Examples of Troj/Ransom-MC include:
Example 1
File Information
- Size
- 144K
- SHA-1
- 4746486d91d1a94cd76415b6e1e52bc96dc9fe9e
- MD5
- d28964c1f895c8edcb613f8b2cb5d051
- CRC-32
- 10faff6a
- File type
- Windows executable
- First seen
- 2013-01-10
Runtime Analysis
Dropped Files
- c:\Documents and Settings\test user\Start Menu\Programs\Startup\runctf.lnk
- Size
- 740
- SHA-1
- 5cd04bdd6c0248bccd375625e9fa5f413bee4a40
- MD5
- 4a4bd26493e55d7eb2fcc8660dda24e8
- CRC-32
- 18ee64fe
- File type
- Windows Shortcut file (.LNK)
- First seen
- 2013-01-10
- C:\Documents and Settings\All Users\Application Data\elpmas.js
- Size
- 2.4K
- SHA-1
- 8ee4bff2fd557efb4f54333291d53e29c25b7658
- MD5
- f401340119e2ee08feab6563955c783b
- CRC-32
- dfc09537
- File type
- JavaScript
- First seen
- 2012-12-22
- C:\Documents and Settings\All Users\Application Data\elpmas.pad
- Size
- 91M
- SHA-1
- c920fdb2c503c6f1d55f059459e589d260cf56e9
- MD5
- be212e4495146c4dd1f7846a408d953c
- CRC-32
- 3130ecd2
- File type
- Unspecified binary - probably data
- First seen
- 2013-01-10
Registry Keys Created
- HKCU\Software\Microsoft\Internet Explorer\Main
- NoProtectedModeBanner
- 0x00000001
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
- 2500
- 0x00000003
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
- 2500
- 0x00000003
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
- 2500
- 0x00000003
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
- 2500
- 0x00000003
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
- 2500
- 0x00000003
Registry Keys Modified
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
- 1609
- 0x00000000
IP Connections
Example 2
File Information
- Size
- 140K
- SHA-1
- a75fee8ad428e8f0cd357422aea175e4664ae5f8
- MD5
- 189711e590217d54b24877574683d73e
- CRC-32
- 87e0ac97
- File type
- Windows executable
- First seen
- 2013-01-12
Example 3
File Information
- Size
- 144K
- SHA-1
- e8b603ddff2e5947d598147b99bebf3220579b16
- MD5
- 0f6aaace6733771cf0e988d5e767b08c
- CRC-32
- 2f9a7647
- File type
- Windows executable
- First seen
- 2013-01-10
Runtime Analysis
Dropped Files
- c:\Documents and Settings\test user\Start Menu\Programs\Startup\runctf.lnk
- Size
- 740
- SHA-1
- 2987fdf9a1640ba71c799916149c97e2f6ac6c3e
- MD5
- b129ca09a383e57ba60e667a5b6092b7
- CRC-32
- 7876eb33
- File type
- Windows Shortcut file (.LNK)
- First seen
- 2013-01-10
- C:\Documents and Settings\All Users\Application Data\elpmas.pad
- Size
- 91M
- SHA-1
- 1e542097e2607692e6b84e3a5e966a250a83b54d
- MD5
- fd39b209258883a7d10929997feae4de
- CRC-32
- 1e2d23a9
- File type
- Unspecified binary - probably data
- First seen
- 2013-01-10
- C:\Documents and Settings\All Users\Application Data\elpmas.js
- Size
- 2.4K
- SHA-1
- 8ee4bff2fd557efb4f54333291d53e29c25b7658
- MD5
- f401340119e2ee08feab6563955c783b
- CRC-32
- dfc09537
- File type
- JavaScript
- First seen
- 2012-12-22
Registry Keys Created
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
- 2500
- 0x00000003
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
- 2500
- 0x00000003
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
- 2500
- 0x00000003
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
- 2500
- 0x00000003
- HKCU\Software\Microsoft\Internet Explorer\Main
- NoProtectedModeBanner
- 0x00000001
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
- 2500
- 0x00000003
Registry Keys Modified
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
- 1609
- 0x00000000
- HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
- 1609
- 0x00000000
IP Connections