.000001FB527A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: OpenWith.exe, 00000007.00000002.2185337136.000001FB527A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: OpenWith.exe, 00000007.00000002.2185337136.000001FB527A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: OpenWith.exe, 00000007.00000002.2185337136.000001FB527A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: OpenWith.exe, 00000007.00000002.2185337136.000001FB527A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: OpenWith.exe, 00000007.00000002.2185337136.000001FB527A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: OpenWith.exe, 00000007.00000002.2185337136.000001FB527A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: OpenWith.exe, 00000007.00000002.2185337136.000001FB527A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: clop ransomware.exe, 00000000.00000003.1956860464.0000000002BEA000.00000004.00000001.sdmp	String found in binary or memory: https://www.verivox.de/company/datenschutz/

Spam, unwanted Advertisements and Ransom Demands:

Yara detected Clop Ransomware

Show sources

Source: Yara match

File source: Process Memory Space: clop ransomware.exe PID: 3824, type: MEMORY

Modifies existing user documents (likely ransomware behavior)

Show sources

Source: C:\Users\user\Desktop\clop ransomware.exe	File deleted: C:\Users\user\Desktop\HMPPSXQPQV.pdf	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File deleted: C:\Users\user\Desktop\LIJDSFKJZG.xlsx	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File deleted: C:\Users\user\Desktop\HMPPSXQPQV.docx	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File deleted: C:\Users\user\Desktop\LFOPODGVOH.docx	Jump to behavior

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000006.00000002.2167138375.0000025640508000.00000004.00000020.sdmp, type: MEMORY

Matched rule: Detects LockerGoga ransomware binaries Author: Florian Roth

Detected potential crypto function

Show sources

Source: C:\Users\user\Desktop\clop ransomware.exe	Code function: 0_2_0040A0E5	0_2_0040A0E5
Source: C:\Users\user\Desktop\clop ransomware.exe	Code function: 0_2_00433045	0_2_00433045
Source: C:\Users\user\Desktop\clop ransomware.exe	Code function: 0_2_0043215D	0_2_0043215D
Source: C:\Users\user\Desktop\clop ransomware.exe	Code function: 0_2_004332C0	0_2_004332C0
Source: C:\Users\user\Desktop\clop ransomware.exe	Code function: 0_2_00431C32	0_2_00431C32
Source: C:\Users\user\Desktop\clop ransomware.exe	Code function: 0_2_00432CAC	0_2_00432CAC
Source: C:\Users\user\Desktop\clop ransomware.exe	Code function: 0_2_004335C5	0_2_004335C5
Source: C:\Users\user\Desktop\clop ransomware.exe	Code function: 0_2_0042CEDC	0_2_0042CEDC
Source: C:\Users\user\Desktop\clop ransomware.exe	Code function: 0_2_004326A1	0_2_004326A1

Found potential string decryption / allocating functions

Show sources

Source: C:\Users\user\Desktop\clop ransomware.exe	Code function: String function: 0042B330 appears 32 times
Source: C:\Users\user\Desktop\clop ransomware.exe	Code function: String function: 0040D8D0 appears 44 times

Sample file is different than original file name gathered from version info

Show sources

Source: clop ransomware.exe, 00000000.00000002.2163380138.0000000000980000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameCRYPT32.DLL.MUIj% vs clop ransomware.exe
Source: clop ransomware.exe, 00000000.00000002.2162402654.0000000000490000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamempr.dll.muij% vs clop ransomware.exe
Source: clop ransomware.exe, 00000000.00000002.2165305205.0000000002A50000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs clop ransomware.exe

Tries to load missing DLLs

Show sources

Source: C:\Users\user\Desktop\clop ransomware.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	Section loaded: browcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	Section loaded: dpapi.dll	Jump to behavior

Yara signature match

Show sources

Source: 00000006.00000002.2167138375.0000025640508000.00000004.00000020.sdmp, type: MEMORY

Matched rule: Ransom_LockerGoga_Mar19_1 date = 2019-03-19, hash3 = bdf36127817413f625d2625d3133760af724d6ad2410bea7297ddc116abc268f, hash2 = 7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26, hash1 = c97d9bbc80b573bdeeda3812f4d00e5183493dd0d5805e2508728f65977dda15, author = Florian Roth, description = Detects LockerGoga ransomware binaries, reference = https://www.nrk.no/norge/skreddersydd-dobbeltangrep-mot-hydro-1.14480202, license = https://creativecommons.org/licenses/by-nc/4.0/

Classification label

Show sources

Source: classification engine

Classification label: mal100.rans.evad.winEXE@3/47@0/0

Contains functionality to enum processes or threads

Show sources

Source: C:\Users\user\Desktop\clop ransomware.exe

Code function: 0_2_0040D8D0 GetCurrentThread,Sleep,CreateToolhelp32Snapshot,lstrcpyW,lstrcpyW,lstrlenW,CharUpperBuffW,CloseHandle,Process32FirstW,lstrcpyW,lstrlenW,CharUpperBuffW,lstrcmpW,OpenProcess,TerminateProcess,CloseHandle,lstrcpyW,Process32NextW,CloseHandle,

0_2_0040D8D0

Contains functionality to load and extract PE file embedded resources

Show sources

Source: C:\Users\user\Desktop\clop ransomware.exe

Code function: 0_2_0040DAA0 StrStrW,SetErrorMode,wsprintfW,CreateFileW,CloseHandle,lstrcmpW,GetModuleHandleW,FindResourceW,LoadResource,LockResource,SizeofResource,GlobalAlloc,CreateFileW,WriteFile,CloseHandle,GlobalFree,

0_2_0040DAA0

Creates files inside the user directory

Show sources

Source: C:\Users\user\Desktop\clop ransomware.exe

File created: C:\Users\user\Desktop\desktop.ini.Clop

Jump to behavior

Creates mutexes

Show sources

Source: C:\Windows\System32\OpenWith.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:14160:120:WilError_01
Source: C:\Users\user\Desktop\clop ransomware.exe	Mutant created: \Sessions\1\BaseNamedObjects\CLOP#666

Creates temporary files

Show sources

Source: C:\Users\user\Desktop\clop ransomware.exe

File created: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Temp\ClopReadMe.txt

Jump to behavior

Might use command line arguments

Show sources

Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: popup.txt	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: //...//	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: 1234567890	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: zoolz.exe	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: mysqld-nt.exe	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: syntime.exe	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: agntsv.exe	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: mysqld-opt.exe	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: tbirdonfig.exe	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: dbeng50.exe	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: oautoupds.exe	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: thebat.exe	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: dbsnmp.exe	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: oomm.exe	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: thebat64.exe	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: ensv.exe	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: ossd.exe	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: thunderbird.exe	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: exel.exe	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: onenote.exe	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: visio.exe	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: orale.exe	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: winword.exe	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: infopath.exe	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: outlook.exe	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: wordpad.exe	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: isqlplussv.exe	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: powerpnt.exe	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: xfssvon.exe	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: msaess.exe	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: tmlisten.exe	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: msftesql.exe	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: sqlagent.exe	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: PNTMon.exe	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: mspub.exe	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: sqlbrowser.exe	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: NTAoSMgr.exe	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: sqlservr.exe	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: Ntrtsan.exe	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: sqlwriter.exe	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: mbamtray.exe	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: mysqld.exe	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: steam.exe	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: CLOP#666	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: %c:	0_2_0040D450
Source: C:\Users\user\Desktop\clop ransomware.exe	Command line argument: .	0_2_0040D450

PE file has an executable .text section and no other executable section

Show sources

Source: clop ransomware.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads ini files

Show sources

Source: C:\Users\user\Desktop\clop ransomware.exe

File read: C:\$Recycle.Bin\S-1-5-18\desktop.ini

Jump to behavior

Reads software policies

Show sources

Source: C:\Users\user\Desktop\clop ransomware.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Sample is known by Antivirus

Show sources

Source: clop ransomware.exe	Virustotal: Detection: 86%
Source: clop ransomware.exe	Metadefender: Detection: 66%

Spawns processes

Show sources

Source: unknown	Process created: C:\Users\user\Desktop\clop ransomware.exe 'C:\Users\user\Desktop\clop ransomware.exe'
Source: unknown	Process created: C:\Windows\System32\notepad.exe 'C:\Windows\system32\NOTEPAD.EXE' C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ClopReadMe.txt
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding

Uses an in-process (OLE) Automation server

Show sources

Source: C:\Windows\System32\notepad.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\InProcServer32

Jump to behavior

Data Obfuscation:

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\Desktop\clop ransomware.exe

Unpacked PE file: 0.2.clop ransomware.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.gfids:R;.rsrc:R;.reloc:R;

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\Desktop\clop ransomware.exe

Unpacked PE file: 0.2.clop ransomware.exe.400000.0.unpack

Uses code obfuscation techniques (call, push, ret)

Show sources

Source: C:\Users\user\Desktop\clop ransomware.exe	Code function: 0_2_00401936 push ecx; ret		0_2_00401949
Source: C:\Users\user\Desktop\clop ransomware.exe	Code function: 0_2_0042B375 push ecx; ret		0_2_0042B388

Persistence and Installation Behavior:

Creates license or readme file

Show sources

Source: C:\Users\user\Desktop\clop ransomware.exe	File created: C:\ClopReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File created: C:\$Recycle.Bin\ClopReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File created: C:\$Recycle.Bin\S-1-5-18\ClopReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File created: C:\$Recycle.Bin\S-1-5-21-58933367-3072710494-194312298-1001\ClopReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File created: C:\$Recycle.Bin\S-1-5-21-58933367-3072710494-194312298-1002\ClopReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File created: C:\Documents and Settings\ClopReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File created: C:\Documents and Settings\All Users\ClopReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File created: C:\Documents and Settings\Default\ClopReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File created: C:\Documents and Settings\Default\AppData\ClopReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File created: C:\Documents and Settings\Default\AppData\Local\ClopReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File created: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\History\ClopReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File created: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Microsoft\ClopReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File created: C:\Documents and Settings\Default\AppData\Local\Application Data\Application Data\Temp\ClopReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File created: C:\Documents and Settings\Default\AppData\Local\Application Data\Temporary Internet Files\ClopReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\ClopReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\ClopReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File created: C:\Documents and Settings\Default\Cookies\ClopReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File created: C:\Documents and Settings\Default\Documents\ClopReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File created: C:\Documents and Settings\Default\Documents\My Music\ClopReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File created: C:\Documents and Settings\Default\Documents\My Pictures\ClopReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File created: C:\Documents and Settings\Default\Documents\My Videos\ClopReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File created: C:\Documents and Settings\Default\Downloads\ClopReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File created: C:\Documents and Settings\Default\Favorites\ClopReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File created: C:\Documents and Settings\Default\Links\ClopReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File created: C:\Documents and Settings\Default\NetHood\ClopReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File created: C:\Documents and Settings\Default\PrintHood\ClopReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File created: C:\Documents and Settings\Default\Recent\ClopReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File created: C:\Documents and Settings\Default\Saved Games\ClopReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File created: C:\Documents and Settings\Default\SendTo\ClopReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File created: C:\Documents and Settings\Default\Start Menu\ClopReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File created: C:\Documents and Settings\Default\Start Menu\Programs\ClopReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File created: C:\Documents and Settings\Default\Start Menu\Programs\Accessibility\ClopReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File created: C:\Documents and Settings\Default\Start Menu\Programs\Accessories\ClopReadMe.txt	Jump to behavior

Boot Survival:

Stores files to the Windows start menu directory

Show sources

Source: C:\Users\user\Desktop\clop ransomware.exe	File created: C:\Documents and Settings\Default\Start Menu\ClopReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File created: C:\Documents and Settings\Default\Start Menu\Programs\desktop.ini.Clop	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File created: C:\Documents and Settings\Default\Start Menu\Programs\ClopReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File created: C:\Documents and Settings\Default\Start Menu\Programs\Accessibility\Desktop.ini.Clop	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File created: C:\Documents and Settings\Default\Start Menu\Programs\Accessibility\ClopReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File created: C:\Documents and Settings\Default\Start Menu\Programs\Accessories\Desktop.ini.Clop	Jump to behavior
Source: C:\Users\user\Desktop\clop ransomware.exe	File created: C:\Documents and Settings\Default\Start Menu\Programs\Accessories\ClopReadMe.txt	Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Creates files in the recycle bin to hide itself

Show sources

Source: C:\Users\user\Desktop\clop ransomware.exe

File created: C:\$Recycle.Bin\ClopReadMe.txt

Jump to behavior

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Show sources

Source: C:\Windows\System32\OpenWith.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Disables application error messsages (SetErrorMode)

Show sources

Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Found evasive API chain (may stop execution after checking mutex)

Show sources

Source: C:\Users\user\Desktop\clop ransomware.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

graph_0-17287

Contains long sleeps (>= 3 min)

Show sources

Source: C:\Users\user\Desktop\clop ransomware.exe

Thread delayed: delay time: 300000

Jump to behavior

May sleep (evasive loops) to hinder dynamic analysis

Show sources

Source: C:\Users\user\Desktop\clop ransomware.exe TID: 384

Thread sleep time: -300000s >= -30000s

Jump to behavior

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\Users\user\Desktop\clop ransomware.exe	Code function: 0_2_0040B480 SetErrorMode,lstrcpyW,lstrcpyW,lstrcatW,lstrcatW,lstrcpyW,lstrcatW,FindFirstFileW,StrStrW,lstrcmpW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrcmpW,lstrcmpW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,wsprintfW,lstrcpyA,lstrcpyW,lstrcpyW,CreateThread,WaitForSingleObject,FindNextFileW,lstrcmpW,lstrcmpW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,wsprintfW,lstrcpyA,lstrcpyW,lstrcpyW,CreateThread,WaitForSingleObject,FindNextFileW,FindClose,FindClose,lstrcpyW,lstrcatW,FindFirstFileW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrcmpW,lstrcmpW,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,FindNextFileW,lstrcmpW,lstrcmpW,lstrcpyW,lstrcatW	0_2_0040B480
Source: C:\Users\user\Desktop\clop ransomware.exe	Code function: 0_2_0040BE90 SetErrorMode,lstrcpyW,lstrcpyW,lstrcatW,lstrcatW,lstrcpyW,lstrcatW,FindFirstFileW,StrStrW,lstrcmpW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrcmpW,lstrcmpW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,wsprintfW,lstrcpyA,lstrcpyW,lstrcpyW,CreateThread,WaitForSingleObject,FindNextFileW,lstrcmpW,lstrcmpW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,wsprintfW,lstrcpyA,lstrcpyW,lstrcpyW,CreateThread,WaitForSingleObject,FindNextFileW,FindClose,FindClose,lstrcpyW,lstrcatW,StrStrW,StrStrW,FindFirstFileW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrcmpW,lstrcmpW,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,F	0_2_0040BE90
Source: C:\Users\user\Desktop\clop ransomware.exe	Code function: 0_2_0040D88A FindFirstFileTransactedA,	0_2_0040D88A
Source: C:\Users\user\Desktop\clop ransomware.exe	Code function: 0_2_004046B5 FindFirstFileExA,	0_2_004046B5

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Show sources

Source: clop ransomware.exe, 00000000.00000002.2165305205.0000000002A50000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: clop ransomware.exe, 00000000.00000002.2165305205.0000000002A50000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: clop ransomware.exe, 00000000.00000002.2165305205.0000000002A50000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: clop ransomware.exe, 00000000.00000002.2165305205.0000000002A50000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Program exit points

Show sources

Source: C:\Users\user\Desktop\clop ransomware.exe

API call chain: ExitProcess graph end node

graph_0-17289

Queries a list of all running processes

Show sources

Source: C:\Users\user\Desktop\clop ransomware.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Show sources

Source: C:\Users\user\Desktop\clop ransomware.exe

Code function: 0_2_00404274 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00404274

Contains functionality to read the PEB

Show sources

Source: C:\Users\user\Desktop\clop ransomware.exe

Code function: 0_2_0040335D mov eax, dword ptr fs:[00000030h]

0_2_0040335D

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Show sources

Source: C:\Users\user\Desktop\clop ransomware.exe

Code function: 0_2_004064AF GetProcessHeap,

0_2_004064AF

Contains functionality to register its own exception handler

Show sources

Source: C:\Users\user\Desktop\clop ransomware.exe	Code function: 0_2_00401832 SetUnhandledExceptionFilter,	0_2_00401832
Source: C:\Users\user\Desktop\clop ransomware.exe	Code function: 0_2_00401241 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00401241
Source: C:\Users\user\Desktop\clop ransomware.exe	Code function: 0_2_00404274 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00404274
Source: C:\Users\user\Desktop\clop ransomware.exe	Code function: 0_2_004016E4 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004016E4
Source: C:\Users\user\Desktop\clop ransomware.exe	Code function: 0_2_004256A5 SetUnhandledExceptionFilter,	0_2_004256A5

HIPS / PFW / Operating System Protection Evasion:

May try to detect the Windows Explorer process (often used for injection)

Show sources

Source: clop ransomware.exe, 00000000.00000002.2163488807.0000000000D60000.00000002.00000001.sdmp, notepad.exe, 00000006.00000002.2167807411.0000025640AF0000.00000002.00000001.sdmp, OpenWith.exe, 00000007.00000002.2181016027.000001FB4E530000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: clop ransomware.exe, 00000000.00000002.2163488807.0000000000D60000.00000002.00000001.sdmp, notepad.exe, 00000006.00000002.2167807411.0000025640AF0000.00000002.00000001.sdmp, OpenWith.exe, 00000007.00000002.2181016027.000001FB4E530000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: clop ransomware.exe, 00000000.00000002.2163488807.0000000000D60000.00000002.00000001.sdmp, notepad.exe, 00000006.00000002.2167807411.0000025640AF0000.00000002.00000001.sdmp, OpenWith.exe, 00000007.00000002.2181016027.000001FB4E530000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: clop ransomware.exe, 00000000.00000002.2163488807.0000000000D60000.00000002.00000001.sdmp, notepad.exe, 00000006.00000002.2167807411.0000025640AF0000.00000002.00000001.sdmp, OpenWith.exe, 00000007.00000002.2181016027.000001FB4E530000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality locales information (e.g. system language)

Show sources

Source: C:\Users\user\Desktop\clop ransomware.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,___crtGetLocaleInfoA,	0_2_00435378
Source: C:\Users\user\Desktop\clop ransomware.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,___crtGetLocaleInfoA,	0_2_0043537C
Source: C:\Users\user\Desktop\clop ransomware.exe	Code function: __crtGetLocaleInfoA_stat,	0_2_0043672A

Contains functionality to query CPU information (cpuid)

Show sources

Source: C:\Users\user\Desktop\clop ransomware.exe

Code function: 0_2_0040194B cpuid

0_2_0040194B

Queries the volume information (name, serial number etc) of a device

Show sources

Source: C:\Windows\System32\notepad.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ClopReadMe.txt VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segmdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segmdl2.ttf VolumeInformation	Jump to behavior

Contains functionality to query local / system time

Show sources

Source: C:\Users\user\Desktop\clop ransomware.exe

Code function: 0_2_004015CC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,RtlQueryPerformanceCounter,

0_2_004015CC

Queries the cryptographic machine GUID

Show sources

Source: C:\Users\user\Desktop\clop ransomware.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Malware Configuration

No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Simulations

Behavior and APIs

Time	Type	Description
11:16:53	API Interceptor	1x Sleep call for process: clop ransomware.exe modified
11:17:58	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ClopReadMe.txt
11:18:06	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.Clop
11:18:15	API Interceptor	1x Sleep call for process: OpenWith.exe modified

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
clop ransomware.exe	86%	Virustotal		Browse
clop ransomware.exe	67%	Metadefender		Browse
clop ransomware.exe	100%	Avira	TR/Zudochka.tztrl
clop ransomware.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
0.0.clop ransomware.exe.400000.0.unpack	100%	Avira	TR/Zudochka.tztrl		Download File
0.2.clop ransomware.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1039569		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	Virustotal		Browse
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://fontfabrik.com	0%	Virustotal		Browse
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	Virustotal		Browse
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	Virustotal		Browse
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	Virustotal		Browse
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.tiro.com	0%	Virustotal		Browse
http://www.tiro.com	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr	0%	Virustotal		Browse
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	Virustotal		Browse
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	Virustotal		Browse
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	Virustotal		Browse
http://www.sakkal.com	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	Virustotal		Browse
http://www.sajatypeworks.com	0%	URL Reputation	safe

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000002.2167138375.0000025640508000.00000004.00000020.sdmp	Ransom_LockerGoga_Mar19_1	Detects LockerGoga ransomware binaries	Florian Roth	0x3984:$rn1: This may lead to the impossibility of recovery of the certain files.
Process Memory Space: clop ransomware.exe PID: 3824	JoeSecurity_Clop	Yara detected Clop Ransomware	Joe Security

Unpacked PEs

No yara matches

Sigma Overview

No Sigma rule has matched

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report clop ransomware

Overview

General Information

Detection

Confidence

Classification

Analysis Advice

Mitre Att&ck Matrix

Signature Overview

AV Detection:

Cryptography:

Spreading:

Networking:

Spam, unwanted Advertisements and Ransom Demands:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Malware Configuration

Behavior Graph

Simulations

Behavior and APIs

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Overview

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Screenshots

Thumbnails