24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 36:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4d3,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Application.Scam.SConnect.Generic Sample 072fb279608d… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 072fb279608d…. Malware family: Application.Scam.SConnect.Generic. Threat score 100/100. 9/25 AV engines flagged this file. 1 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/072fb279608d062dd75764fedc60c55f672a9eb381fa243b53164c9be0a841c8","keywords":["Malicious","Application.Scam.SConnect.Generic","malware analysis","sandbox report","threat intelligence","072fb279608d062dd75764fedc60c55f672a9eb381fa243b53164c9be0a841c8"],"about":{"@type":"SoftwareApplication","name":"suspicious.exe","applicationCategory":["peexe","executable"],"identifier":"072fb279608d062dd75764fedc60c55f672a9eb381fa243b53164c9be0a841c8","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Application.Scam.SConnect.Generic","antivirusDetections":{"malicious":9,"total":25},"behavioralIndicators":{"malicious":1,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T509,Pattern match: "http://ocsp.digicert.com0a", Pattern match: "http://ocsp.digicert.com0c", Pattern match: "crl3.digicert.com/digicerttrustedrootg4.crl0", Pattern match: "cacerts.digicert.com/digicerttrustedrootg4.crt0c", Pattern match: "http://www.digicert.com/cps0", Pattern match: "http://ocsp.digicert.com0x", Pattern match: "www.digicert.com1$0", Pattern match: "http://ocsp.digicert.com0\", Pattern match: "crl3.digicert.com/digicertassuredidrootca.crl0", Pattern match: "cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0", Pattern match: "www.digicert.com1!0", Pattern match: "crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0", Pattern match: "cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0", Pattern match: "https://portal.onepansol.site/bin/screenconnect.client.application?h=portal.onepansol.site&p=8041&k=bgiaaackaabsu0exaagaaaeaaqbjbhggislyyryz5gdjvaerzbe4q70ggejsok%2fmfp78od71rkgcajdsvfgobiivp3jkqptxgxmun4t2izqmqtlavhb4e5yzf5sxmu0d%2fn3at%2fwiuoasfsa4qdbxhs", Pattern match: "cacerts.digicert.com/digicertassuredidrootca.crt0e", Pattern match: "crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0s", Pattern match: "crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0"26:T2634,Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidCodePage"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetTimeFormatW"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "RtlUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "sample.bin"), Found reference to API (Indicator: "FlushFileBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSize"; Source: "sample.bin"), Found reference to API (Indicator: "CertFindAttribute"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedPushEntrySList"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxW"; Source: "sample.bin"), Found reference to API (Indicator: "GetXStateFeaturesMask"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileType"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCPInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "IsDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedFlushSList"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "SetEnvironmentVariableA"; Source: "sample.bin"), Found reference to API (Indicator: "EnumSystemLocalesW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "GetActiveWindow"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "SetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "CertDeleteCertificateFromStore"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetTimeFormatEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "FlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "FlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleCP"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "CertAddCertificateContextToStore"; Source: "sample.bin"), Found reference to API (Indicator: "CertOpenSystemStoreA"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessWindowStation"; Source: "sample.bin"), Found reference to API (Indicator: "CertFreeCertificateContext"; Source: "sample.bin"), Found reference to API (Indicator: "TlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeSListHead"; Source: "sample.bin"), Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "LocalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThread"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileExA"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleMode"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineW"; Source: "sample.bin"), Found reference to API (Indicator: "OutputDebugStringW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessHeap"; Source: "sample.bin"), Found reference to API (Indicator: "OutputDebugStringA"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "LocateXStateFeature"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "FlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "DecodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "FlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "GetOEMCP"; Source: "sample.bin"), Found reference to API (Indicator: "EncodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "CryptQueryObject"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "CertCreateCertificateContext"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastActivePopup"; Source: "sample.bin"), Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileA"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleExW"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringW"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileW"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidLocaleName"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointerEx"; Source: "sample.bin"), Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "LocaleNameToLCID"; Source: "sample.bin"), Found reference to API (Indicator: "WriteConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnabledXStateFeatures"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "sample.bin"), Found reference to API (Indicator: "CryptMsgGetParam"; Source: "sample.bin"), Found reference to API (Indicator: "CertCloseStore"; Source: "sample.bin"), Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "sample.bin"), Found reference to API (Indicator: "AreFileApisANSI"; Source: "sample.bin"), Found reference to API (Indicator: "GetDateFormatW"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadStackGuarantee"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "GetDateFormatEx"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidLocale"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "LCIDToLocaleName"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "sample.bin")27:Tfec,Assembly shows XOR instruction xor eax ebp in Stream UID: 53596-120-00425BF0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 53596-120-00425BF0 Assembly shows XOR instruction xor eax ebp in Stream UID: 53596-355-00438863 Assembly shows XOR instruction xor ecx ebp in Stream UID: 53596-355-00438863 Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 53596-366-00439702 Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 53596-366-00439702 Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 53596-366-00439702 Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 53596-366-00439702 Assembly shows XOR instruction xor eax ebp in Stream UID: 53596-878-0040CB70 Assembly shows XOR instruction xor ecx ebp in Stream UID: 53596-878-0040CB70 Assembly shows XOR instruction xor eax ebp in Stream UID: 53596-940-004361A9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 53596-940-004361A9 Assembly shows XOR instruction xor eax ebp in Stream UID: 53596-941-0042776C Assembly shows XOR instruction xor ecx ebp in Stream UID: 53596-941-0042776C Assembly shows XOR instruction xor eax ebp in Stream UID: 53596-1013-0040EF17 Assembly shows XOR instruction xor ecx ebp in Stream UID: 53596-1013-0040EF17 Assembly shows XOR instruction xor eax ebp in Stream UID: 53596-1016-00427C0C Assembly shows XOR instruction xor ecx ebp in Stream UID: 53596-1016-00427C0C Assembly shows XOR instruction xor eax dword ptr [00448000h] in Stream UID: 53596-1022-00427076 Assembly shows XOR instruction xor eax ebp in Stream UID: 53596-1029-00427ADC Assembly shows XOR instruction xor ecx ebp in Stream UID: 53596-1029-00427ADC Assembly shows XOR instruction xor eax ebp in Stream UID: 53596-1043-00427D2C Assembly shows XOR instruction xor ecx ebp in Stream UID: 53596-1043-00427D2C Assembly shows XOR instruction xor eax ebp in Stream UID: 53596-1046-0042BCAF Assembly shows XOR instruction xor ecx ebp in Stream UID: 53596-1046-0042BCAF Assembly shows XOR instruction xor eax ebp in Stream UID: 53596-1084-0040EEB5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 53596-1084-0040EEB5 Assembly shows XOR instruction xor eax ebp in Stream UID: 53596-1107-004278A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 53596-1107-004278A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 53596-1142-00436E08 Assembly shows XOR instruction xor ecx ebp in Stream UID: 53596-1142-00436E08 Assembly shows XOR instruction xor eax ebp in Stream UID: 53596-1143-00436A23 Assembly shows XOR instruction xor ecx ebp in Stream UID: 53596-1143-00436A23 Assembly shows XOR instruction xor eax ebp in Stream UID: 53596-1144-00436BF0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 53596-1144-00436BF0 Assembly shows XOR instruction xor eax ebp in Stream UID: 53596-1145-00436B02 Assembly shows XOR instruction xor ecx ebp in Stream UID: 53596-1145-00436B02 Assembly shows XOR instruction xor eax ebp in Stream UID: 53596-1146-0043678D Assembly shows XOR instruction xor ecx ebp in Stream UID: 53596-1146-0043678D Assembly shows XOR instruction xor eax ebp in Stream UID: 53596-1873-00424C1B Assembly shows XOR instruction xor ecx ebp in Stream UID: 53596-1873-00424C1B Assembly shows XOR instruction xor eax ebp in Stream UID: 53596-1950-00427CCA Assembly shows XOR instruction xor ecx ebp in Stream UID: 53596-1950-00427CCA Assembly shows XOR instruction xor edx dword ptr [00448000h] in Stream UID: 53596-1957-004271F6 Assembly shows XOR instruction xor eax ebp in Stream UID: 53596-1962-0042784F Assembly shows XOR instruction xor ecx ebp in Stream UID: 53596-1962-0042784F Assembly shows XOR instruction xor eax ebp in Stream UID: 53596-1963-004279AA Assembly shows XOR instruction xor ecx ebp in Stream UID: 53596-1963-004279AA Assembly shows XOR instruction xor eax ebp in Stream UID: 53596-1965-00427A7B Assembly shows XOR instruction xor ecx ebp in Stream UID: 53596-1965-00427A7B28:Teda,"suspicious.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000081000600000028b1800012000600080a3d00640000004f6140775c0000000000000000ef39001aa0e57204ef39000bed407700008000000000000080810014ef3900d8ec4077008081000000000020ef390002d8e5720080810084ef3900b7abe57200808100050000009e297077e094810000000000280000002400000000008000f8ef39006c00000058f039001f0000001f00000000003f00d0073d00300000005c0000000400000000003d00c99a73ab64003900e514e67201000000c893810078b1800005000000000000002000000000003d00d0013d00740a3d0000000000700a3d0050f03900f0ef390050f56f77e094810058f03900a4f03900 (UID: 00000000-00006568) "suspicious.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006568) "suspicious.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006568) "suspicious.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000a0ef390044ef3900226e2d7400006104000000002d6e2d74d2a21d0f2d000000ecb79075c8ef390000003d00a88f8b0030748a00050000008000000008ef390000003d008cef390070c82e746e3c177bfeffffff2d000000d0cc9f75270000005cef3900856a2f741c2334749cef3900f85f2f7408000000bb692e74b2692e740aa21d0f2d000000ecb7907527000000d0cc9f7570ef39002d000000d0cc9f7527000000a0ef3900856a2f741c233474e8ef39007e8a9e75ee8c9e75738a9e753eef0fc72d000000ecb7907527000000d0cc9f75b4136104481361043eef0fc7b0ef3900fc52dc759cf03900e0849e75eef1ecb2feffffff738a9e75 (UID: 00000000-00006568) "suspicious.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0f27077f8f7253f03000000c4ef3900cd017177b0328c004a00000008f0390025849775b0328c009829610408f0390044849775f853dc7534f0390037c1937553849775fcef39009912460013cc3f706fb66858ddd9e2db7f381ffbdef00fc738f03900d9859775f4181c3ff4181c3f010000004e859775068656746bf17cb8f80b9244a510d5f59626b033f6f00fc748f039001dce9e751e0000000000b672feffffffed829e7500008e7500000000000000007af00fc768f03900 (UID: 00000000-00006568) "suspicious.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000003d00d0013d00740a3d0000000000700a3d0000000000e8ef390059167077240000000000000000000000000080000000000030000000b4ad8b0090ad8b0037066f7702000000000080002400000000000000f4ef390008f03900ee13707701000000ee1370770000000000000000f082c97420f7253f20f0390032ba71779cad8b0000000000000000000000000048f039009651a9739cad8b00000000000000a77336e0ac73000000000000000001000000b42f135facf039000dc7ac730000a773facdac738fc8ac7318df2a5f0000a773c0f03900010000000000bc72feffffffe0f0390000aa9f73000000000000000000d78a0090f03900 (UID: 00000000-00006568)29:T610,GetUserDefaultLCID@KERNEL32.dll at 53596-1016-00427C0C EnumSystemLocalesW@KERNEL32.dll at 53596-1022-00427076 GetLocaleInfoW@KERNEL32.dll at 53596-1029-00427ADC GetUserDefaultLCID@KERNEL32.dll at 53596-1046-0042BCAF EnumSystemLocalesW@KERNEL32.dll at 53596-1047-0042B5D1 EnumSystemLocalesW@KERNEL32.dll at 53596-1048-0042B6D5 GetLocaleInfoW@KERNEL32.dll at 53596-1050-0042BADB EnumSystemLocalesW@KERNEL32.dll at 53596-1051-0042B63A EnumSystemLocalesW@KERNEL32.dll at 53596-1957-004271F6 GetLocaleInfoW@KERNEL32.dll at 53596-2048-0042B52A GetUserDefaultLCID@KERNEL32.dll at 53596-2051-0042B61E GetLocaleInfoW@KERNEL32.dll at 53596-2052-0042B764 GetLocaleInfoW@KERNEL32.dll at 53596-2053-0042BBE2 GetLocaleInfoW@KERNEL32.dll at 53596-2054-0042B9B4 GetUserDefaultLCID@KERNEL32.DLL at 00000000-00006568-54724-822-00C87C0C EnumSystemLocalesW@KERNEL32.DLL at 00000000-00006568-54724-828-00C87076 GetLocaleInfoW@KERNEL32.DLL at 00000000-00006568-54724-835-00C87ADC GetUserDefaultLCID@KERNEL32.DLL at 00000000-00006568-54724-852-00C8BCAF EnumSystemLocalesW@KERNEL32.DLL at 00000000-00006568-54724-853-00C8B5D1 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00006568-54724-854-00C8B6D5 GetLocaleInfoW@KERNEL32.DLL at 00000000-00006568-54724-856-00C8BADB EnumSystemLocalesW@KERNEL32.DLL at 00000000-00006568-54724-857-00C8B63A EnumSystemLocalesW@KERNEL32.DLL at 00000000-00006568-54724-1763-00C871F6 GetLocaleInfoW@KERNEL32.DLL at 00000000-00006568-54724-1854-00C8B52A GetUserDefaultLCID@KERNEL32.DLL at 00000000-00006568-54724-1857-00C8B61E2a:T5d6,"suspicious.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER"; Key: "") "suspicious.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\CERTIFICATES"; Key: "") "suspicious.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\CRLS"; Key: "") "suspicious.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\CTLS"; Key: "") "suspicious.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\CERTIFICATES\3BA63A6E4841355772DEBEF9CDCF4D5AF353A297"; Key: "BLOB") "suspicious.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\CERTIFICATES\3C0D087ECDCC76D1084ABE00F1FEE5040400AE37"; Key: "BLOB") "suspicious.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\CERTIFICATES\4CE89794FE2D2F7E30121F10BCF76AC3CCF77CA9"; Key: "BLOB") "suspicious.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\CERTIFICATES\5BDEFE580A816661CDB57A57107BF4187486EFCC"; Key: "BLOB") "suspicious.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\CERTIFICATES\60EE3FC53D4BDFD1697AE5BEAE1CAB1C0F3AD4E3"; Key: "BLOB") "suspicious.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\CERTIFICATES\6F474206BCBB391BB82BA9E5DC0302DEF37AEBBE"; Key: "BLOB") "suspicious.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\CERTIFICATES\E1D782A8E191BEEF6BCA1691B5AAB494A6249BF3"; Key: "BLOB")2b:T577,"suspicious.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006568) "suspicious.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006568) "suspicious.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006568) "suspicious.exe" called "LoadLibrary" with a parameter dfshim (UID: 00000000-00006568) "suspicious.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006568) "suspicious.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00006568) "suspicious.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006568) "suspicious.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006568) "suspicious.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006568) "suspicious.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\dfdll.dll (UID: 00000000-00006568) "suspicious.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006568) "suspicious.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006568) "suspicious.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-1 (UID: 00000000-00006568)2c:T1419,"suspicious.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter ShOpenVerbApplicationW (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter GetRequestedRuntimeInfo_RetAddr (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter GetRequestedRuntimeInfo (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter ActivateDeploymentW (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter AllowSetForegroundWindow (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00006568) "suspicious.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00006568)2d:T677,"suspicious.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72d40000 "suspicious.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74460000 "suspicious.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74460000 "suspicious.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74460000 "suspicious.exe" loaded module "KERNEL32.DLL" at base 74e90000 "suspicious.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 74640000 "suspicious.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 74100000 "suspicious.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 74e90000 "suspicious.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72cf0000 "suspicious.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 77200000 "suspicious.exe" loaded module "DFSHIM" at base 72bc0000 "suspicious.exe" loaded module "ADVAPI32.DLL" at base 77260000 "suspicious.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72ad0000 "suspicious.exe" loaded module "SHLWAPI.DLL" at base 75890000 "suspicious.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 74350000 "suspicious.exe" loaded module "VERSION.DLL" at base 73e00000 "suspicious.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DFDLL.DLL" at base 72aa0000 "suspicious.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73c30000 "suspicious.exe" loaded module "USER32.DLL" at base 74970000 "suspicious.exe" loaded module "RPCRT4.DLL" at base 74360000 "suspicious.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-1" at base 743500002e:T581,"suspicious.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "suspicious.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "suspicious.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "suspicious.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "suspicious.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "suspicious.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "suspicious.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "suspicious.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "suspicious.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "suspicious.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "suspicious.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\DISABLE8AND16BITMITIGATION"; Key: ""; Value: "")2f:Ta2f,"suspicious.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "suspicious.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "suspicious.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "SUSPICIOUS.EXE"; Value: "") "suspicious.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "suspicious.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "suspicious.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "suspicious.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "suspicious.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "suspicious.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "suspicious.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "suspicious.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "suspicious.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "suspicious.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "suspicious.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "suspicious.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "suspicious.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "suspicious.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "suspicious.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "suspicious.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "")30:T733,"suspicious.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "suspicious.exe" trying to access non-existent file "C:\FLTLIB.DLL" "suspicious.exe" trying to access non-existent file "C:\MSVCP140.DLL" "suspicious.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "suspicious.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "suspicious.exe" trying to access non-existent file "C:\BCRYPT.DLL" "suspicious.exe" trying to access non-existent file "C:\bcrypt.dll" "suspicious.exe" trying to access non-existent file "C:\DFSHIM.DLL" "suspicious.exe" trying to access non-existent file "C:\dfshim.DLL" "suspicious.exe" trying to access non-existent file "C:\VERSION.DLL" "suspicious.exe" trying to access non-existent file "C:\VERSION.dll" "suspicious.exe" trying to access non-existent file "C:\MSCOREE.DLL" "suspicious.exe" trying to access non-existent file "C:\mscoree.dll" "suspicious.exe" trying to access non-existent file "C:\URLMON.DLL" "suspicious.exe" trying to access non-existent file "C:\urlmon.dll" "suspicious.exe" trying to access non-existent file "C:\IERTUTIL.DLL" "suspicious.exe" trying to access non-existent file "C:\iertutil.dll" "suspicious.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "suspicious.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "suspicious.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "suspicious.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "suspicious.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" "suspicious.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL"31:T920,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006568.00000000.233636.00800000.00000004.mdmp") Found URL "http://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://mcert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0uz" - Source: "00000000-00006568.00000000.233636.008A6000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00006568.00000000.233636.008A6000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0uz" - Source: "00000000-00006568.00000000.233636.008A6000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0mm*v;z" - Source: "00000000-00006568.00000000.233636.008A6000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00006568.00000000.233636.008A6000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00006568.00000000.233636.008A6000.00000004.mdmp") Found URL "http://cacerts.digicert.com/digicerttrustedrootg<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00006568.00000000.233636.008A6000.00000004.mdmp") Found URL "http://crl3.digicert.com/digices'eu)dg4codesigningrsa4096sha3842021ca1.crl0smhttp://crls?eg*rt.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.s7e>+705030)0'http://www.digicert.com/qphttp://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigniap6sha3842021ca1.crt0uz" - Source: "00000000-00006568.00000000.233636.008A6000.00000004.mdmp")32:T553,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006568.00000000.233636.00800000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006568.00000000.233636.00800000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00006568.00000000.233636.00800000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006568.00000000.233636.00800000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006568.00000000.233636.00800000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006568.00000000.233636.00800000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00006568.00000000.233636.00800000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006568.00000000.233636.00800000.00000004.mdmp")33:T99c,"suspicious.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00006568) "suspicious.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00006568) "suspicious.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006568) "suspicious.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00006568) "suspicious.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00006568) "suspicious.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00006568) "suspicious.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00006568) "suspicious.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00006568) "suspicious.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00006568) "suspicious.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00006568) "suspicious.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00006568) "suspicious.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00006568) "suspicious.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00006568) "suspicious.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00006568) "suspicious.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00006568) "suspicious.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00006568) "suspicious.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00006568) "suspicious.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00006568) "suspicious.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00006568) "suspicious.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00006568) "suspicious.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00006568) "suspicious.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00006568) "suspicious.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00006568) "suspicious.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00006568)34:T1ede,"suspicious.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "suspicious.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\CERTIFICATES\7B0F360B775F76C94A12CA48445AA2D2A875701C"; Key: "BLOB"; Value: "0300000001000000140000007B0F360B775F76C94A12CA48445AA2D2A875701C2000000001000000B4060000308206B030820498A003020102021008AD40B260D29C4C9F5ECDA9BD93AED9300D06092A864886F70D01010C05003062310B300906035504061302555331153013060355040A130C446967694365727420496E6331193017060355040B13107777772E64696769636572742E636F6D3121301F060355040313184469676943657274205472757374656420526F6F74204734301E170D3231303432393030303030305A170D3336303432383233353935395A3069310B300906035504061302555331173015060355040A130E44696769436572742C20496E632E3141303F060355040313384469676943657274205472757374656420473420436F6465205369676E696E6720525341343039362053484133383420323032312043413130820222300D06092A864886F70D01010105000382020F003082020A0282020100D5B42F42D028AD78B75DD539591BB18842F5338CEB3D819770C5BBC48526309FA48E68D85CF5EB342407E14B4FD37843F417D71EDAF9D2D5671A524F0EA157FC8899C191CC81033E4D702464B38DE2087D347D4C8057126B439A99F2C53B1FF2EFCB475A13A64CB3012025F310D38BB2FB08F08AE09D09C065A7FA98804935873D5119E8902178452EA19F2CE118C21ACCC5EE93497042328FFBC6EA1CF3656891A24D4C8211485268DE10BD14575DE8181365C57FB24F852C48A4568435D6F92E9CAA0015D137FE1A0694C27CC8EA1B32E6CAC2F4A7A3030E74A5AF39B6AB6012E3E8D6B9F731E1DCADE418A0D8C1234747B3A10F6EA3AB6D9806831BB76A672DD2BD441A9210818FB03B09D7C79B325AC2FF6A60548B49C193EDE1B45CE06FEB26F98CD5B2F93810E6EACE91F5BED3FB6F9361345CBC93452883362A66285FB073CE8B262506B283D45CF615194CED62E05E33F2E8E8EC0AA7B0032B91B23679BEF7AD081E75A665CCBBE34850F377911AFEDB50A246C8615898F57C02163C8328AD3986ECD4B70D53D0F847E675308DEC30937614A65B4B5D74614D3F129176DEBF58CB72102941F0D5C56D267668114113589ADC262B01F4894D59DB78CF814A3E40475FC98150738510232159608A6454C1CC211AE838197C661CCD78384530994FFF634F4CBBAA0D0853417C583D47B3FAB6EC8C320902CC6C3C0C56110203010001A38201593082015530120603551D130101FF040830060101FF020100301D0603551D0E041604146837E0EBB63BF85F1186FBFE617B088865F44E42301F0603551D23041830168014ECD7E382D2715D644CDF2E673FE7BA98AE1C0F4F300E0603551D0F0101FF04040302018630130603551D25040C300A06082B06010505070303307706082B06010505070101046B3069302406082B060105050730018618687474703A2F2F6F6373702E64696769636572742E636F6D304106082B060105050730028635687474703A2F2F636163657274732E64696769636572742E636F6D2F446967694365727454727573746564526F6F7447342E63727430430603551D1F043C303A3038A036A0348632687474703A2F2F63726C332E64696769636572742E636F6D2F446967694365727454727573746564526F6F7447342E63726C301C0603551D20041530133007060567810C01033008060667810C010401300D06092A864886F70D01010C050003820201003A23443D8D0876EE8FBC3A99D356E0021AA5F84834F32CB6E67466F79472B100CAAF6C302713129E90449F4BFD9EA37C26D537BC3A5D486D95D53F49F427BB16814550FD9CBDB685E0767E3771CB22F75AAA90CFF5936AE3EB20D1D55079889A8A8AC1B6BDA148187EDCD8801A111918CD61998156F6C9E376E7C4E41B5F43F83E94FF76393D9ED499CF4ADD28EB5F26A1955848D51AFED7273FFD90D17686DD1CB0605CF30DA8EEE089A1BD39E1384EDA6EBB369DFBE521535AC3CAE96AF1A23EDB43B833C84F38149299F5DDCE546DD95D02141F40337C03E295B2C221757352CB46D8C4341CA2A54B8DCD6F76372C853F1ACE26E918BE9007B0437F9588208270F0CCCAEFFD29355C1F893855F7378A8B09A1CB0BE9311AFF2E195C3971E1BE9CA70A06D62667B792E64E5FDE7AAC49CF2EA47492ADDB3CA49C861FE3C1561B2B23FF8FB5EA887B706BE6A0BAFD3A3F45A6C4E81691528B41C048844B964DAB4440E38DF01528CEEDF11856072A2F10C40C08643C338FAE288C3CCB8F880B0DBF3BF4CE1E7B8EEFB5EBCBB7F07713E6E7283FAC12AEA52F226C41F9825C1566CC6C0ECAC586C3F626330C074BA0D307026A6A4030484B34A85120BBAD1B8508E2590D6DCA05502BEA4A1C9EA5FDA0A71F0674E7F2D65290FDAF854821F9573BB49C03ED8645F4B4616EBF68E2266086EAC8AFA9FE941DE7631B3A8656784E00") "suspicious.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\CERTIFICATES\4C2272FBA7A7380F55E2A424E9E624AEE1C14579"; Key: "BLOB"; Value: "0300000001000000140000004C2272FBA7A7380F55E2A424E9E624AEE1C145792000000001000000640700003082076030820548A00302010202100B9360051BCCF66642998998D5BA97CE300D06092A864886F70D01010B05003069310B300906035504061302555331173015060355040A130E44696769436572742C20496E632E3141303F060355040313384469676943657274205472757374656420473420436F6465205369676E696E67205253413430393620534841333834203230323120434131301E170D3232303831373030303030305A170D3235303831353233353935395A3065310B30090603550406130255533110300E06035504081307466C6F72696461310E300C0603550407130554616D706131193017060355040A1310436F6E6E656374776973652C204C4C433119301706035504031310436F6E6E656374776973652C204C4C4330820222300D06092A864886F70D01010105000382020F003082020A0282020100EC489826D08D2C6DE21B3CD3676DB1E0E50CB1FF75FF564E9741F9574AA3640AA8297294A05B4DB68ABD0760B6B05B50CE92FF42A4E390BE776A43E9961C722F6B3A4D5C880BCC6A61B4026F9137D36B2B7E9B86055876B9FA860DBCB164FE7F4B5B9DE4799AE4E02DC1F0BEE01E5D032933A2827388F8DB0B482E76C441B1BD50909EF2023E1FB62196C994CE052266B28CD89253E6416044133139764DB5FC45702529536BF82C775F9EC81FA27DC409530325F40CDEF95B81B9CE0D42791CEE72E7BD1B36C257B52257C65A28970E457513989434BFC239E2992B193E1B3CC3F11CCDD1D26D4EC9845099AB913906A42069AF999C0071169B45A2EA1AA666F1904E8ACB05E1823A359A291FD46B4EF7AED5935BB6AB17EBF077210726930C90F01761D6544A94E8FA614CC41D817EEC734B1C3D3AFB7C58FB256F0C09EDC1459BDDBFF9940ED1958570265D67AF79A9B6A16AFFD70FC6328C9810D5DC186E39AF6FBCAD49A270F237E6BCD5DE0BC014BC3179CD79776591340311A42CA94F33416C2E01B59BD1D71DE86ACE6716BC90B2D7695D155039AA08FBAC19A4D93FB784230A20A485287A16355645FC09142C602D140FA046B7BFD75328184FF7BDF8F9E0D65E6201C8D242931047F59BD328AC353777CCEFA60408887B84FC3631301463461A1D73C0B5CC74D6D82905DDF923BDBAB027A311CC38D3FA16F639A50203010001A382020630820202301F0603551D230418301680146837E0EBB63BF85F1186FBFE617B088865F44E42301D0603551D0E04160414338CE10A6E06D9C6ED0BC6CAE736CEFB8188646A300E0603551D0F0101FF04040302078030130603551D25040C300A06082B060105050703033081B50603551D1F0481AD3081AA3053A051A04F864D687474703A2F2F63726C332E64696769636572742E636F6D2F4469676943657274547275737465644734436F64655369676E696E6752534134303936534841333834323032314341312E63726C3053A051A04F864D687474703A2F2F63726C342E64696769636572742E636F6D2F4469676943657274547275737465644734436F64655369676E696E6752534134303936534841333834323032314341312E63726C303E0603551D20043730353033060667810C0104013029302706082B06010505070201161B687474703A2F2F7777772E64696769636572742E636F6D2F43505330819406082B06010505070101048187308184302406082B060105050730018618687474703A2F2F6F6373702E64696769636572742E636F6D305C06082B060105050730028650687474703A2F2F636163657274732E64696769636572742E636F6D2F4469676943657274547275737465644734436F64655369676E696E6752534134303936534841333834323032314341312E637274300C0603551D130101FF04023000300D06092A864886F70D01010B050003820201000AD79F00CF4984864C8981ECCE8718AA875647F6A74608C968E16568C7AA9D711ED7341676038067F01330C91621B27A2A8894C4108C268162A31F13F9757A7D6BB3C6F19BF27C3A29896D712D85873627D827CD6471761444FABF1D31E903F791143C5B4CE5E7444AACBA36D759AEBA3069D195226755CBC675AA747F77596C53C96E083C45BBA24479D6845EEA9F2B28BA29B4DCF0BCF14AA4CE176C24E2C1B8FEC3EE16E1C086DB6FDA97388859E83BE65C03F701395B78B842C6DD1533EF642CCA6FE50F6337D3F2DFEDD8B28F2B28E0C98EDD2151392E7CC75489F48859F1DE14C81B306EB50EED7BB78BE30EAADA76767C4CA523A11EEC5A2372D6122926AB1801A6A6778E9504791487EE47D4577154988802070F80FC535957658F954CD083546C5AFB5A6567B6761275F5DB20F70AB86FEEF94C7CFC65369D325121B69A82399BC7DC1962416F0F05CF1EEE64D495A3527E464E2C68DA0187093F97B673E43DDDBCC067E00713F1565FCFF8C3772D44B40A04E600644F22A990345F9A6B5B52963E82C81A0CE91D43A230F67B37D8DEBDA40EA3D59D305E18ADC1976516C12A8BA2BCA24143B12E9527B4DCA58872AA9B3A8C6AC563FC2DC02BF51BE889516D35A4BA9D062417B5BDCC50BA945FAE26B60D6AEC03984798A6A21D3FF793CC0849E81ED55B8027411C50DB776AE8FEEF2FDC2DAFB04345261DEDC05400")35:T996,Found string "FlsAlloc" (Source: suspicious.exe, API is part of module: KERNELBASE.DLL) Found string "FlsFree" (Source: suspicious.exe, API is part of module: KERNELBASE.DLL) Found string "FlsGetValue" (Source: suspicious.exe, API is part of module: KERNELBASE.DLL) Found string "FlsSetValue" (Source: suspicious.exe, API is part of module: KERNELBASE.DLL) Found string "InitializeCriticalSectionEx" (Source: suspicious.exe, API is part of module: KERNELBASE.DLL) Found string "CorExitProcess" (Source: suspicious.exe, API is part of module: MSCOREEI.DLL) Found string "AreFileApisANSI" (Source: suspicious.exe, API is part of module: KERNELBASE.DLL) Found string "CompareStringEx" (Source: suspicious.exe, API is part of module: KERNELBASE.DLL) Found string "EnumSystemLocalesEx" (Source: suspicious.exe, API is part of module: KERNELBASE.DLL) Found string "GetActiveWindow" (Source: suspicious.exe, API is part of module: USER32.DLL) Found string "GetCurrentPackageId" (Source: suspicious.exe, API is part of module: KERNEL.APPCORE.DLL) Found string "GetDateFormatEx" (Source: suspicious.exe, API is part of module: KERNELBASE.DLL) Found string "GetEnabledXStateFeatures" (Source: suspicious.exe, API is part of module: KERNELBASE.DLL) Found string "GetFileInformationByHandleEx" (Source: suspicious.exe, API is part of module: KERNELBASE.DLL) Found string "GetLastActivePopup" (Source: suspicious.exe, API is part of module: USER32.DLL) Found string "GetLocaleInfoEx" (Source: suspicious.exe, API is part of module: KERNELBASE.DLL) Found string "GetProcessWindowStation" (Source: suspicious.exe, API is part of module: USER32.DLL) Found string "GetSystemTimePreciseAsFileTime" (Source: suspicious.exe, API is part of module: KERNELBASE.DLL) Found string "GetTimeFormatEx" (Source: suspicious.exe, API is part of module: KERNELBASE.DLL) Found string "GetUserDefaultLocaleName" (Source: suspicious.exe, API is part of module: KERNELBASE.DLL) Found string "GetUserObjectInformationW" (Source: suspicious.exe, API is part of module: USER32.DLL) Found string "GetXStateFeaturesMask" (Source: suspicious.exe, API is part of module: KERNELBASE.DLL) Found string "IsValidLocaleName" (Source: suspicious.exe, API is part of module: KERNELBASE.DLL) Found string "LCMapStringEx" (Source: suspicious.exe, API is part of module: KERNELBASE.DLL) Found string "LCIDToLocaleName" (Source: suspicious.exe, API is part of module: KERNELBASE.DLL)1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"072fb279608d062dd75764fedc60c55f672a9eb381fa243b53164c9be0a841c8","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790884359048,"unified_at":"2026-10-01T19:52:39.048Z","metadata":{"hashes":{"sha256":"072fb279608d062dd75764fedc60c55f672a9eb381fa243b53164c9be0a841c8","sha1":"ddb04687c03c542b8f21f68be0fe0161c004a243","md5":"691f35bf0e51a5c1445a284029c28e29","sha512":"bd3aa483ba5cdef090f7bb4bdb0a95bfb2bb1ca8f1ff4b7bb3cc1365a6e0ffa25c3916945287881a199da18fe3638d2bac4e37dc7fa95ceb673a83dbbe6680ff","ssdeep":"6144:NmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9z:o1iw7gryNkSV1hy1Z1u2JLu9","ssdeep_chunks":["6144:NmlfAgi","6144:mlfAgiw","6144:lfAgiw7","6144:fAgiw7O","6144:Agiw7Op","6144:giw7Op5","6144:iw7Op5r","6144:w7Op5ry","6144:7Op5ryN","6144:Op5ryNk","6144:p5ryNkS","6144:5ryNkS7","6144:ryNkS7Z","6144:yNkS7Z1","6144:NkS7Z12","6144:kS7Z12w","6144:S7Z12wv","6144:7Z12wvt","6144:Z12wvtG","6144:12wvtGV","6144:2wvtGVG","6144:wvtGVG3","6144:vtGVG3i","6144:tGVG3iV","6144:GVG3iVt","6144:VG3iVt8","6144:G3iVt8e","6144:3iVt8eZ","6144:iVt8eZ1","6144:Vt8eZ1u","6144:t8eZ1u2","6144:8eZ1u2J","6144:eZ1u2J/","6144:Z1u2J/x","6144:1u2J/xF","6144:u2J/xFj","6144:2J/xFji","6144:J/xFji9","6144:/xFji9z","12288:NmlfAgi","12288:mlfAgiw","12288:lfAgiw7","12288:fAgiw7O","12288:Agiw7Op","12288:giw7Op5","12288:iw7Op5r","12288:w7Op5ry","12288:7Op5ryN","12288:Op5ryNk","12288:p5ryNkS","12288:5ryNkS7","12288:ryNkS7Z","12288:yNkS7Z1","12288:NkS7Z12","12288:kS7Z12w","12288:S7Z12wv","12288:7Z12wvt","12288:Z12wvtG","12288:12wvtGV","12288:2wvtGVG","12288:wvtGVG3","12288:vtGVG3i","12288:tGVG3iV","12288:GVG3iVt","12288:VG3iVt8","12288:G3iVt8e","12288:3iVt8eZ","12288:iVt8eZ1","12288:Vt8eZ1u","12288:t8eZ1u2","12288:8eZ1u2J","12288:eZ1u2J/","12288:Z1u2J/x","12288:1u2J/xF","12288:u2J/xFj","12288:2J/xFji","12288:J/xFji9","12288:/xFji9z","6144:o1iw7gr","6144:1iw7gry","6144:iw7gryN","6144:w7gryNk","6144:7gryNkS","6144:gryNkSV","6144:ryNkSV1","6144:yNkSV1h","6144:NkSV1hy","6144:kSV1hy1","6144:SV1hy1Z","6144:V1hy1Z1","6144:1hy1Z1u","6144:hy1Z1u2","6144:y1Z1u2J","6144:1Z1u2JL","6144:Z1u2JLu","6144:1u2JLu9"],"imphash":"c2fe6927e1db8cf00400dbef9e5d35be","pehash":"38d5642073565301f28a43c0e5980ba775f5e400"},"file_info":{"file_name":"suspicious.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":312584,"entropy":6.64,"compile_timestamp":"2025-04-08T18:34:09","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1785217249000,"last_seen":1788122870000,"last_multi_scan":1788122870000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":5,"import_count":0,"export_count":0,"embedded_file_count":1,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":250390,"raw_size":250880},{"name":".rdata","virtual_address":"0x3f000","virtual_size":36784,"raw_size":36864},{"name":".data","virtual_address":"0x48000","virtual_size":7048,"raw_size":2560},{"name":".rsrc","virtual_address":"0x4a000","virtual_size":480,"raw_size":512},{"name":".reloc","virtual_address":"0x4b000","virtual_size":8884,"raw_size":9216}],"section_names":[".text",".rdata",".data",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["malgent","nemucod","ransomware"]},"stats":{"av":{"malicious_count":9,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":46},"sandbox_signatures":{"informative_count":111,"suspicious_count":11,"malicious_count":1,"total":123},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"RiskWare[RemoteAdmin]/Win32.ConnectWise","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"APPL/AgentW32.ToolX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Application.Scam.SConnect.D86B738C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HackTool/ConnectWiseControl.j","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"RemoteTool ( 005ce31e1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.DLA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"ApplicUnsaf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Tool.ConnectWise.Win32.134","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Application.Scam.SConnect.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"suspicious","value":"Able to check if a debugger is running"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Discovery","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"suspicious","value":"Contains ability to query CPU information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Defense Evasion","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"suspicious","value":"YARA signature match - RMM tools"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Privilege Escalation","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"},{"type":"malicious","value":"The input sample is signed with an invalid certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"},{"type":"informative","value":"Able to read the PEB (Process Environment Block) structure"}],"sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]}],"sandbox_signatures":[{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - RMM tools","description":"YARA signature to detect screenconnect RMM tool file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1219","id":"yara-557","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$25","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://portal.onepansol.site\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$26","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\builds\\cc\\cwcontrol\\Product\\ClickOnceRunner\\Release\\ClickOnceRunner.pdb\"","origin":"sample.bin","id":"string-7","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\"), Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1029","id":"string-365","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-247","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"sample.bin\"), Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"sample.bin\"), Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; Source: \"sample.bin\"), Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; Source: \"sample.bin\"), Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"sample.bin\"), Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614","id":"string-201","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"sample.bin\"), Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"sample.bin\"), Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"sample.bin\"), Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-901","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in \"sample.bin\", Found system information discovery API: \"GetUserObjectInformationW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\"), Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\"), Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObjectEx\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0\" (Indicator: \"SHA384\"; Source: \"sample.bin\"), Found reference to \"8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1\" (Indicator: \"SHA384\"; Source: \"sample.bin\"), Found reference to \"8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10\" (Indicator: \"SHA384\"; Source: \"sample.bin\"), Found reference to \"Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S\" (Indicator: \"SHA384\"; Source: \"sample.bin\"), Found reference to \"Mhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0>\" (Indicator: \"SHA384\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CertFindAttribute\" (Indicator: \"CertFindAttribute\"; Source: \"sample.bin\"), Found api reference \"CertDeleteCertificateFromStore\" (Indicator: \"CertDeleteCertificateFromStore\"; Source: \"sample.bin\"), Found api reference \"CertAddCertificateContextToStore\" (Indicator: \"CertAddCertificateContextToStore\"; Source: \"sample.bin\"), Found api reference \"CertOpenSystemStoreA\" (Indicator: \"CertOpenSystemStoreA\"; Source: \"sample.bin\"), Found api reference \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; Source: \"sample.bin\"), Found api reference \"CryptQueryObject\" (Indicator: \"CryptQueryObject\"; Source: \"sample.bin\"), Found api reference \"CertCreateCertificateContext\" (Indicator: \"CertCreateCertificateContext\"; Source: \"sample.bin\"), Found api reference \"CryptMsgGetParam\" (Indicator: \"CryptMsgGetParam\"; Source: \"sample.bin\"), Found api reference \"CertCloseStore\" (Indicator: \"CertCloseStore\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-602","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CertDeleteCertificateFromStore\" (Indicator: \"CertDeleteCertificateFromStore\"; Source: \"sample.bin\"), Found reference to API \"CertOpenSystemStoreA\" (Indicator: \"CertOpenSystemStore\"; Source: \"sample.bin\"), Found reference to API \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; Source: \"sample.bin\"), Found reference to API \"CertCloseStore\" (Indicator: \"CertCloseStore\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-438","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\"), Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"sample.bin\"), Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-121","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExA\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"sample.bin\"), Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileInformationByHandleEx\" (Indicator: \"GetFileInformationByHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; Source: \"sample.bin\"), Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-148","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00006568.00000000.233636.00800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"suspicious.exe\" queried SystemProcessInformation at 00000000-00006568-00000C15-2645431026 [PID: 6568]\n \"suspicious.exe\" queried SystemProcessInformation at 00000000-00006568-00000C15-2645437958 [PID: 6568]\n \"suspicious.exe\" queried SystemProcessInformation at 00000000-00006568-00000C15-2645495791 [PID: 6568]\n \"suspicious.exe\" queried SystemProcessInformation at 00000000-00006568-00000C15-2645503143 [PID: 6568]\n \"suspicious.exe\" queried SystemProcessInformation at 00000000-00006568-00000C15-2645829538 [PID: 6568]\n \"suspicious.exe\" queried SystemProcessInformation at 00000000-00006568-00000C15-2645838093 [PID: 6568]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 53596-3082-00401E8A\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00006568-54724-9-00C6153C\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00006568-54724-81-00C841D5\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00006568-54724-435-00C61CFA\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00006568-54724-3267-00C61E8A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$27","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \"C:\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00006568.00000000.233636.00800000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00006568.00000000.233636.00800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00006568.00000000.233636.008A6000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"sample.bin\" at offset 299963; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 4114; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 40322; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 299944; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 300518; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 300634; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 303846; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 306635; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 306882; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00006568.00000000.233636.00800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"suspicious.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00006568)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"suspicious.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00006568)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"suspicious.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006568)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$28","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileExA@KERNEL32.dll at 53596-1876-004254C4\n FindFirstFileExW@KERNEL32.dll at 53596-1877-004254EF\n FindNextFileA@KERNEL32.dll at 53596-1878-0042551A\n FindNextFileW@KERNEL32.dll at 53596-1879-00425531\n FindFirstFileExA@KERNEL32.DLL at 00000000-00006568-54724-672-00C85188\n FindFirstFileExW@KERNEL32.DLL at 00000000-00006568-54724-699-00C8530C\n FindFirstFileExA@KERNEL32.DLL at 00000000-00006568-54724-1682-00C854C4\n FindFirstFileExW@KERNEL32.DLL at 00000000-00006568-54724-1683-00C854EF\n FindNextFileA@KERNEL32.DLL at 00000000-00006568-54724-1684-00C8551A\n FindNextFileW@KERNEL32.DLL at 00000000-00006568-54724-1685-00C85531","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 53596-1966-00427B48\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006568-54724-455-00C61BC9\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006568-54724-1772-00C87B48","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 53596-1966-00427B48\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006568-54724-455-00C61BC9\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00006568-54724-1772-00C87B48","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"$29","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"suspicious.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \",RtlGetVersion,NTDLL.dll,\"01:00:46.328\",RX=0,PX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00006568.00000000.233636.008A6000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"suspicious.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"suspicious.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"General","name":"Able to read the PEB (Process Environment Block) structure","description":"\"sample.bin\" can read 32 bit PEB structure (dword ptr fs:[00000030h]) (Offset: 54843)","origin":"Binary File","mitre_attack_id":"T1027.007","relevance":3,"id":"binary-30","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineA\" (Source: \"00000000-00006568.00000000.233636.00C9F000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00006568.00000000.233636.00C9F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"suspicious.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\dfsvc.exe\" - (UID: 00000000-00006568)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2c","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"WaitForSingleObjectEx@KERNEL32.dll at 53596-880-00424A84\n WaitForSingleObjectEx@KERNEL32.dll at 53596-1851-00424734\n Sleep@KERNEL32.DLL at 00000000-00006568-54724-411-00C61000\n WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00006568-54724-646-00C84A84\n WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00006568-54724-1657-00C84734","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: suspicious.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW@KERNEL32.dll at 53596-1960-004276E9\n LoadLibraryExW@KERNEL32.DLL at 00000000-00006568-54724-49-00C87638\n LoadLibraryA@KERNEL32.DLL at 00000000-00006568-54724-411-00C61000\n LoadLibraryExW@KERNEL32.DLL at 00000000-00006568-54724-564-00C6A676\n LoadLibraryExW@KERNEL32.DLL at 00000000-00006568-54724-1766-00C876E9","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"\\REGISTRY\\MACHINE\\Software\\Classes\\PackagedCom\" in Source: 00000000-00006568.00000000.233636.008A6000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process suspicious.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:6568:168:WilStaging_02\"\n Process suspicious.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6568:168:WilStaging_02\"\n Process suspicious.exe created mutex with name \"Local\\SM0:6568:168:WilStaging_02\"\n Process suspicious.exe created mutex with name \"SM0:6568:168:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"suspicious.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"\\REGISTRY\\MACHINE\\Software\\Classes\\PackagedCom\" in Source: 00000000-00006568.00000000.233636.008A6000.00000004.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"suspicious.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77200000\n \"suspicious.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72F80000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"suspicious.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74360000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"suspicious.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"suspicious.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"suspicious.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"suspicious.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"suspicious.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"suspicious.exe\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"suspicious.exe\" file has an entrypoint instructions - \"call\t0x401c16,jmp\t0x40135f,push\tebp,mov\tebp, esp,push\t0,call\tdword ptr [0x43f048],push\tdword ptr [ebp + 8],call\tdword ptr [0x43f044],push\t0xc0000409,call\tdword ptr [0x43f04c],push\teax,call\tdword ptr [0x43f050],pop\tebp,ret\t,push\tebp,mov\tebp, esp,sub\tesp, 0x324,push\t0x17,call\tdword ptr [0x43f054],test\teax, eax,je\t0x40157e,push\t2,pop\tecx,int\t0x29,mov\tdword ptr [0x448a20], eax,mov\tdword ptr [0x448a1c], ecx,mov\tdword ptr [0x448a18], edx,mov\tdword ptr [0x448a14], ebx,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\dfsvc.exe\" [Source: 00000000-00006568-00000C47-3310845622]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"suspicious.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"suspicious.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"suspicious.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll\" [Source: 00000000-00006568-00000C2E-1435236084]\n Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\dfdll.dll\" [Source: 00000000-00006568-00000C2B-2646562193]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: 7B:0F:36:0B:77:5F:76:C9:4A:12:CA:48:44:5A:A2:D2:A8:75:70:1C; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O=\"DigiCert\n Inc.\", C=US\" (SHA1: 4C:22:72:FB:A7:A7:38:0F:55:E2:A4:24:E9:E6:24:AE:E1:C1:45:79; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"suspicious.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"suspicious.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"suspicious.exe\" queries basic process information of the \"C:\\suspicious.exe\" (UID: 6568)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"suspicious.exe\" reads file \"c:\\windows\\microsoft.net\\framework\\v4.0.30319\\dfsvc.exe.config\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay the execution of current thread","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"suspicious.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"suspicious.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"suspicious.exe\" trying to touch file \"C:\\suspicious.exe\"\n \"suspicious.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"suspicious.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"suspicious.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"suspicious.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"suspicious.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ucrtbase.dll\"\n \"suspicious.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\msasn1.dll\"\n \"suspicious.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\crypt32.dll\"\n \"suspicious.exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$30","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"suspicious.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\MSCOREE.DLL.LOCAL\"\n \"suspicious.exe\" trying to access non-existent file \"C:\\WINDOWS\\SYSTEM32\\mscoree.dll.local\"\n \"suspicious.exe\" trying to access non-existent file \"C:\\.config\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.14\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.19\"\n \"2.5.29.15\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.32\"\n \"2.5.29.31\"\n \"2.5.29.17\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$31","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00006568.00000000.233636.008A6000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \",RtlGetVersion,NTDLL.dll,\"01:00:46.328\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006568.00000000.233636.008A6000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: suspicious.exe]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$33","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"suspicious.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"suspicious.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"ECDSA\" (Indicator: \"ecdsa\"; Source: \"00000000-00006568.00000000.233636.008A6000.00000004.mdmp\")\n Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00006568.00000000.233636.008A6000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\suspicious.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00006568.00000000.233636.00800000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00006568.00000000.233636.008A6000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"suspicious.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"suspicious.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CRYPT32\"; Key: \"DIAGLEVEL\"; Value: \"\")\n \"suspicious.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\CRYPT32\"; Key: \"DIAGMATCHANYMASK\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$34","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"suspicious.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"suspicious.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Able to check if a debugger is running","description":"IsDebuggerPresent@KERNEL32.dll at 53596-880-00424A84\n IsDebuggerPresent@KERNEL32.dll at 53596-1851-00424734\n OutputDebugStringA@KERNEL32.dll at 53596-1861-004249EA\n OutputDebugStringW@KERNEL32.dll at 53596-1862-004249FC\n IsDebuggerPresent@KERNEL32.DLL at 00000000-00006568-54724-81-00C841D5\n IsDebuggerPresent@KERNEL32.DLL at 00000000-00006568-54724-435-00C61CFA\n IsDebuggerPresent@KERNEL32.DLL at 00000000-00006568-54724-646-00C84A84\n IsDebuggerPresent@KERNEL32.DLL at 00000000-00006568-54724-1657-00C84734\n OutputDebugStringA@KERNEL32.DLL at 00000000-00006568-54724-1667-00C849EA\n OutputDebugStringW@KERNEL32.DLL at 00000000-00006568-54724-1668-00C849FC\n IsDebuggerPresent@KERNEL32.DLL at 00000000-00006568-54724-3292-00C9A6CA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":3,"id":"stream-75","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00000000-00006568-54724-433-00C621DA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleW@KERNEL32.dll at 53596-1873-00424C1B\n GetModuleHandleExW@KERNEL32.DLL at 00000000-00006568-54724-103-00C6E2D6\n GetModuleHandleW@KERNEL32.DLL at 00000000-00006568-54724-112-00C6E277\n GetModuleHandleW@KERNEL32.DLL at 00000000-00006568-54724-1679-00C84C1B\n GetModuleHandleW@KERNEL32.DLL at 00000000-00006568-54724-2193-00C61E48","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.dll at 53596-1986-004288F7\n GetStartupInfoW@KERNEL32.DLL at 00000000-00006568-54724-456-00C61E0F\n GetStartupInfoW@KERNEL32.DLL at 00000000-00006568-54724-1792-00C888F7","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"7/26 Antivirus vendors marked sample as malicious (26% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"YARA signature \"INDICATOR_RMM_ConnectWise_ScreenConnect_CERT\" matched file \"sample.bin\" as \"Detects ConnectWise Control (formerly ScreenConnect) by (default) certificate. Review RMM Inventory\"","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineA@KERNEL32.dll at 53596-3389-00426512\n GetCommandLineA@KERNEL32.DLL at 00000000-00006568-54724-3082-00C86512","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameW@KERNEL32.dll at 53596-879-0040CBED\n GetModuleFileNameW@KERNEL32.dll at 53596-903-0040CFA3\n GetModuleFileNameA@KERNEL32.dll at 53596-906-0040D0C2\n GetModuleFileNameW@KERNEL32.dll at 53596-907-0040D0DC\n GetModuleFileNameW@KERNEL32.dll at 53596-3083-00401228\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00006568-54724-411-00C61000\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00006568-54724-645-00C6CBED\n GetModuleFileNameA@KERNEL32.DLL at 00000000-00006568-54724-670-00C6CE7F\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00006568-54724-697-00C6CFA3\n GetModuleFileNameA@KERNEL32.DLL at 00000000-00006568-54724-706-00C6D0C2\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00006568-54724-707-00C6D0DC\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00006568-54724-2809-00C61228","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"suspicious.exe\" claimed CRC 326500 while the actual is CRC 355290","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"CertDeleteCertificateFromStore\n TerminateProcess\n OutputDebugStringW\n FindNextFileW\n IsDebuggerPresent\n Sleep\n GetModuleFileNameA\n FindFirstFileExA\n UnhandledExceptionFilter\n CreateFileW\n GetModuleHandleExW\n GetModuleHandleW\n LoadLibraryExW\n GetCommandLineW\n GetModuleFileNameW\n FindFirstFileExW\n GetCommandLineA\n OutputDebugStringA\n CreateThread\n GetProcAddress\n FindNextFileA\n WriteFile\n GetStartupInfoW\n LoadLibraryA","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"level":"malicious","category":"General","name":"The input sample is signed with an invalid certificate","description":"Error: A certificate was explicitly revoked by its issuer. (0x800b010c)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-1","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies system certificates settings"}],"sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]}],"intel_graph":{"map":{"Domain:4265ede294794173dbc317248375db514b13501eaff7de1737db50ebdf83176a":{"type":"Domain","value":"portal.onepansol.site","verdict":{"verdict":"malicious","verdict_source":"domain reputation data","reasons":["reported malicious domain"]}},"File:072fb279608d062dd75764fedc60c55f672a9eb381fa243b53164c9be0a841c8":{"type":"File","value":"072fb279608d062dd75764fedc60c55f672a9eb381fa243b53164c9be0a841c8","verdict":{"verdict":"malicious","verdict_source":"domain reputation data","reasons":["reported malicious domain"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:250852bb8aac7141da89eab099ca04dab1c36f6e16494d9a62ad9ec81cca93d7":{"type":"File","value":"250852bb8aac7141da89eab099ca04dab1c36f6e16494d9a62ad9ec81cca93d7","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"},"File:f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35":{"type":"File","value":"f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35","verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence"]}}},"chains":[{"id":"1543724007955902437","root":"File:072fb279608d062dd75764fedc60c55f672a9eb381fa243b53164c9be0a841c8","edges":[{"edge_kind":"contacted_domain","from_key":"File:072fb279608d062dd75764fedc60c55f672a9eb381fa243b53164c9be0a841c8","to_key":"Domain:4265ede294794173dbc317248375db514b13501eaff7de1737db50ebdf83176a"}],"verdict":{"verdict":"malicious","verdict_source":"domain reputation data","reasons":["reported malicious domain"]}},{"id":"1543723977410700061","root":"File:072fb279608d062dd75764fedc60c55f672a9eb381fa243b53164c9be0a841c8","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:072fb279608d062dd75764fedc60c55f672a9eb381fa243b53164c9be0a841c8","to_key":"File:250852bb8aac7141da89eab099ca04dab1c36f6e16494d9a62ad9ec81cca93d7"}],"verdict":{"verdict":"unknown"}},{"id":"1543723990187883021","root":"File:f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence"]}},{"id":"sandbox_network","root":"File:072fb279608d062dd75764fedc60c55f672a9eb381fa243b53164c9be0a841c8","edges":[{"edge_kind":"contacted_domain","from_key":"File:072fb279608d062dd75764fedc60c55f672a9eb381fa243b53164c9be0a841c8","to_key":"Domain:4265ede294794173dbc317248375db514b13501eaff7de1737db50ebdf83176a"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:072fb279608d062dd75764fedc60c55f672a9eb381fa243b53164c9be0a841c8","edges":[{"edge_kind":"extracted","from_key":"File:072fb279608d062dd75764fedc60c55f672a9eb381fa243b53164c9be0a841c8","to_key":"File:250852bb8aac7141da89eab099ca04dab1c36f6e16494d9a62ad9ec81cca93d7"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":53,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":6,"registry_keys_modified_count":0,"registry_keys_deleted_count":2,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":8,"embedded_ips_count":0,"embedded_domains_count":1,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["malgent","nemucod","ransomware"],"sandbox_reports":[{"id":"6a68455432371a13360d8efc","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":71,"malware_family":"RemoteTool","submit_name":"suspicious.exe","analysis_start_time":"2026-07-28T05:59:50+00:00","indicators_count":{"informative":109,"suspicious":16,"malicious":1},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":[{"domain":"portal.onepansol.site","sources":[{"report_type":"qsp","report_id":""}]}],"http_requests":null,"embedded_domains":[{"value":"portal.onepansol.site","sources":[{"report_type":"qsp","report_id":""}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}],"processes":[{"pid":6568,"ppid":0,"name":"suspicious.exe","command_line":"","sha256":"072fb279608d062dd75764fedc60c55f672a9eb381fa243b53164c9be0a841c8","normalized_path":"C:\\suspicious.exe","uid":"00000000-00006568","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["mscoreei.dll","crypt32.dll","ucrtbase.dll","sspicli.dll","msvcp_win.dll","vcruntime140.dll","imm32.dll","rsaenh.dll","powrprof.dll","wow64win.dll","KernelBase.dll","cryptbase.dll","gdi32full.dll","msvcp140.dll","cfgmgr32.dll","windows.storage.dll","urlmon.dll","kernel32.dll","ws2_32.dll","win32u.dll","imagehlp.dll","version.dll","user32.dll","wow64cpu.dll","apphelp.dll","fltLib.dll","rpcrt4.dll","dfshim.dll","SHCore.dll","kernel.appcore.dll","msasn1.dll","sechost.dll","gdi32.dll","oleaut32.dll","iertutil.dll","uxtheme.dll","VxSSL32.dll","advapi32.dll","wintrust.dll","bcrypt.dll","dfdll.dll","ntdll.dll","combase.dll","msvcrt.dll","profapi.dll","mscoree.dll","clbcatq.dll","wow64.dll","bcryptprimitives.dll","ole32.dll","shlwapi.dll","cryptsp.dll","shell32.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"250852bb8aac7141da89eab099ca04dab1c36f6e16494d9a62ad9ec81cca93d7","sha256":"250852bb8aac7141da89eab099ca04dab1c36f6e16494d9a62ad9ec81cca93d7","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\CERTIFICATES\\7B0F360B775F76C94A12CA48445AA2D2A875701C\\","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\CERTIFICATES\\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\\","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\CERTIFICATES\\7B0F360B775F76C94A12CA48445AA2D2A875701C\\7B0F360B775F76C94A12CA48445AA2D2A875701C","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPUBLISHER\\CERTIFICATES\\4C2272FBA7A7380F55E2A424E9E624AEE1C14579\\4C2272FBA7A7380F55E2A424E9E624AEE1C14579","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6568:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6568:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"name":"Local\\SM0:6568:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]},{"name":"SM0:6568:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a68455432371a13360d8efc"}]}]}},"report_ids":{"sandbox_job_ids":["6a68455432371a13360d8efc"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Application.Scam.SConnect.Generic Sample 072fb279608d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 072fb279608d…. Malware family: Application.Scam.SConnect.Generic. Threat score 100/100. 9/25 AV engines flagged this file. 1 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/072fb279608d062dd75764fedc60c55f672a9eb381fa243b53164c9be0a841c8"}],["$","meta","4",{"property":"og:title","content":"Malicious Application.Scam.SConnect.Generic Sample 072fb279608d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 072fb279608d…. Malware family: Application.Scam.SConnect.Generic. Threat score 100/100. 9/25 AV engines flagged this file. 1 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/072fb279608d062dd75764fedc60c55f672a9eb381fa243b53164c9be0a841c8"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Application.Scam.SConnect.Generic Sample 072fb279608d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 072fb279608d…. Malware family: Application.Scam.SConnect.Generic. Threat score 100/100. 9/25 AV engines flagged this file. 1 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L36","11",{}]]