34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 41:I[99539,["$1","$2","$3","$4","$5"],"IconMark"] 33:T490,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Tasker Sample 0740056cb7f9… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0740056cb7f9…. Malware family: Trojan.Tasker. Threat score 100/100. 15/28 AV engines flagged this file. 10 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0740056cb7f967e17b055e408cf9e9eb561fc543c4c5e74d912bca8ba45a7f75","keywords":["Malicious","Trojan.Tasker","malware analysis","sandbox report","threat intelligence","0740056cb7f967e17b055e408cf9e9eb561fc543c4c5e74d912bca8ba45a7f75"],"about":{"@type":"SoftwareApplication","name":"2018-10-24_09-20-01.exe","applicationCategory":["peexe","executable"],"identifier":"0740056cb7f967e17b055e408cf9e9eb561fc543c4c5e74d912bca8ba45a7f75","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Tasker","antivirusDetections":{"malicious":15,"total":28},"behavioralIndicators":{"malicious":10,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T7c1,"winlogon.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "winlogon.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "winlogon.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "winlogon.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "winlogon.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "winlogon.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "winlogon.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "winlogon.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "winlogon.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "winlogon.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "winlogon.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "winlogon.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "winlogon.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "winlogon.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "winlogon.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "winlogon.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "winlogon.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "winlogon.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "winlogon.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "winlogon.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")37:T723,"winlogon.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "winlogon.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "winlogon.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "winlogon.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "winlogon.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA"; Key: "BLOB") "winlogon.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135"; Key: "BLOB") "winlogon.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "winlogon.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "winlogon.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "winlogon.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "winlogon.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "winlogon.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "winlogon.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "winlogon.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "winlogon.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "winlogon.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "winlogon.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")38:T49e,"\Sessions\1\BaseNamedObjects\Local\ZonesCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZoneAttributeCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\!IETld!Mutex" "\Sessions\1\BaseNamedObjects\Local\_!MSFTHISTORY!_" "\Sessions\1\BaseNamedObjects\Local\c:!users!%OSUSER%!appdata!local!microsoft!windows!temporary internet files!content.ie5!" "\Sessions\1\BaseNamedObjects\Local\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!cookies!" "\Sessions\1\BaseNamedObjects\Local\c:!users!%OSUSER%!appdata!local!microsoft!windows!history!history.ie5!" "\Sessions\1\BaseNamedObjects\Local\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!ietldcache!" "\Sessions\1\BaseNamedObjects\Local\WininetStartupMutex" "\Sessions\1\BaseNamedObjects\Local\WininetConnectionMutex" "\Sessions\1\BaseNamedObjects\Local\WininetProxyRegistryMutex" "\Sessions\1\BaseNamedObjects\AMD Opteron(TM) Processor 6272 e47c61d2-1dae-480e-827a-ae8d797649df" "\Sessions\1\BaseNamedObjects\IESQMMUTEX_0_208" "\Sessions\1\BaseNamedObjects\RasPbFile"39:T646,".exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" ".exe" touched file "C:\Windows\System32\en-US\propsys.dll.mui" ".exe" touched file "C:\Windows\System32\en-US\setupapi.dll.mui" ".exe" touched file "C:\Windows\AppPatch\sysmain.sdb" ".exe" touched file "C:\Windows\AppPatch\pcamain.sdb" ".exe" touched file "C:\Windows\System32\oleaccrc.dll" ".exe" touched file "C:\Windows\System32" ".exe" touched file "C:\Windows\System32\schtasks.exe" ".exe" touched file "C:\Windows\System32\cmd.exe" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "winlogon.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "winlogon.exe" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui" "winlogon.exe" touched file "C:\Windows\System32\tzres.dll" "winlogon.exe" touched file "C:\Windows\System32\en-US\tzres.dll.mui"3a:T4e3,Heuristic match: "api.foxovsky.ru" Heuristic match: "hibud.ir" Heuristic match: "POST /gate/config.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoContent-Length: 0Host: hibud.ir" Heuristic match: "POST /gate/update.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoContent-Length: 58Host: hibud.ir" Heuristic match: "POST /v1/checkLicense.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoContent-Length: 38Host: api.foxovsky.ru" Heuristic match: "POST /v1/updateLicense.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoContent-Length: 38Host: api.foxovsky.ru" Heuristic match: "bitbucket.org" Heuristic match: "bbuseruploads.s3.amazonaws.com" Pattern match: "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX"3b:T590,"POST /gate/create.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoContent-Length: 433Host: hibud.ir" with no payload "POST /gate/config.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoContent-Length: 0Host: hibud.ir" with no payload "POST /gate/update.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoContent-Length: 58Host: hibud.ir" with no payload "POST /v1/checkLicense.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoContent-Length: 38Host: api.foxovsky.ru" with no payload "POST /v1/saveLicense.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoContent-Length: 451Host: api.foxovsky.ru" with no payload "POST /v1/updateLicense.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoContent-Length: 38Host: api.foxovsky.ru" with no payload3c:T8d9,"winlogon.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "winlogon.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "winlogon.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "winlogon.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "winlogon.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "winlogon.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "winlogon.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "winlogon.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "winlogon.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "winlogon.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "winlogon.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "winlogon.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "winlogon.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "winlogon.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "winlogon.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "winlogon.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "winlogon.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "winlogon.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "winlogon.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "winlogon.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")3d:T17b1,Found malicious artifacts related to "209.141.41.188": ... URL: http://209.141.41.188/default.exe (AV positives: 11/69 scanned on 10/11/2018 11:00:41) URL: http://209.141.41.188/default.exe. (AV positives: 7/68 scanned on 10/10/2018 06:17:14) URL: http://209.141.41.188/ (AV positives: 5/68 scanned on 10/03/2018 07:36:12) URL: http://209.141.41.188/soft.exe (AV positives: 4/67 scanned on 10/01/2018 19:47:29) File SHA256: 2e7ddeea92385b0acef13e1167926fbb9fb90e15ce2d30da6b397515587f3074 (AV positives: 48/68 scanned on 10/11/2018 11:00:45) File SHA256: 3828cb7ddd4795ad2a48f84ca0da2991f53adb15dbcc9590f3c11d9bcffd30de (AV positives: 19/70 scanned on 10/01/2018 18:08:09) Found malicious artifacts related to "31.41.40.18": ... URL: http://verasok.of.by/ (AV positives: 1/67 scanned on 10/22/2018 23:29:26) URL: http://api.foxovsky.ru/v1/updateLicense.php (AV positives: 1/67 scanned on 10/22/2018 17:27:21) URL: http://api.foxovsky.ru/v1/checkLicense.php (AV positives: 1/67 scanned on 10/22/2018 17:26:19) URL: http://api.foxovsky.ru/ (AV positives: 2/68 scanned on 10/22/2018 06:18:33) URL: http://xn----8sb4bbedil8b.xn--p1acf/ (AV positives: 4/67 scanned on 10/22/2018 02:11:16) File SHA256: 72ec27bd0d959a1e6713d96b4e55c5a9b92ac6d1b5b5a4a8d5d1211422fcee57 (AV positives: 1/55 scanned on 09/14/2018 06:13:05) File SHA256: 2a4912ca062b0f6d3700a009df2092bc42eb4864b6e366730f285121539cdef2 (Date: 07/29/2018 15:06:54) File SHA256: e7530275674ea40f3ca9a734d4df1cd0de88b73ab04f06d45aa2d1d5ef99be50 (AV positives: 11/66 scanned on 06/05/2018 03:34:22) File SHA256: c9a834dde38c8b559d575ac61046e3a3fada97d2953d902b74cf8d5e51ada30f (Date: 04/29/2018 14:44:14) File SHA256: bfd6acdfa9dc704b2f38c02a4ae6422b9ae47fb9dd64fa0650ff74953c5cb2af (Date: 04/29/2018 14:17:40) File SHA256: 5db52418636a9d33bacad91b1dc615316e7acfe6892a8d6fb417832cc3ca665d (AV positives: 25/65 scanned on 04/27/2018 23:15:12) File SHA256: 0da7f045f652ff4544f56f674d283040fd1a1269710a3d30d1f5a15dfc9b8f6e (AV positives: 44/67 scanned on 04/02/2018 11:52:49) File SHA256: 5bf38c18daae1dc6bffe53b5437562564cabb2767ad9a7059f2bf11f7096d831 (AV positives: 3/60 scanned on 01/26/2018 21:00:15) File SHA256: be337f2f964a43d40e8493e777763e823be7c41b56f730c3490c68528952375d (Date: 12/14/2017 16:41:26) File SHA256: f633197f2ed11edca6acfb45c78603213055d3b900503205f7da3c07988a0e21 (Date: 11/16/2017 06:55:07) Found malicious artifacts related to "18.205.93.2": ... URL: http://bitbucket.org/delich/kach/downloads/elemente.exe (AV positives: 3/67 scanned on 10/24/2018 00:34:35) URL: http://bitbucket.org/delich/kach/downloads/elementu.exe (AV positives: 3/67 scanned on 10/24/2018 00:33:56) URL: https://bitbucket.org/adbeflash/adbfl/downloads/adobe_F_lnstall_winx86_64.rar (AV positives: 1/67 scanned on 10/24/2018 00:30:24) URL: https://bitbucket.org/myntcurrency/mynt-core/downloads/sgminer-5.6.1-nicehash-51-windows-amd64-mynt.zip (AV positives: 2/67 scanned on 10/23/2018 23:13:48) URL: https://bitbucket.org/delich/kach/downloads/Elementu.exe (AV positives: 2/67 scanned on 10/23/2018 23:07:16) File SHA256: 83c2edfe8af7ea6a2886b3ade55d70bfad5f3ea2dec353526f99b2c685bed0f1 (AV positives: 30/59 scanned on 10/23/2018 23:13:51) File SHA256: ab1032d2390160bd6201e6509eb71655af4cac6d9f10f49b8ac64fff5bd9b28c (AV positives: 40/67 scanned on 10/23/2018 23:07:17) File SHA256: acbf179c44392c6dc6e9cc7c4831ed1a7ebe650d9941dc147d235db1ae7a8413 (AV positives: 33/67 scanned on 10/23/2018 21:12:05) File SHA256: 865f73dc4dbf1ef93cf5116f52e392ce637252e7ba9e62e9de7318bc7942d7af (AV positives: 19/68 scanned on 10/23/2018 15:55:40) File SHA256: 4ef06e229252f44dee40e0ca46173f3d34bcb357efcc9925a73488ab42a56225 (AV positives: 26/67 scanned on 10/23/2018 09:26:55) File SHA256: 0dbfae68050f1193be70ba4b6fe68f3446698158f0bfe4b72023c7edf96c7645 (Date: 10/17/2018 08:08:21) File SHA256: 5a47c44c5a8f0f0589d67c2a3f3cc159070ec047edc24819bb7a592e0add9313 (Date: 10/17/2018 07:52:26) File SHA256: e11f2bdf81f33e119c689835f1901620cdc3c64857d43eaecb98408b47d8800a (Date: 10/14/2018 06:30:52) File SHA256: c90797de676afe7d71331e8973a9ae5ba88d2841075f191cfdad705f2bb0ef01 (Date: 10/13/2018 22:57:42) File SHA256: 1b428cc720fe1f53b7cc1e84434b3ca87e2f03801beb029a24fbb245df24aa37 (Date: 10/13/2018 22:23:33) Found malicious artifacts related to "54.231.82.98": ... URL: http://f.cl.ly/items/1g3x3b0H3r3B3p0a3q3Y/TerranceSpells_Resume.doc (AV positives: 7/70 scanned on 10/03/2018 11:44:09) URL: http://hstair.s3.amazonaws.com/NE3/ (AV positives: 2/69 scanned on 09/24/2018 19:21:07) URL: http://dnld.installcore.com/cust/portalprogramas/AresSetup_RC2.exe (AV positives: 4/68 scanned on 09/11/2018 14:55:49) URL: http://images.arcadianhome.com/ (AV positives: 1/68 scanned on 09/11/2018 12:00:27) URL: http://template-try.crystalgraphics.com/ (AV positives: 3/69 scanned on 09/10/2018 11:06:07) File SHA256: ce5e10915a6fc6a315ed76df85b9e7f63a37acbb0c0301f67a4e4c08576c9017 (AV positives: 7/68 scanned on 10/23/2018 00:44:23) File SHA256: bbd59de433f5411b5a1dac7b5813a0263df346f9cf53fd5d0abd65341d8fd7cd (AV positives: 44/63 scanned on 10/03/2018 08:22:58) File SHA256: 997a2f249f6b7fe90fa9c6324dcee6a7e6dee71556918d1c2fc98ec8722d45f5 (AV positives: 18/71 scanned on 10/01/2018 20:25:48) File SHA256: 57618d5fab9f0f777430fde5beceffdfb99cc81cfbd353ca58f41b7faf84eddc (AV positives: 1/57 scanned on 09/30/2018 09:06:22) File SHA256: 648dc7e553bcf6ddb791aff0f5c10f768cee94b971f38461b16fe80824f23691 (AV positives: 1/60 scanned on 09/30/2018 08:15:16) File SHA256: b0576d0068d4c5d59c39736b6f05017b4b72dfc956441663d3fa4d55c9932420 (Date: 09/14/2018 04:52:02) File SHA256: 91f4a74f4290adea933e8a9be69f47696deb32b141e99c58a30eb3ea11fad7b9 (Date: 06/23/2017 07:57:01) File SHA256: 95970c61902dc3e1c19adef8c6c90d4880247d752248ca82fd970e744962ade9 (Date: 06/03/2016 13:41:48) File SHA256: 51761d2a901f3612765fff31508d4f80186c21575f490275f4c57c34cf32d25f (Date: 04/30/2016 15:55:43) File SHA256: 2cd6400b8ad3d0c4dadd8498a5e6f943d127173fcd324b3cb441f76db0e855d1 (Date: 04/24/2016 10:05:35)3e:T17b1,Found malicious artifacts related to "209.141.41.188": ... URL: http://209.141.41.188/default.exe (AV positives: 11/69 scanned on 10/11/2018 11:00:41) URL: http://209.141.41.188/default.exe. (AV positives: 7/68 scanned on 10/10/2018 06:17:14) URL: http://209.141.41.188/ (AV positives: 5/68 scanned on 10/03/2018 07:36:12) URL: http://209.141.41.188/soft.exe (AV positives: 4/67 scanned on 10/01/2018 19:47:29) File SHA256: 2e7ddeea92385b0acef13e1167926fbb9fb90e15ce2d30da6b397515587f3074 (AV positives: 48/68 scanned on 10/11/2018 11:00:45) File SHA256: 3828cb7ddd4795ad2a48f84ca0da2991f53adb15dbcc9590f3c11d9bcffd30de (AV positives: 19/70 scanned on 10/01/2018 18:08:09) Found malicious artifacts related to "31.41.40.18": ... URL: http://verasok.of.by/ (AV positives: 1/67 scanned on 10/22/2018 23:29:26) URL: http://api.foxovsky.ru/v1/updateLicense.php (AV positives: 1/67 scanned on 10/22/2018 17:27:21) URL: http://api.foxovsky.ru/v1/checkLicense.php (AV positives: 1/67 scanned on 10/22/2018 17:26:19) URL: http://api.foxovsky.ru/ (AV positives: 2/68 scanned on 10/22/2018 06:18:33) URL: http://xn----8sb4bbedil8b.xn--p1acf/ (AV positives: 4/67 scanned on 10/22/2018 02:11:16) File SHA256: 72ec27bd0d959a1e6713d96b4e55c5a9b92ac6d1b5b5a4a8d5d1211422fcee57 (AV positives: 1/55 scanned on 09/14/2018 06:13:05) File SHA256: 2a4912ca062b0f6d3700a009df2092bc42eb4864b6e366730f285121539cdef2 (Date: 07/29/2018 15:06:54) File SHA256: e7530275674ea40f3ca9a734d4df1cd0de88b73ab04f06d45aa2d1d5ef99be50 (AV positives: 11/66 scanned on 06/05/2018 03:34:22) File SHA256: c9a834dde38c8b559d575ac61046e3a3fada97d2953d902b74cf8d5e51ada30f (Date: 04/29/2018 14:44:14) File SHA256: bfd6acdfa9dc704b2f38c02a4ae6422b9ae47fb9dd64fa0650ff74953c5cb2af (Date: 04/29/2018 14:17:40) File SHA256: 5db52418636a9d33bacad91b1dc615316e7acfe6892a8d6fb417832cc3ca665d (AV positives: 25/65 scanned on 04/27/2018 23:15:12) File SHA256: 0da7f045f652ff4544f56f674d283040fd1a1269710a3d30d1f5a15dfc9b8f6e (AV positives: 44/67 scanned on 04/02/2018 11:52:49) File SHA256: 5bf38c18daae1dc6bffe53b5437562564cabb2767ad9a7059f2bf11f7096d831 (AV positives: 3/60 scanned on 01/26/2018 21:00:15) File SHA256: be337f2f964a43d40e8493e777763e823be7c41b56f730c3490c68528952375d (Date: 12/14/2017 16:41:26) File SHA256: f633197f2ed11edca6acfb45c78603213055d3b900503205f7da3c07988a0e21 (Date: 11/16/2017 06:55:07) Found malicious artifacts related to "18.205.93.2": ... URL: http://bitbucket.org/delich/kach/downloads/elemente.exe (AV positives: 3/67 scanned on 10/24/2018 00:34:35) URL: http://bitbucket.org/delich/kach/downloads/elementu.exe (AV positives: 3/67 scanned on 10/24/2018 00:33:56) URL: https://bitbucket.org/adbeflash/adbfl/downloads/adobe_F_lnstall_winx86_64.rar (AV positives: 1/67 scanned on 10/24/2018 00:30:24) URL: https://bitbucket.org/myntcurrency/mynt-core/downloads/sgminer-5.6.1-nicehash-51-windows-amd64-mynt.zip (AV positives: 2/67 scanned on 10/23/2018 23:13:48) URL: https://bitbucket.org/delich/kach/downloads/Elementu.exe (AV positives: 2/67 scanned on 10/23/2018 23:07:16) File SHA256: 83c2edfe8af7ea6a2886b3ade55d70bfad5f3ea2dec353526f99b2c685bed0f1 (AV positives: 30/59 scanned on 10/23/2018 23:13:51) File SHA256: ab1032d2390160bd6201e6509eb71655af4cac6d9f10f49b8ac64fff5bd9b28c (AV positives: 40/67 scanned on 10/23/2018 23:07:17) File SHA256: acbf179c44392c6dc6e9cc7c4831ed1a7ebe650d9941dc147d235db1ae7a8413 (AV positives: 33/67 scanned on 10/23/2018 21:12:05) File SHA256: 865f73dc4dbf1ef93cf5116f52e392ce637252e7ba9e62e9de7318bc7942d7af (AV positives: 19/68 scanned on 10/23/2018 15:55:40) File SHA256: 4ef06e229252f44dee40e0ca46173f3d34bcb357efcc9925a73488ab42a56225 (AV positives: 26/67 scanned on 10/23/2018 09:26:55) File SHA256: 0dbfae68050f1193be70ba4b6fe68f3446698158f0bfe4b72023c7edf96c7645 (Date: 10/17/2018 08:08:21) File SHA256: 5a47c44c5a8f0f0589d67c2a3f3cc159070ec047edc24819bb7a592e0add9313 (Date: 10/17/2018 07:52:26) File SHA256: e11f2bdf81f33e119c689835f1901620cdc3c64857d43eaecb98408b47d8800a (Date: 10/14/2018 06:30:52) File SHA256: c90797de676afe7d71331e8973a9ae5ba88d2841075f191cfdad705f2bb0ef01 (Date: 10/13/2018 22:57:42) File SHA256: 1b428cc720fe1f53b7cc1e84434b3ca87e2f03801beb029a24fbb245df24aa37 (Date: 10/13/2018 22:23:33) Found malicious artifacts related to "54.231.82.98": ... URL: http://f.cl.ly/items/1g3x3b0H3r3B3p0a3q3Y/TerranceSpells_Resume.doc (AV positives: 7/70 scanned on 10/03/2018 11:44:09) URL: http://hstair.s3.amazonaws.com/NE3/ (AV positives: 2/69 scanned on 09/24/2018 19:21:07) URL: http://dnld.installcore.com/cust/portalprogramas/AresSetup_RC2.exe (AV positives: 4/68 scanned on 09/11/2018 14:55:49) URL: http://images.arcadianhome.com/ (AV positives: 1/68 scanned on 09/11/2018 12:00:27) URL: http://template-try.crystalgraphics.com/ (AV positives: 3/69 scanned on 09/10/2018 11:06:07) File SHA256: ce5e10915a6fc6a315ed76df85b9e7f63a37acbb0c0301f67a4e4c08576c9017 (AV positives: 7/68 scanned on 10/23/2018 00:44:23) File SHA256: bbd59de433f5411b5a1dac7b5813a0263df346f9cf53fd5d0abd65341d8fd7cd (AV positives: 44/63 scanned on 10/03/2018 08:22:58) File SHA256: 997a2f249f6b7fe90fa9c6324dcee6a7e6dee71556918d1c2fc98ec8722d45f5 (AV positives: 18/71 scanned on 10/01/2018 20:25:48) File SHA256: 57618d5fab9f0f777430fde5beceffdfb99cc81cfbd353ca58f41b7faf84eddc (AV positives: 1/57 scanned on 09/30/2018 09:06:22) File SHA256: 648dc7e553bcf6ddb791aff0f5c10f768cee94b971f38461b16fe80824f23691 (AV positives: 1/60 scanned on 09/30/2018 08:15:16) File SHA256: b0576d0068d4c5d59c39736b6f05017b4b72dfc956441663d3fa4d55c9932420 (Date: 09/14/2018 04:52:02) File SHA256: 91f4a74f4290adea933e8a9be69f47696deb32b141e99c58a30eb3ea11fad7b9 (Date: 06/23/2017 07:57:01) File SHA256: 95970c61902dc3e1c19adef8c6c90d4880247d752248ca82fd970e744962ade9 (Date: 06/03/2016 13:41:48) File SHA256: 51761d2a901f3612765fff31508d4f80186c21575f490275f4c57c34cf32d25f (Date: 04/30/2016 15:55:43) File SHA256: 2cd6400b8ad3d0c4dadd8498a5e6f943d127173fcd324b3cb441f76db0e855d1 (Date: 04/24/2016 10:05:35)3f:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==40:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"0740056cb7f967e17b055e408cf9e9eb561fc543c4c5e74d912bca8ba45a7f75","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1793899656486,"unified_at":"2026-11-05T17:27:36.486Z","metadata":{"hashes":{"sha256":"0740056cb7f967e17b055e408cf9e9eb561fc543c4c5e74d912bca8ba45a7f75","sha1":"163cc10beb9897520e9271b24b18732890744563","md5":"7cb066591ef68944f2f49451ffccb7ca","sha512":"a8365897b94903aa0a577625da01d14344ada6468fa4c2121fa494b55bfe91121f7f3e4a354b29fa4f478ce75ff1e7334fd76d6e241ede3e220480efea2acfe6","ssdeep":"3072:qfhBR26thwL9RgGquTxBdqhzJxgNs8PGvvsMmFri4X5hjQxYY:KjhluTkzTUdevl0B","ssdeep_chunks":["3072:qfhBR26","3072:fhBR26t","3072:hBR26th","3072:BR26thw","3072:R26thwL","3072:26thwL9","3072:6thwL9R","3072:thwL9Rg","3072:hwL9RgG","3072:wL9RgGq","3072:L9RgGqu","3072:9RgGquT","3072:RgGquTx","3072:gGquTxB","3072:GquTxBd","3072:quTxBdq","3072:uTxBdqh","3072:TxBdqhz","3072:xBdqhzJ","3072:BdqhzJx","3072:dqhzJxg","3072:qhzJxgN","3072:hzJxgNs","3072:zJxgNs8","3072:JxgNs8P","3072:xgNs8PG","3072:gNs8PGv","3072:Ns8PGvv","3072:s8PGvvs","3072:8PGvvsM","3072:PGvvsMm","3072:GvvsMmF","3072:vvsMmFr","3072:vsMmFri","3072:sMmFri4","3072:MmFri4X","3072:mFri4X5","3072:Fri4X5h","3072:ri4X5hj","3072:i4X5hjQ","3072:4X5hjQx","3072:X5hjQxY","3072:5hjQxYY","6144:qfhBR26","6144:fhBR26t","6144:hBR26th","6144:BR26thw","6144:R26thwL","6144:26thwL9","6144:6thwL9R","6144:thwL9Rg","6144:hwL9RgG","6144:wL9RgGq","6144:L9RgGqu","6144:9RgGquT","6144:RgGquTx","6144:gGquTxB","6144:GquTxBd","6144:quTxBdq","6144:uTxBdqh","6144:TxBdqhz","6144:xBdqhzJ","6144:BdqhzJx","6144:dqhzJxg","6144:qhzJxgN","6144:hzJxgNs","6144:zJxgNs8","6144:JxgNs8P","6144:xgNs8PG","6144:gNs8PGv","6144:Ns8PGvv","6144:s8PGvvs","6144:8PGvvsM","6144:PGvvsMm","6144:GvvsMmF","6144:vvsMmFr","6144:vsMmFri","6144:sMmFri4","6144:MmFri4X","6144:mFri4X5","6144:Fri4X5h","6144:ri4X5hj","6144:i4X5hjQ","6144:4X5hjQx","6144:X5hjQxY","6144:5hjQxYY","3072:KjhluTk","3072:jhluTkz","3072:hluTkzT","3072:luTkzTU","3072:uTkzTUd","3072:TkzTUde","3072:kzTUdev","3072:zTUdevl","3072:TUdevl0","3072:Udevl0B"],"imphash":"4b89cffba3b87ecf25c3581a88fad091"},"file_info":{"file_name":"2018-10-24_09-20-01.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":201216,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1540341101000,"last_seen":1676825903000,"last_multi_scan":1676825903000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["coinminer","miner"]},"stats":{"av":{"malicious_count":15,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":11},"sandbox_signatures":{"informative_count":20,"suspicious_count":17,"malicious_count":10,"total":47},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[PSW]/Win32.Tepfer","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1238098","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Zusy.392933","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Zusy.392933 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/CoinMiner.BSG trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/CoinMiner.ci","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"CryptoMiner ( 0053ecb91 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Tasker.avq","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Tasker.fjtpfe","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Tasker","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Tasker.Win32.507","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Tasker","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Service Execution","attack_id":"T1035","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"tactic":"Execution","technique":"Local Job Scheduling","attack_id":"T1168","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1168","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1036","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","identifiers":[{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Reads the registry for installed applications"},{"type":"suspicious","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1057","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SCHTASKS.EXE\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SCHTASKS.EXE\")\n \".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WINLOGON.EXE\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WINLOGON.EXE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$36","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$37","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"hibud.ir\"\n \"api.foxovsky.ru\"\n \"bitbucket.org\"\n \"bbuseruploads.s3.amazonaws.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"209.141.41.188:80\"\n \"31.41.40.18:80\"\n \"18.205.93.2:443\"\n \"54.231.82.98:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"%USERPROFILE%\\Desktop\\supreme\\Supreme\\Release\\Supreme.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"winlogon.exe\" created file \"%TEMP%\\CabC11E.tmp\"\n \"winlogon.exe\" created file \"%TEMP%\\TarC11F.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$38","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"winlogon.exe\" (UID: 00042477-00003012) was launched with new environment variables: \"SESSIONNAME=\"Console\"\"\n Process \"winlogon.exe\" (UID: 00042477-00003012) was launched with modified environment variables: \"Path\"\n Process \"winlogon.exe\" (UID: 00042477-00003012) was launched with missing environment variables: \"PROMPT, MpConfig_ProductUserAppDataPath, MpConfig_ProductAppDataPath, MpConfig_ProductPath, MpConfig_ProductCodeName, MpConfig_ReportingGUID\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"winlogon.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c taskkill /im 0740056cb7f967e17b055e408cf9e9eb561fc543c4c5e74d912bca8ba45a7f75.exe /f & erase m5X+556cb7f967e17b055e408cf9eçs6j¹ù\" on 2018-10-24.02:38:00.300","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"winlogon.exe\" (UID: 00042264-00002624)\n Spawned process \"schtasks.exe\" with commandline \"/Create /SC MINUTE /MO 15 /TN \"WBY6IH2PWJVFIRJ897\" /TR \"%ALLUSER ...\" (UID: 00042470-00003708), Spawned process \"winlogon.exe\" (UID: 00042477-00003012), Spawned process \"cmd.exe\" with commandline \"/c taskkill /im 0740056cb7f967e17b055e408cf9e9eb561fc543c4c5e74d ...\" (UID: 00042534-00003272), Spawned process \"taskkill.exe\" with commandline \"taskkill /im 0740056cb7f967e17b055e408cf9e9eb561fc543c4c5e74d91 ...\" (UID: 00042603-00003812)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"winlogon.exe\" (UID: 00042264-00002624)\n Spawned process \"schtasks.exe\" with commandline \"/Create /SC MINUTE /MO 15 /TN \"WBY6IH2PWJVFIRJ897\" /TR \"%ALLUSER ...\" (UID: 00042470-00003708), Spawned process \"winlogon.exe\" (UID: 00042477-00003012), Spawned process \"cmd.exe\" with commandline \"/c taskkill /im 0740056cb7f967e17b055e408cf9e9eb561fc543c4c5e74d ...\" (UID: 00042534-00003272), Spawned process \"taskkill.exe\" with commandline \"taskkill /im 0740056cb7f967e17b055e408cf9e9eb561fc543c4c5e74d91 ...\" (UID: 00042603-00003812)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"\n \"schtasks.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"winlogon.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"TarC11F.tmp\" has type \"data\"\n \"EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619\" has type \"data\"\n \"CabC11E.tmp\" has type \"Microsoft Cabinet archive data 50939 bytes 1 file\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$39","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$3a","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"winlogon.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"\n \"winlogon.exe\" opened \"\\Device\\KsecDD\"\n \"schtasks.exe\" opened \"\\Device\\KsecDD\"\n \"taskkill.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"0740056cb7f967e17b055e408cf9e9eb561fc543c4c5e74d912bca8ba45a7f75.bin\" was detected as \"VC8 -> Microsoft Corporation\"\n \"winlogon.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"winlogon.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"schtasks.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"taskkill.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"winlogon.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"taskkill.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"winlogon.exe\" sleeping for \"00300000\" milliseconds\n \"winlogon.exe\" sleeping for \"00600000\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"2/68 reputation engines marked \"http://api.foxovsky.ru\" as malicious (2% detection rate)\n 1/67 reputation engines marked \"http://bitbucket.org\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"$3b","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\".exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"winlogon.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 209.141.41.188 on port 80 is sent without HTTP header\n TCP traffic to 31.41.40.18 on port 80 is sent without HTTP header\n TCP traffic to 18.205.93.2 on port 443 is sent without HTTP header\n TCP traffic to 54.231.82.98 on port 443 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"winlogon.exe\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"winlogon.exe\" had access to \"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":7,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"%ALLUSERSPROFILE%\\{H3D7L8J5-U16Q-FD38-ZZ02EU261ELM}\\winlogon.exe\" marked \"%TEMP%\\CabC11E.tmp\" for deletion\n \"%ALLUSERSPROFILE%\\{H3D7L8J5-U16Q-FD38-ZZ02EU261ELM}\\winlogon.exe\" marked \"%TEMP%\\TarC11F.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"winlogon.exe\" opened \"%TEMP%\\CabC11E.tmp\" with delete access\n \"winlogon.exe\" opened \"%TEMP%\\TarC11F.tmp\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\".exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"winlogon.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"winlogon.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"winlogon.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"winlogon.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"winlogon.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"winlogon.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetUserNameA\n RegOpenKeyExW\n RegCloseKey\n GetThreadContext\n WriteFile\n WriteProcessMemory\n GetModuleFileNameW\n CopyFileA\n GetModuleFileNameA\n UnhandledExceptionFilter\n GetModuleHandleA\n CreateThread\n CreateToolhelp32Snapshot\n LoadLibraryW\n GetTickCount\n OpenProcess\n CreateDirectoryA\n GetStartupInfoW\n ReadProcessMemory\n GetComputerNameA\n GetProcAddress\n CreateFileW\n IsDebuggerPresent\n CreateFileA\n VirtualAllocEx\n Process32NextW\n GetCommandLineA\n Process32FirstW\n GetModuleHandleW\n CreateProcessA\n Sleep\n TerminateProcess\n VirtualAlloc\n GetModuleFileNameExW\n ShellExecuteExA\n ShellExecuteW\n ShellExecuteA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"taskkill.exe\" wrote bytes \"4053157758581677186a1677653c17770000000000bfb7750000000056ccb775000000007ccab7750000000037683b756a2c1777d62d17770000000020693b750000000029a6b77500000000a48d3b7500000000f70eb77500000000\" to virtual address \"0x75AE1000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"11/67 Antivirus vendors marked sample as malicious (16% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"11/67 Antivirus vendors marked sample as malicious (16% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"11/67 Antivirus vendors marked dropped file \"winlogon.exe\" as malicious (classified as \"FileRepMalware\" with 16% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"11/67 Antivirus vendors marked spawned process \"winlogon.exe\" (PID: 2624) as malicious (classified as \"FileRepMalware\" with 16% detection rate)\n 11/67 Antivirus vendors marked spawned process \"winlogon.exe\" (PID: 3012) as malicious (classified as \"FileRepMalware\" with 16% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\".exe\" allocated memory in \"HKCU\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\".exe\" wrote 32 bytes to a remote process \"%ALLUSERSPROFILE%\\{H3D7L8J5-U16Q-FD38-ZZ02EU261ELM}\\winlogon.exe\" (Handle: 328)\n \".exe\" wrote 52 bytes to a remote process \"%ALLUSERSPROFILE%\\{H3D7L8J5-U16Q-FD38-ZZ02EU261ELM}\\winlogon.exe\" (Handle: 328)\n \".exe\" wrote 4 bytes to a remote process \"%ALLUSERSPROFILE%\\{H3D7L8J5-U16Q-FD38-ZZ02EU261ELM}\\winlogon.exe\" (Handle: 328)\n \".exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\schtasks.exe\" (Handle: 576)\n \".exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\schtasks.exe\" (Handle: 576)\n \".exe\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\schtasks.exe\" (Handle: 576)\n \"cmd.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\taskkill.exe\" (Handle: 84)\n \"cmd.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\taskkill.exe\" (Handle: 84)\n \"cmd.exe\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\taskkill.exe\" (Handle: 84)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$3d","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"malicious","category":"Network Related","name":"Multiple malicious artifacts seen in the context of different hosts","description":"$3e","origin":"Network Traffic","relevance":10,"id":"network-27","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\".exe\" checked file \"C:\\0740056cb7f967e17b055e408cf9e9eb561fc543c4c5e74d912bca8ba45a7f75.exe:Zone.Identifier\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \".exe\" (UID: 00041627-00003796)\n Spawned process \"winlogon.exe\" (UID: 00042264-00002624)\n Spawned process \"schtasks.exe\" with commandline \"/Create /SC MINUTE /MO 15 /TN \"WBY6IH2PWJVFIRJ897\" /TR \"%ALLUSERSPROFILE%\\{H3D7L8J5-U16Q-FD38-ZZ02EU261ELM}\\winlogon.exe\" /F\" (UID: 00042470-00003708)\n Spawned process \"winlogon.exe\" (UID: 00042477-00003012)\n Spawned process \"cmd.exe\" with commandline \"/c taskkill /im 0740056cb7f967e17b055e408cf9e9eb561fc543c4c5e74d912bca8ba45a7f75.exe /f & erase m5X+556cb7f967e17b055e408cf9eçs6j¹ù\" (UID: 00042534-00003272)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /im 0740056cb7f967e17b055e408cf9e9eb561fc543c4c5e74d912bca8ba45a7f75.exe /f\" (UID: 00042603-00003812)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Accesses potentially sensitive information from local browsers"},{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns a lot of processes"},{"detail":"Creates a fake system process"}],"sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"name":"Fingerprint","details_count":6,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Reads the active computer name"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 4 domains and 4 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]}]},"activity":{"stats":{"process_count":6,"spawned_processes_count":6,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":16,"imported_dlls_count":104,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":47,"files_deleted_count":0,"registry_keys_created_count":6,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":6,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":4,"dns_resolutions_count":4,"contacted_urls_count":6,"http_requests_count":6},"behavior_tags":["coinminer","miner"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","TOR analysis"],"sandbox_reports":[{"id":"5bcfbd6c7ca3e11c3610b3a4","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"FileRepMalware","contacted_countries":["RUS","USA"],"submit_name":"2018-10-24_09-20-01.exe","analysis_start_time":"2018-10-24T02:31:46+00:00","indicators_count":{"informative":20,"suspicious":27,"malicious":17},"tags":["Multi-Process","Network Traffic","Extracted Files","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"209.141.41.188","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"address":"31.41.40.18","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"address":"18.205.93.2","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"address":"54.231.82.98","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]}],"dns_resolutions":[{"domain":"hibud.ir","address":"209.141.41.188","ttl":3600,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"domain":"bitbucket.org","address":"18.205.93.0","ttl":300,"country":"United States","registrar_name":"eNom, Inc.","registrar_organization":"Atlassian","registrar_name_servers":"NS-1305.AWSDNS-35.ORG","registrar_creation_date":"1997-11-24T05:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"domain":"bbuseruploads.s3.amazonaws.com","address":"52.216.96.243","ttl":300,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Amazon.com, Inc.","registrar_creation_date":"2005-08-18T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"domain":"api.foxovsky.ru","address":"31.41.40.18","ttl":3600,"country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]}],"http_requests":[{"host":"hibud.ir","host_ip":"209.141.41.188:80","url":"/gate/create.php","method":"POST","header":"POST /gate/create.php HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko\nContent-Length: 433\nHost: hibud.ir","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"host":"hibud.ir","host_ip":"209.141.41.188:80","url":"/gate/config.php","method":"POST","header":"POST /gate/config.php HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko\nContent-Length: 0\nHost: hibud.ir","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"host":"hibud.ir","host_ip":"209.141.41.188:80","url":"/gate/update.php","method":"POST","header":"POST /gate/update.php HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko\nContent-Length: 58\nHost: hibud.ir","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"host":"api.foxovsky.ru","host_ip":"31.41.40.18:80","url":"/v1/checkLicense.php","method":"POST","header":"POST /v1/checkLicense.php HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko\nContent-Length: 38\nHost: api.foxovsky.ru","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"host":"api.foxovsky.ru","host_ip":"31.41.40.18:80","url":"/v1/saveLicense.php","method":"POST","header":"POST /v1/saveLicense.php HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko\nContent-Length: 451\nHost: api.foxovsky.ru","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"host":"api.foxovsky.ru","host_ip":"31.41.40.18:80","url":"/v1/updateLicense.php","method":"POST","header":"POST /v1/updateLicense.php HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko\nContent-Length: 38\nHost: api.foxovsky.ru","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}],"processes":[{"pid":3796,"ppid":0,"name":"0740056cb7f967e17b055e408cf9e9eb561fc543c4c5e74d912bca8ba45a7f75.exe","command_line":"","sha256":"0740056cb7f967e17b055e408cf9e9eb561fc543c4c5e74d912bca8ba45a7f75","normalized_path":"C:\\0740056cb7f967e17b055e408cf9e9eb561fc543c4c5e74d912bca8ba45a7f75.exe","uid":"00041627-00003796","icon":"$3f"},{"pid":2624,"ppid":3796,"name":"winlogon.exe","command_line":"","sha256":"0740056cb7f967e17b055e408cf9e9eb561fc543c4c5e74d912bca8ba45a7f75","normalized_path":"%ALLUSERSPROFILE%\\{H3D7L8J5-U16Q-FD38-ZZ02EU261ELM}\\winlogon.exe","parent_uid":"00041627-00003796","uid":"00042264-00002624"},{"pid":3708,"ppid":3796,"name":"schtasks.exe","command_line":"/Create /SC MINUTE /MO 15 /TN \"WBY6IH2PWJVFIRJ897\" /TR \"%ALLUSERSPROFILE%\\{H3D7L8J5-U16Q-FD38-ZZ02EU261ELM}\\winlogon.exe\" /F","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\System32\\schtasks.exe","parent_uid":"00041627-00003796","uid":"00042470-00003708"},{"pid":3272,"ppid":3796,"name":"cmd.exe","command_line":"/c taskkill /im 0740056cb7f967e17b055e408cf9e9eb561fc543c4c5e74d912bca8ba45a7f75.exe /f & erase m5X+556cb7f967e17b055e408cf9eçs6j¹ù","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00041627-00003796","uid":"00042534-00003272"},{"pid":3812,"ppid":3272,"name":"taskkill.exe","command_line":"taskkill /im 0740056cb7f967e17b055e408cf9e9eb561fc543c4c5e74d912bca8ba45a7f75.exe /f","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\System32\\taskkill.exe","parent_uid":"00042534-00003272","uid":"00042603-00003812"},{"pid":3012,"ppid":0,"name":"winlogon.exe","command_line":"","sha256":"0740056cb7f967e17b055e408cf9e9eb561fc543c4c5e74d912bca8ba45a7f75","normalized_path":"%ALLUSERSPROFILE%\\{H3D7L8J5-U16Q-FD38-ZZ02EU261ELM}\\winlogon.exe","uid":"00042477-00003012","icon":"$40"}],"all_imported_dlls":["dnsapi.dll","secur32.dll","bcrypt.dll","srvcli.dll","iertutil.dll","userenv.dll","rsaenh.dll","dhcpcsvc.dll","xmllite.dll","user32.dll","usp10.dll","rtutils.dll","dhcpcsvc6.dll","cabinet.dll","ktmw32.dll","netapi32.dll","wbemsvc.dll","shell32.dll","cryptbase.dll","devobj.dll","netutils.dll","ntdsapi.dll","KernelBase.dll","crypt32.dll","propsys.dll","mswsock.dll","IPHLPAPI.DLL","pnrpnsp.dll","winsta.dll","advapi32.dll","cfgmgr32.dll","devrtl.dll","cryptsp.dll","framedynos.dll","credssp.dll","gdi32.dll","msctf.dll","FWPUCLNT.DLL","wkscli.dll","wbemprox.dll","fastprox.dll","ntdll.dll","lpk.dll","clbcatq.dll","sspicli.dll","NapiNSP.dll","npmproxy.dll","bcryptprimitives.dll","taskschd.dll","imm32.dll","comctl32.dll","sfc_os.dll","mpr.dll","nsi.dll","msxml3r.dll","winrnr.dll","cryptnet.dll","rpcrt4.dll","ntmarta.dll","ieframe.dll","msxml3.dll","rasapi32.dll","winbrand.dll","dbghelp.dll","wininet.dll","msasn1.dll","sfc.dll","oleacc.dll","wshqos.dll","netprofm.dll","RpcRtRemote.dll","gpapi.dll","Wldap32.dll","setupapi.dll","wintrust.dll","nlaapi.dll","wbemcomn.dll","sechost.dll","wship6.dll","ncrypt.dll","kernel32.dll","shlwapi.dll","SensApi.dll","normaliz.dll","schannel.dll","wtsapi32.dll","ws2_32.dll","winhttp.dll","webio.dll","urlmon.dll","oleaut32.dll","rpcss.dll","profapi.dll","oleaccrc.dll","WSHTCPIP.DLL","winnsi.dll","uxtheme.dll","msvcrt.dll","apphelp.dll","rasadhlp.dll","version.dll","rasman.dll","psapi.dll","ole32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"winlogon.exe","sha256":"0740056cb7f967e17b055e408cf9e9eb561fc543c4c5e74d912bca8ba45a7f75","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"name":"EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619","sha256":"0a9631dfa1bef96b93c3d7d0cbcd8662d6ba31c5fceb678355e292851cc8502b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"name":"CabC11E.tmp","sha256":"c929701c67a05f90827563eedccf5eba8e65b2da970189a0371f28cd896708b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"name":"TarC11F.tmp","sha256":"7e58975a4e1e86940f84e744709426939b85ae174dbbf020da3c893a54fd1da2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]}],"files_written":[{"path":"C:\\0740056cb7f967e17b055e408cf9e9eb561fc543c4c5e74d912bca8ba45a7f75.exe","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"C:\\0740056cb7f967e17b055e408cf9e9eb561fc543c4c5e74d912bca8ba45a7f75.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"%WINDIR%\\System32\\en-US\\propsys.dll.mui","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"%WINDIR%\\AppPatch\\pcamain.sdb","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"%WINDIR%\\System32\\schtasks.exe","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"%WINDIR%\\System32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"%WINDIR%\\System32\\en-US\\schtasks.exe.mui","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"%WINDIR%\\System32\\en-US\\taskkill.exe.mui","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"%WINDIR%\\System32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"%WINDIR%\\System32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"%WINDIR%\\System32\\en-US\\crypt32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\EDC238BFF48A31D55A97E1E93892934B_167DB4E3AB356C5B50FAA8944D554776","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\0270780F846F08BEFE0DD8112D932FEF","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"%WINDIR%\\System32\\en-US\\winhttp.dll.mui","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{09477111-DE61-43CD-A5AA-D9F7B489301F}\\","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\0A-00-27-00-00-00\\","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{09477111-DE61-43CD-A5AA-D9F7B489301F}\\0A-00-27-00-00-00\\","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\AMD Opteron(TM) Processor 6272 e47c61d2-1dae-480e-827a-ae8d797649df","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5bcfbd6c7ca3e11c3610b3a4"}]}]}},"report_ids":{"sandbox_job_ids":["5bcfbd6c7ca3e11c3610b3a4"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious Trojan.Tasker Sample 0740056cb7f9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 0740056cb7f9…. Malware family: Trojan.Tasker. Threat score 100/100. 15/28 AV engines flagged this file. 10 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/0740056cb7f967e17b055e408cf9e9eb561fc543c4c5e74d912bca8ba45a7f75"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Tasker Sample 0740056cb7f9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 0740056cb7f9…. Malware family: Trojan.Tasker. Threat score 100/100. 15/28 AV engines flagged this file. 10 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/0740056cb7f967e17b055e408cf9e9eb561fc543c4c5e74d912bca8ba45a7f75"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Tasker Sample 0740056cb7f9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 0740056cb7f9…. Malware family: Trojan.Tasker. Threat score 100/100. 15/28 AV engines flagged this file. 10 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L41","11",{}]] 32:null