24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 34:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4bf,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 0190be745aae… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0190be745aae…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 10/25 AV engines flagged this file. 3 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0190be745aae5ec9cb6916759fc24426b552dc67b7fbf05798335b646b7b124a","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","0190be745aae5ec9cb6916759fc24426b552dc67b7fbf05798335b646b7b124a"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable"],"identifier":"0190be745aae5ec9cb6916759fc24426b552dc67b7fbf05798335b646b7b124a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":10,"total":25},"behavioralIndicators":{"malicious":3,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T9ce,"file.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000008f0070a8b00070a8b0000000000009509d77000005760300000006519d7700000000b0ee8f0034296e770000000000000000000000000000000020486e7708000000000000005013097634296e77000000000800000070a8b00000000000000000000000000000000000180000006596d9bfa3834173c8ff8e0094ee8f0028ef8f0040b14173990615ccfeffffff94fca177d0a1b0000000af000000000000000000c39140739cee8f000000000064000000260031003051af00000000003100000000000000f899b000cfa1b000d0a1b0002051af000000af0094ee8f007cee8f00a6eb9d77000000000000000000000000b0476e773156e1a4b4ee8f00 (UID: 00000000-00007280) "file.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007280) "file.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007280) "file.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000b000b48f6a0020f08f006509a2771200000000000000d06c8275020000004850b000b48f6a0040f08f006509a2771200000000000000d06c8275f0b9db761200000054f08f00ae2e9f770200000000000000d06c827564f08f00e16c827502000000000000008cf08f0068205f770200000000000000bf6f86947092e37600000000ccf08f00201b6477ffffffffdcf08f0058105f773c105f77ef6f86947092e3769cb9db76f0b9db76bcf08f00b8f08f000d0000000d0000005041ff767cc83877000000004041ff76d8f08f0050f18f00608d62777b8a62e3feffffffe8f08f00900f5f775041ff76f8f08f000625f2767cc838775041ff7604f18f00 (UID: 00000000-00007280)26:T4ec,"file.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007280) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007280) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007280) "file.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007280) "file.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007280) "file.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007280) "file.exe" called "LoadLibrary" with a parameter NTDLL.dll (UID: 00000000-00007280) "file.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00007280) "file.exe" called "LoadLibrary" with a parameter NTDLL (UID: 00000000-00007280) "file.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00007280) "file.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00007280) "file.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00007280) "file.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007280) "file.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007280)27:T132f,"file.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter timeGetTime (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter NtOpenThread (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00007280) "file.exe" called "GetProcAddress" with a parameter RtlAllocateHeap (UID: 00000000-00007280)28:T524,"file.exe" loaded module "KERNEL32" at base 76980000 "file.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 756f0000 "file.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 756f0000 "file.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 756f0000 "file.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 75ee0000 "file.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 756f0000 "file.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 756f0000 "file.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 756f0000 "file.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73680000 "file.exe" loaded module "USER32.DLL" at base 76be0000 "file.exe" loaded module "ADVAPI32.DLL" at base 75c00000 "file.exe" loaded module "NTDLL.DLL" at base 77990000 "file.exe" loaded module "WINMM.DLL" at base 75640000 "file.exe" loaded module "NTDLL" at base 77990000 "file.exe" loaded module "SHELL32.DLL" at base 76d90000 "file.exe" loaded module "KERNEL32.DLL" at base 76980000 "file.exe" loaded module "GDI32.DLL" at base 776e0000 "file.exe" loaded module "OLE32.DLL" at base 77470000 "file.exe" loaded module "OLEAUT32.DLL" at base 75b60000 "file.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 7698000029:T464,"file.exe" file has an entrypoint instructions - "jmp 0x89d00a,pcmpgtb mm3, qword ptr [eax + eax],add byte ptr [eax], al,add byte ptr [eax], al,jmp 0x89f00f,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"2a:T7e1,"file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "FIRSTENTRY"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "LASTENTRY"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2024"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2007"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")2b:T553,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00008968.00000000.192403.033E0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00008968.00000000.192403.033E0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00008968.00000000.192403.033E0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00008968.00000000.192403.033E0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00008968.00000000.192403.033E0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00008968.00000000.192403.033E0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00008968.00000000.192403.033E0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00008968.00000000.192403.033E0000.00000004.mdmp")2c:T4c1,"15001600c02e61730cf48500f8505f73@ADVAPI32.dll" "0e000f00702f61730cf48500f8505f73@ADVAPI32.dll" "0e000f00cc2f61730cf48500f8505f73@ADVAPI32.dll" "11001200b43761730cf48500f8505f73@ADVAPI32.dll" "11001200483861730cf48500f8505f73@ADVAPI32.dll" "120013008c3861730cf48500f8505f73@ADVAPI32.dll" "12001300e43861730cf48500f8505f73@ADVAPI32.dll" "14001500385e61730cf48500f8505f73@ADVAPI32.dll" "14001500505e61730cf48500f8505f73@ADVAPI32.dll" "14001500685e61730cf48500f8505f73@ADVAPI32.dll" "17001800805e61730cf48500f8505f73@ADVAPI32.dll" "0d000e00985e61730cf48500f8505f73@ADVAPI32.dll" "11001200a85e61730cf48500f8505f73@ADVAPI32.dll" "11001200bc5e61730cf48500f8505f73@ADVAPI32.dll" "0f001000fc5f61730cf48500f8505f73@ADVAPI32.dll" "140015003c6061730cf48500f8505f73@ADVAPI32.dll" "14001500546061730cf48500f8505f73@ADVAPI32.dll" "0c000d009c6061730cf48500f8505f73@ADVAPI32.dll" "0c000d00ac6061730cf48500f8505f73@ADVAPI32.dll" "0e000f00bc6061730cf48500f8505f73@ADVAPI32.dll" "0e000f00cc6061730cf48500f8505f73@ADVAPI32.dll" "0b000c00dc6061730cf48500f8505f73@ADVAPI32.dll" "18001900146361730cf48500f8505f73@RPCRT4.dll" "13001400406361730cf48500f8505f73@RPCRT4.dll" "14001500546361730cf48500f8505f73@RPCRT4.dll"2d:T96d,"file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")2e:T559,"file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "file.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "file.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "file.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "file.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "file.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "file.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "file.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")2f:T523,The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 3A:73:CE:5F:81:A1:1F:2A:77:33:A1:5A:BE:44:23:F9:3C:43:AE:30; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: B1:28:84:62:AC:1C:02:07:B8:F9:D7:0E:21:82:54:A8:C9:59:73:95; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert SHA2 Extended Validation Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 10:20:2B:EE:30:69:CC:B6:AC:5E:47:04:71:CA:B0:75:78:51:58:F5; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 7E:2F:3A:4F:8F:E8:FA:8A:57:30:AE:CA:02:96:96:63:7E:98:6F:3F; see report for more information)30:T5ac4,Found URL "https://frogmen-smell.sbs/apifrogmen-smell.sbsrogmen-smell.sbsncrypt.dllrpc-a75b9402e4cdbccdcbey" - Source: "00000000-00002668.00000000.131966.00220000.00000004.mdmp") Found URL "https://frogmen-smell.sbs/apit" - Source: "00000000-00002668.00000000.131966.00220000.00000004.mdmp") Found URL "http://o.pki.goog/s/we1/0zg0%http://i.pki.goog/we1.crt01frogmen-smell.sbs*.frogmen-smell.sbs0/0-0+%http://c.pki.goog/we1/7jtea6h-ubk.crl0z<" - Source: "00000000-00002668.00000000.131966.00220000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00002668.00000000.131966.00220000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&globalsign" - Source: "00000000-00002668.00000000.131966.00220000.00000004.mdmp") Found URL "http://i.pki.goog/gsr1.crt0-&0$0" - Source: "00000000-00002668.00000000.131966.00220000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:viw2vu" - Source: "00000000-00002668.00000000.131966.00220000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:tioxtpovgoogle" - Source: "00000000-00002668.00000000.131966.00220000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:vv" - Source: "00000000-00002668.00000000.131966.00220000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&vbg0vj" - Source: "00000000-00002668.00000000.131966.00220000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:w" - Source: "00000000-00002668.00000000.131966.00220000.00000004.mdmp") Found URL "https://crib-endanger.sbs/apicrib-endanger.sbsleez-inc.sbsleez-inc.sbsu2.5.29.21u2.5.29.31u2.5.29.37u2.5.29.20u2.5.29.27u2.5.29.28u2.5.29.46u2.5.29.30u2.5.29.33u2.5.29.5u2.5.29.36u2.5.29.54u1.3.14.3.2.7u1.3.14.3.2.7gest" - Source: "00000000-00002668.00000001.133122.00264000.00000004.mdmp") Found URL "http://www.digicert.com/cps0n0l04.http://crl3.digicert.com/sha2-ev-server-g3.crl04.http://crl4.digicert.com/sha2-ev-server-g3.crl0" - Source: "00000000-00002668.00000001.133122.00264000.00000004.mdmp") Found URL "http://ocsp.digicert.com0rfhttp://cacerts.digicert.com/digicertsha2extendedvalidationserverca.crt0qhyfqnli" - Source: "00000000-00002668.00000001.133122.00264000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0" - Source: "00000000-00002668.00000001.133122.00264000.00000004.mdmp") Found URL "http://o.pki.goog/s/we1/0zg0%http://i.pki.goog/we1.crt01frogmen-smell.sbs*.frogmen-smell.sbs0/0-0+%http://c.pki.goog/we1/7jtea6h-ubk.crl0z<" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&globalsign" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://i.pki.goog/gsr1.crt0-&0$0" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:connconltcpcp8],sslchconh0fchtepsche" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://www.digicert.com/cps0n0l04.http://crl3.digicert.com/sha2-ev-server-g3.crl04.http://crl4.digicert.com/sha2-ev-server-g3.crl0" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://ocsp.digicert.com0rfhttp://cacerts.digicert.com/digicertsha2extendedvalidationserverca.crt0qhyfqnli" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcdcd(0?1$0" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0v" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/waa0salt" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'ek" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,0ab^9ckxvgo0vbr0entrust.net1;092www.entrust.net/cps" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?,@6og^vgg0)wp+(the" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;ngte" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!ki0!!salt" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:9*cosalt" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0oc*9cd(" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7v5*0western" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?thf*cerb*ervi" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://crl.comov_ateservices.crl0yh0!e=t+" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0ta[17iusai:" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://www.microsoft.com0gt:(y<%qtz-r9lv<;7=_somj," - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://o.pki.goog/s/we1/nls0%http://i.pki.goog/we1.crt03marshal-zhukov.com*.marshal-zhukov.com0/0-0+%http://c.pki.goog/we1/0b07lkysgu0.crl0^o1gtln/," - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:eg" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "https://steamcommunity.com/profiles/76561199724331900/inventory/" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "https://community.cloudflare.shelp.steampowered.com\/","partner_base_url":"https:\/\/partner.steamgames.com\/","stats_base_url":"https:\/\/partner.steampowered.cygoogle" - Source: "00000000-00002668.00000001.133122.00275000.00000004.mdmp") Found URL "http://o.pki.goog/s/we1/nls0%http://i.pki.goog/we1.crt03marshal-zhukov.com*.marshal-zhukov.com0/0-0+%http://c.pki.goog/we1/0b07lkysgu0.crl0^o1gtln/8s \" (Indicator: \"CallWindowProc\"; Source: \"00000000-00008968.00000000.192403.033E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"673a46267344e586780c31d9"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"file.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74C10000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"673a46267344e586780c31d9"},{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance HTTP/1.1Connection: Keep-Alive\n User-Agent: Microsoft-WNS/10.0\n Host: assets.msn.com\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"673a46267344e586780c31d9"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://assets.msn.com/service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"673a46267344e586780c31d9"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"673a46267344e586780c31d9"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Contains ability to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptExportKey\" (Indicator: \"CryptExportKey\"; Source: \"00000000-00008968.00000000.192403.033E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":2,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"673a46267344e586780c31d9"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - \\.\\NTICE; Source: \"00000000-00003096.00000000.148565.00BA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"673a463fd3202de3310a51c1"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; File: \"00000000-00003096.00000000.148560.00540000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; File: \"00000000-00003096.00000000.148560.00540000.00000004.mdmp\")\n Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00003096.00000000.148560.00540000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00003096.00000000.148560.00540000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"673a463fd3202de3310a51c1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"48,3492,3024,,RtlGetVersion,NTDLL.dll,\"252:24:07.276\",RX=0,PX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00003096.00000000.148565.00BA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"673a463fd3202de3310a51c1"},{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"\\REGISTRY\\MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\OLEAUT\" in Source: 00000000-00003096.00000000.148560.00540000.00000004.mdmp\n \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\OLEAUT\" in Source: 00000000-00003096.00000000.148560.00540000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"673a463fd3202de3310a51c1"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"file.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:ffffffffc0000135]\n \"file.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:ffffffffc0000135]","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"673a463fd3202de3310a51c1"},{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"$2c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"673a463fd3202de3310a51c1"},{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\IMM32.DLL\" [Source: 00000000-00003096-00000C60-1325663334]\n Observed system executable string:\"C:\\Windows\\SYSTEM32\\wow64win.dll\" [Source: 00000000-00003096.00000000.148560.00540000.00000004.mdmp]\n Observed system executable string:\"C:\\Windows\\SYSTEM32\\wow64.dll\" [Source: 00000000-00003096.00000000.148560.00540000.00000004.mdmp]\n Observed system executable string:\"C:\\Windows\\SYSTEM32\\wow64cpu.dll\" [Source: 00000000-00003096.00000000.148560.00540000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"673a463fd3202de3310a51c1"},{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"file.exe\" trying to access non-existent file \"SICE\"\n \"file.exe\" trying to access non-existent file \"SIWVID\"\n \"file.exe\" trying to access non-existent file \"NTICE\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"673a463fd3202de3310a51c1"},{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"48,3492,3024,,RtlGetVersion,NTDLL.dll,\"252:24:07.276\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00003096.00000000.148565.00BA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"673a463fd3202de3310a51c1"},{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"smss.exe,csrss.exe,wininit.exe,winlogon.exe,services.exe\" (File: \"00000000-00003096.00000000.148560.00540000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"673a463fd3202de3310a51c1"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"explorer.exe\" (Indicator: \"explorer.exe\"; File: \"00000000-00003096.00000000.148560.00540000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-481","sources":[{"report_type":"sandbox","report_id":"673a463fd3202de3310a51c1"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in File: \"00000000-00003096.00000000.148560.00540000.00000004.mdmp\")\n Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00003096.00000000.148560.00540000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"673a463fd3202de3310a51c1"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00002668-00000CBB-1078747158\")\n Found reference to \"CryptCNGInitHMAC\" (Indicator: \"HMAC\"; Source: \"00000000-00002668.00000000.131966.00220000.00000004.mdmp, 00000000-00002668.00000001.133122.00220000.00000004.mdmp\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00002668.00000001.133122.00275000.00000004.mdmp\")\n Found reference to \"SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00002668.00000001.133122.00275000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00002668.00000000.131966.00220000.00000004.mdmp, 00000000-00002668.00000001.133122.00275000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"file.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"104.21.80.55:443\"\n \"23.63.176.92:443\"\n \"172.67.160.80:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00002668.00000000.131966.00220000.00000004.mdmp, 00000000-00002668.00000001.133122.00275000.00000004.mdmp\")\n Found string \"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00002668.00000001.133122.00275000.00000004.mdmp\")\n Found string \"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36\" (Indicator: \"user-agent: \"; Source: \"00000000-00002668.00000001.133122.00275000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"300snails.sbs\"\n \"3xc1aimbl0w.sbs\"\n \"bored-light.sbs\"\n \"crib-endanger.sbs\"\n \"faintbl0w.sbs\"\n \"fleez-inc.sbs\"\n \"frogmen-smell.sbs\"\n \"marshal-zhukov.com\"\n \"pull-trucker.sbs\"\n \"steamcommunity.com\"\n \"thicktoys.sbs\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"file.exe\" searching for class \"OLLYDBG\"\n \"file.exe\" searching for class \"GBDYLLO\"\n \"file.exe\" searching for class \"pediy06\"\n \"file.exe\" searching for class \"FilemonClass\"\n \"file.exe\" searching for window \"File Monitor - Sysinternals: www.sysinternals.com\"\n \"file.exe\" searching for class \"PROCMON_WINDOW_CLASS\"\n \"file.exe\" searching for window \"Process Monitor - Sysinternals: www.sysinternals.com\"\n \"file.exe\" searching for class \"RegmonClass\"\n \"file.exe\" searching for window \"Registry Monitor - Sysinternals: www.sysinternals.com\"\n \"file.exe\" searching for class \"18467-41\"\n \"file.exe\" searching for class \"Regmonclass\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$2f","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"\"file.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"272c90\"\n \"lpszHeaders\": \"Content-Type: application/x-www-form-urlencoded\"\n \"dwHeadersLength\": \"4294967295\"\n \"lpOptional\": \"act=life\"\n \"dwOptionalLength\": \"8\"\n \"dwTotalLength\": \"8\"\n \"dwContext\": \"0\"}\n \"file.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"286158\"\n \"lpszHeaders\": \"Content-Type: application/x-www-form-urlencoded\"\n \"dwHeadersLength\": \"4294967295\"\n \"lpOptional\": \"act=life\"\n \"dwOptionalLength\": \"8\"\n \"dwTotalLength\": \"8\"\n \"dwContext\": \"0\"\n \"$error\": \"2ee7\"}\n \"file.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"286158\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}\n \"file.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"286158\"\n \"lpszHeaders\": \"Content-Type: application/x-www-form-urlencoded\"\n \"dwHeadersLength\": \"4294967295\"\n \"lpOptional\": \"act=life\"\n \"dwOptionalLength\": \"8\"\n \"dwTotalLength\": \"8\"\n \"dwContext\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"file.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"272c90\"\n \"lpReserved\": \"0\"\n \"$error\": \"2ee2\"}\n \"file.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"286158\"\n \"lpReserved\": \"0\"}\n \"file.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"286158\"\n \"lpReserved\": \"0\"\n \"$error\": \"2ee2\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00002668-00000C29-1077405315\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00002668-00000C29-1077406043\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"www.mail.google.com0\" [Source: 00000000-00002668.00000001.133122.00275000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.35\"\n \"2.5.29.15\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.19\"\n \"2.5.29.14\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.17\"\n \"2.5.29.32\"\n \"2.5.29.31\"\n \"2.5.29.1\"\n \"2.5.4.3\"\n \"2.5.29.4\"\n \"2.5.29.10\"\n \"2.5.29.16\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$30","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"i HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002668.00000001.133122.00275000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"frogmen-smell.sbs\" (6 days old)\n Newly renewed or created SSL certificate: \"marshal-zhukov.com\" (11 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"frogmen-smell.sbs\" (89 days old)\n Short term registered certificate: \"marshal-zhukov.com\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"104.21.80.55\" on port \"443\"\n HTTPS traffic to \"23.63.176.92\" on port \"443\"\n HTTPS traffic to \"172.67.160.80\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"\"file.exe\" called \"FindFirstFileW\" with parameter %APPDATA%\\Microsoft\\SystemCertificates\\My\\Certificates\\* (UID: 00000000-00002668)\n \"file.exe\" called \"FindNextFileW\" with parameter .. (UID: 00000000-00002668)\n \"file.exe\" called \"FindFirstFileW\" with parameter %APPDATA%\\Microsoft\\SystemCertificates\\My\\CRLs\\* (UID: 00000000-00002668)\n \"file.exe\" called \"FindFirstFileW\" with parameter %APPDATA%\\Microsoft\\SystemCertificates\\My\\CTLs\\* (UID: 00000000-00002668)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"ECDSA_P256\" (Indicator: \"ecdsa\"; Source: \"00000000-00002668.00000001.133122.00275000.00000004.mdmp\")\n Found string \"ECDSA_P384\" (Indicator: \"ecdsa\"; Source: \"00000000-00002668.00000001.133122.00275000.00000004.mdmp\")\n Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00002668.00000001.133122.00275000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"file.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"file.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$31","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"file.exe\" at 00000000-00002668-00000105-5518256","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"info@diginotar.nl\"\n Pattern match: \"cps-requests@verisign.com\"\n Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 104.21.80.55 on port 443 is sent without HTTP header\n TCP traffic to 23.63.176.92 on port 443 is sent without HTTP header\n TCP traffic to 172.67.160.80 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\"login.skype.com0\" (Indicator: \"skype.com\")\n \"login.skype.com\" (Indicator: \"skype.com\")\n \"www.login.skype.com0\" (Indicator: \"skype.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$32","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"level":"suspicious","category":"System Security","name":"Writes registry keys","description":"\"file.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\137\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"frogmen-smell.sbs\" has been identified as malicious\n Contacted Domain: \"marshal-zhukov.com\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$33","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Contacts server\n Matched sigs: Spawned process connects to a network","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"673a462ccc6cbdd8ab099936"},{"report_type":"sandbox","report_id":"673a46267344e586780c31d9"},{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries process information"},{"detail":"Reads the system/video BIOS version"}],"sources":[{"report_type":"sandbox","report_id":"673a462ccc6cbdd8ab099936"},{"report_type":"sandbox","report_id":"673a46267344e586780c31d9"},{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Sets the 'ThreadHideFromDebugger' thread data structure"}],"sources":[{"report_type":"sandbox","report_id":"673a462ccc6cbdd8ab099936"},{"report_type":"sandbox","report_id":"673a46267344e586780c31d9"},{"report_type":"sandbox","report_id":"673a463fd3202de3310a51c1"},{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 11 domains and 11 hosts"}],"sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":5,"imported_dlls_count":66,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":34,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":34,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":11,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["evasive","malicious"],"sample_flags":["Sample Crashed","Network Traffic"],"sandbox_reports":[{"id":"673a463fd3202de3310a51c1","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"file.exe","analysis_start_time":"2024-11-17T19:38:40+00:00","indicators_count":{"informative":45,"suspicious":7,"malicious":1},"tags":["Sample Crashed"],"is_in_unified_schema":true},{"id":"673a4638ff335797cc0293d8","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"file.exe","analysis_start_time":"2024-11-17T19:38:33+00:00","indicators_count":{"informative":73,"suspicious":28,"malicious":3},"tags":["Network Traffic"],"is_in_unified_schema":true},{"id":"673a46329669876c3b02314b","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"file.exe","analysis_start_time":"2024-11-17T19:38:27+00:00","indicators_count":{"informative":73,"suspicious":28,"malicious":3},"tags":["Network Traffic"],"is_in_unified_schema":true},{"id":"673a462ccc6cbdd8ab099936","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"file.exe","analysis_start_time":"2024-11-17T19:38:59+00:00","indicators_count":{"informative":47,"suspicious":13,"malicious":2},"tags":["Sample Crashed"],"is_in_unified_schema":true},{"id":"673a46267344e586780c31d9","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"file.exe","analysis_start_time":"2024-11-17T19:38:15+00:00","indicators_count":{"informative":52,"suspicious":13,"malicious":2},"tags":["Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.21.80.55","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"address":"23.63.176.92","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"address":"172.67.160.80","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]}],"dns_resolutions":[{"domain":"300snails.sbs","country":"-","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"domain":"3xc1aimbl0w.sbs","country":"-","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"domain":"bored-light.sbs","country":"-","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"domain":"crib-endanger.sbs","country":"-","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"domain":"faintbl0w.sbs","country":"-","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"domain":"fleez-inc.sbs","country":"-","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"domain":"frogmen-smell.sbs","address":"104.21.80.55","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"domain":"marshal-zhukov.com","address":"172.67.160.80","ttl":300,"country":"United States","registrar_name":"WEBCC","registrar_organization":"Whoisprotection.cc","registrar_name_servers":"MONROE.NS.CLOUDFLARE.COM","registrar_creation_date":"2024-11-06T18:31:55+00:00","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"domain":"pull-trucker.sbs","country":"-","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"domain":"steamcommunity.com","address":"23.63.176.92","ttl":20,"country":"United States","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"domain":"thicktoys.sbs","country":"-","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"673a462ccc6cbdd8ab099936"}],"processes":[{"pid":7280,"ppid":0,"name":"file.exe","command_line":"","sha256":"0190be745aae5ec9cb6916759fc24426b552dc67b7fbf05798335b646b7b124a","normalized_path":"C:\\file.exe","uid":"00000000-00007280","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACKElEQVR4Xu2RyW4TURBFvfEcB8f8AiwRv0UAA3E8ZERhSJiHsLCUFZK/gwAmTQYyAMYMhgASn+FNUVWvX3enKk/uTeRISUtHbnlxz73VicTpc+KfRq0CU/XJoUDuhPzzKPA879Bfggv0+/2hcPwKtFotaDabDL3b/y++/AdnX/xF/kBpGXn+G9mH0jPiF4w9RZ78hLHHRA+Kj3pwYWV/YK4q4KK0TMJQysJA2gukxYffofggROZI4hc4dOUPFBK+8P43OEPc+8qMLnVVjkQVcJ3KLjUrHdIllC5+MdwlOgNzVQEX4Wmt0Eq7ESFyp4N8hsJt5NYnlSOJXSBc2TUsdiPCDgtHWYosfISRm8SeypGoAq5TydMWIiuZQIrM78HI3C4zKFcVcBFdqqQknN9l8rM7PtuQn9lWOZLYBQIhUgikdukOyyy56Q+Qm0IaWypHogq4ThVdmichrbRSFm4ZUJqrb0K2tsFIoUQVcEFL7Vnz03alL2SpEWZr65CtIpPvGZkjiV2AVh5YSiutlIQ+mYoHmQlijZE5ElXA9QlyDSMMlloprsxUCF96Yw3S198ZrrWVUKIKuLDSjH/aQMhSKzTSdPktpK4Sb1SOJH4BEvvSNK0MpG1IoTBdbrOQufIaUpeR8VWVI1EFXJ+ATyukLGahla5Ccpx4BclLBimUqAIuzi9smpXlgyuTLA2FUc7NeCpHErvAUXE8CtSrE/wyDOpVLHD6nPjnPyIPUCMAVciHAAAAAElFTkSuQmCC"},{"pid":5144,"ppid":7280,"name":"WerFault.exe","command_line":"-u -p 7280 -s 708","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007280","uid":"00000000-00005144"},{"pid":4836,"ppid":7280,"name":"WerFault.exe","command_line":"-u -p 7280 -s 708","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007280","uid":"00000000-00004836"},{"pid":2692,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 444 -p 7280 -ip 7280","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00002692","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACKElEQVR4Xu2RyW4TURBFvfEcB8f8AiwRv0UAA3E8ZERhSJiHsLCUFZK/gwAmTQYyAMYMhgASn+FNUVWvX3enKk/uTeRISUtHbnlxz73VicTpc+KfRq0CU/XJoUDuhPzzKPA879Bfggv0+/2hcPwKtFotaDabDL3b/y++/AdnX/xF/kBpGXn+G9mH0jPiF4w9RZ78hLHHRA+Kj3pwYWV/YK4q4KK0TMJQysJA2gukxYffofggROZI4hc4dOUPFBK+8P43OEPc+8qMLnVVjkQVcJ3KLjUrHdIllC5+MdwlOgNzVQEX4Wmt0Eq7ESFyp4N8hsJt5NYnlSOJXSBc2TUsdiPCDgtHWYosfISRm8SeypGoAq5TydMWIiuZQIrM78HI3C4zKFcVcBFdqqQknN9l8rM7PtuQn9lWOZLYBQIhUgikdukOyyy56Q+Qm0IaWypHogq4ThVdmichrbRSFm4ZUJqrb0K2tsFIoUQVcEFL7Vnz03alL2SpEWZr65CtIpPvGZkjiV2AVh5YSiutlIQ+mYoHmQlijZE5ElXA9QlyDSMMlloprsxUCF96Yw3S198ZrrWVUKIKuLDSjH/aQMhSKzTSdPktpK4Sb1SOJH4BEvvSNK0MpG1IoTBdbrOQufIaUpeR8VWVI1EFXJ+ATyukLGahla5Ccpx4BclLBimUqAIuzi9smpXlgyuTLA2FUc7NeCpHErvAUXE8CtSrE/wyDOpVLHD6nPjnPyIPUCMAVciHAAAAAElFTkSuQmCC"}],"all_imported_dlls":["KernelBase.dll","fltLib.dll","gdi32full.dll","wow64base.dll","wow64win.dll","wow64cpu.dll","apphelp.dll","ws2_32.dll","advapi32.dll","sechost.dll","combase.dll","cryptsp.dll","winmm.dll","wow64con.dll","gdi32.dll","msvcrt.dll","imm32.dll","shell32.dll","ntdll.dll","wow64.dll","oleaut32.dll","VxSSL32.dll","rpcrt4.dll","ucrtbase.dll","user32.dll","msvcp_win.dll","kernel32.dll","win32u.dll","ole32.dll","windows.storage.dll","cfgmgr32.dll","shlwapi.dll","profapi.dll","cryptbase.dll","winmmbase.dll","sspicli.dll","bcryptprimitives.dll","SHCore.dll","kernel.appcore.dll","powrprof.dll","lpk.dll","msctf.dll","api-ms-win-core-synch-l1-2-0.dll","usp10.dll","nsi.dll","rasadhlp.dll","FWPUCLNT.DLL","ncrypt.dll","bcrypt.dll","crypt32.dll","msasn1.dll","credssp.dll","wship6.dll","secur32.dll","mswsock.dll","IPHLPAPI.DLL","gpapi.dll","wshqos.dll","WSHTCPIP.DLL","dnsapi.dll","rsaenh.dll","webio.dll","schannel.dll","winhttp.dll","winnsi.dll","userenv.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"673a463fd3202de3310a51c1"},{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"673a462ccc6cbdd8ab099936"},{"report_type":"sandbox","report_id":"673a46267344e586780c31d9"},{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\MY\\","sources":[{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:7280:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"673a462ccc6cbdd8ab099936"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"673a462ccc6cbdd8ab099936"},{"report_type":"sandbox","report_id":"673a46267344e586780c31d9"},{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]},{"name":"SM0:8968:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"673a46267344e586780c31d9"}]},{"name":"Local\\SM0:8968:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"673a46267344e586780c31d9"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"673a46329669876c3b02314b"},{"report_type":"sandbox","report_id":"673a4638ff335797cc0293d8"}]}]}},"report_ids":{"sandbox_job_ids":["673a462ccc6cbdd8ab099936","673a46267344e586780c31d9","673a463fd3202de3310a51c1","673a4638ff335797cc0293d8","673a46329669876c3b02314b"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample 0190be745aae… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 0190be745aae…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 10/25 AV engines flagged this file. 3 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/0190be745aae5ec9cb6916759fc24426b552dc67b7fbf05798335b646b7b124a"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample 0190be745aae… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 0190be745aae…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 10/25 AV engines flagged this file. 3 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/0190be745aae5ec9cb6916759fc24426b552dc67b7fbf05798335b646b7b124a"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample 0190be745aae… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 0190be745aae…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 10/25 AV engines flagged this file. 3 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L34","11",{}]]