34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 3a:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T42e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Sample 075d7e63ccc2… — Score 70/100 — Hybrid Analysis","description":"Suspicious verdict for sample 075d7e63ccc2…. Threat score 70/100. 0/24 AV engines flagged this file. 0 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/075d7e63ccc22d071c904855a71fe63189526a8af2274666e4ba4cc693b39353","keywords":["Suspicious","malware analysis","sandbox report","threat intelligence","075d7e63ccc22d071c904855a71fe63189526a8af2274666e4ba4cc693b39353"],"about":{"@type":"SoftwareApplication","name":"Tweakeze.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"075d7e63ccc22d071c904855a71fe63189526a8af2274666e4ba4cc693b39353","additionalType":"Suspicious sample"},"threatScore":70,"antivirusDetections":{"malicious":0,"total":24},"behavioralIndicators":{"malicious":0,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T558,Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" (Indicator: "software\microsoft\windows\currentversion\run"; in Source: "sample.bin"), Found string "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" (Indicator: "software\microsoft\windows\currentversion\explorer\user shell folders"; in Source: "sample.bin"), Found string "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" (Indicator: "software\microsoft\windows\currentversion\explorer\shell folders"; in Source: "sample.bin"), Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" (Indicator: "software\microsoft\windows\currentversion\run"; in Source: "sample.bin"), Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" (Indicator: "software\microsoft\windows\currentversion\runonce"; in Source: "sample.bin"), Found string "\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" (Indicator: "software\microsoft\windows\currentversion\explorer\shell folders"; in Source: "sample.bin"), Found string "\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" (Indicator: "software\microsoft\windows\currentversion\explorer\user shell folders"; in Source: "sample.bin"), Found string "Software\Microsoft\Windows\CurrentVersion\Run" (Indicator: "software\microsoft\windows\currentversion\run"; in Source: "sample.bin")37:Tb7d,"SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: sample.bin, "Action1=Registry|Number|HKCU\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications\%s_!!_|DisabledByUser|1 " in Source: sample.bin, "SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages" in Source: sample.bin, "SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg" in Source: sample.bin, "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: sample.bin, "System\CurrentControlSet\Control\Session Manager\Environment" in Source: sample.bin, "HKCU\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications" in Source: sample.bin, "SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Families\" in Source: sample.bin, "Action2=Registry|Number|HKCU\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications\%s_!!_|DisabledByUser|0|0 " in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved" in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: sample.bin, "SYSTEM\CurrentControlSet\Control\FileSystem" in Source: sample.bin, "Software\Microsoft\Installer\Products" in Source: sample.bin, "Hardware\Description\System\CentralProcessor" in Source: sample.bin, "Action2=Registry|Number|HKCU\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications\%s_!!_|Disabled|0|0 " in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved" in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\" in Source: sample.bin, "\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: sample.bin, "Software\Microsoft\Windows\DWM" in Source: sample.bin, "\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: sample.bin, "Action1=Registry|Number|HKCU\Software\Microsoft\Windows\CurrentVersion\BackgroundAccessApplications\%s_!!_|Disabled|1 " in Source: sample.bin, "Software\Classes\CLSID\{054AAE20-4BEA-4347-8A35-64A533254A9D}\LocalServer32" in Source: sample.bin, "HKCR\" in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: sample.bin, "HKU\" in Source: sample.bin, "HKLM\" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Run" in Source: sample.bin, "SOFTWARE\Classes\AppUserModelId\%s" in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: sample.bin38:T1628,"UPDATE moz_places SET last_visit_date = null where id not in (select place_id from moz_annos where anno_attribute_id in (select id from moz_anno_attributes where name LIKE 'downloads/%'));" (Source: sample.bin, Indicator: "update moz_places set last_visit_date = null where id not in (select place_id from moz_annos where anno_attribute_id in (select id from moz_anno_attributes where name like 'downloads/%'));"), "select host as cookie, creation_time as raw from channel_id" (Source: sample.bin, Indicator: "select host as cookie, creation_time as raw from channel_id"), "SELECT ProcessId FROM Win32_Process where ParentProcessId=%d" (Source: sample.bin, Indicator: "select processid from win32_process where parentprocessid=%d"), "Delete from moz_annos where place_id not in (select id from moz_places) and place_id != 0" (Source: sample.bin, Indicator: "delete from moz_annos where place_id not in (select id from moz_places) and place_id != 0"), "select host as raw, SubStr(host, instr(host, 'http://') + 7, LENGTH(host) - 7) as cookie from moz_hosts where type='offline-app' and permission=1 and instr(host, 'http://') > 0" (Source: sample.bin, Indicator: "select host as raw, substr(host, instr(host, 'http://') + 7, length(host) - 7) as cookie from moz_hosts where type='offline-app' and permission=1 and instr(host, 'http://') > 0"), "select count(*) from sqlite_master where type='table' and name='%s'" (Source: sample.bin, Indicator: "select count(*) from sqlite_master where type='table' and name='%s'"), "select url, url_hash from moz_places where id in (select fk from moz_bookmarks where fk notnull) and url like '%://%';" (Source: sample.bin, Indicator: "select url, url_hash from moz_places where id in (select fk from moz_bookmarks where fk notnull) and url like '%://%';"), "select name,value from autofill;" (Source: sample.bin, Indicator: "select name,value from autofill;"), "select origin as cookie, id as raw from Databases" (Source: sample.bin, Indicator: "select origin as cookie, id as raw from databases"), "Delete from moz_places where id in (select place_id from moz_historyvisits where place_id not in (select place_id from moz_annos where anno_attribute_id in (select id from moz_anno_attributes where name LIKE 'downloads/%')))" (Source: sample.bin, Indicator: "delete from moz_places where id in (select place_id from moz_historyvisits where place_id not in (select place_id from moz_annos where anno_attribute_id in (select id from moz_anno_attributes where name like 'downloads/%')))"), "SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'" (Source: sample.bin, Indicator: "select * from __instancecreationevent within 1 where targetinstance isa 'win32_process'"), "select prefix,host from moz_hosts" (Source: sample.bin, Indicator: "select prefix,host from moz_hosts"), "Select count(*) as total from %s" (Source: sample.bin, Indicator: "select count(*) as total from %s"), "select scope as cookie from webappsstore2" (Source: sample.bin, Indicator: "select scope as cookie from webappsstore2"), "DELETE FROM moz_favicons WHERE id IN (SELECT f.id FROM moz_favicons f LEFT OUTER JOIN moz_places h ON f.id = h.favicon_id WHERE h.favicon_id IS NULL)" (Source: sample.bin, Indicator: "delete from moz_favicons where id in (select f.id from moz_favicons f left outer join moz_places h on f.id = h.favicon_id where h.favicon_id is null)"), "Delete from moz_historyvisits where place_id in (select place_id from moz_annos where anno_attribute_id in (select id from moz_anno_attributes where name LIKE 'downloads/%'))" (Source: sample.bin, Indicator: "delete from moz_historyvisits where place_id in (select place_id from moz_annos where anno_attribute_id in (select id from moz_anno_attributes where name like 'downloads/%'))"), "delete from OriginInfoTable where origin in (%s) AND (instr(origin, 'http://') > 0 OR instr(origin, 'https://') > 0);" (Source: sample.bin, Indicator: "delete from origininfotable where origin in (%s) and (instr(origin, 'http://') > 0 or instr(origin, 'https://') > 0);"), "UPDATE moz_places SET visit_count = 0 where id not in (select place_id from moz_annos where anno_attribute_id in (select id from moz_anno_attributes where name LIKE 'downloads/%'));" (Source: sample.bin, Indicator: "update moz_places set visit_count = 0 where id not in (select place_id from moz_annos where anno_attribute_id in (select id from moz_anno_attributes where name like 'downloads/%'));"), "select host_key as cookie from cookies;" (Source: sample.bin, Indicator: "select host_key as cookie from cookies;"), "delete from buckets;" (Source: sample.bin, Indicator: "delete from buckets;"), "delete from %s" (Source: sample.bin, Indicator: "delete from %s"), "select * from __InstanceModificationEvent within 1 where TargetInstance ISA 'Win32_PerfFormattedData_Counters_ProcessorInformation' and TargetInstance.Name = '_Total'" (Source: sample.bin, Indicator: "select * from __instancemodificationevent within 1 where targetinstance isa 'win32_perfformatteddata_counters_processorinformation' and targetinstance.name = '_total'"), "select origin as cookie, creation_time as raw from origin_bound_certs" (Source: sample.bin, Indicator: "select origin as cookie, creation_time as raw from origin_bound_certs"), "select hostname, httpRealm, formSubmitUrl from moz_logins" (Source: sample.bin, Indicator: "select hostname, httprealm, formsubmiturl from moz_logins"), "delete from moz_hosts where type='offline-app' and permission=1;" (Source: sample.bin, Indicator: "delete from moz_hosts where type='offline-app' and permission=1;")39:T11c7,Found string "UPDATE moz_places SET last_visit_date = null where id not in (select place_id from moz_annos where anno_attribute_id in (select id from moz_anno_attributes where name LIKE 'downloads/%'));" (Indicator: "select <> from moz_"; Source: "sample.bin"), Found string "Delete from moz_annos where place_id not in (select id from moz_places) and place_id != 0" (Indicator: "select <> from moz_"; Source: "sample.bin"), Found string "select host as raw, SubStr(host, instr(host, 'http://') + 7, LENGTH(host) - 7) as cookie from moz_hosts where type='offline-app' and permission=1 and instr(host, 'http://') > 0" (Indicator: "select <> from moz_"; Source: "sample.bin"), Found string "select url, url_hash from moz_places where id in (select fk from moz_bookmarks where fk notnull) and url like '%://%';" (Indicator: "select <> from moz_"; Source: "sample.bin"), file/memory contains long string with (Indicator: "select <> from moz_"; Source: "sample.bin"), Found string "select prefix,host from moz_hosts" (Indicator: "select <> from moz_"; Source: "sample.bin"), Found string " select host as raw, SubStr(host, instr(host, 'https://') + 8, LENGTH(host) - 8) as cookie from moz_hosts where type='offline-app' and permission=1 and instr(host, 'https://') > 0" (Indicator: "select <> from moz_"; Source: "sample.bin"), Found string "Delete from moz_historyvisits where place_id in (select place_id from moz_annos where anno_attribute_id in (select id from moz_anno_attributes where name LIKE 'downloads/%'))" (Indicator: "select <> from moz_"; Source: "sample.bin"), Found string "UPDATE moz_places SET visit_count = 0 where id not in (select place_id from moz_annos where anno_attribute_id in (select id from moz_anno_attributes where name LIKE 'downloads/%'));" (Indicator: "select <> from moz_"; Source: "sample.bin"), Found string "select hostname, httpRealm, formSubmitUrl from moz_logins" (Indicator: "select <> from moz_"; Source: "sample.bin"), Found string "(select icon_id from moz_icons_to_pages where icon_id in " (Indicator: "select <> from moz_"; Source: "sample.bin"), Found string "delete from moz_icons where root = 1 and id not in (select icon_id from moz_icons_to_pages) and icon_url not like " (Indicator: "select <> from moz_"; Source: "sample.bin"), Found string " select origin as raw, SubStr(origin, instr(origin, 'http://') + 7, LENGTH(origin) - 7) as cookie from moz_perms WHERE instr(origin, 'http://') > 0" (Indicator: "select <> from moz_"; Source: "sample.bin"), Found string "select host as cookie from moz_cookies;" (Indicator: "select <> from moz_"; Source: "sample.bin"), Found string "select Key, Generation from moz_cache" (Indicator: "select <> from moz_"; Source: "sample.bin"), Found string "Delete from moz_historyvisits where place_id not in (select place_id from moz_annos where anno_attribute_id in (select id from moz_anno_attributes where name like 'downloads/%'))" (Indicator: "select <> from moz_"; Source: "sample.bin"), Found string "Delete from moz_annos where anno_attribute_id in (select id from moz_anno_attributes where name like 'downloads/%')" (Indicator: "select <> from moz_"; Source: "sample.bin"), Found string "select prefix,host from moz_origins where id not in(select origin_id from moz_places)" (Indicator: "select <> from moz_"; Source: "sample.bin"), Found string "select icon_url as url from moz_icons where id in " (Indicator: "select <> from moz_"; Source: "sample.bin"), Found string "Delete from moz_places WHERE id in (select place_id from moz_annos where anno_attribute_id in (select id from moz_anno_attributes where name LIKE 'downloads/%') and place_id NOT IN (Select fk FROM moz_bookmarks where fk NOT NULL))" (Indicator: "select <> from moz_"; Source: "sample.bin"), Found string "delete from moz_icons where root = 0 and id not in (select icon_id from moz_icons_to_pages)" (Indicator: "select <> from moz_"; Source: "sample.bin"), Found string "delete from moz_icons_to_pages where page_id not in (select id from moz_pages_w_icons)" (Indicator: "select <> from moz_"; Source: "sample.bin"), Found string "delete from moz_origins where id not in(select origin_id from moz_places)" (Indicator: "select <> from moz_"; Source: "sample.bin"), Found string " select origin as raw, SubStr(origin, instr(origin, 'https://') + 8, LENGTH(origin) - 8) as cookie from moz_perms WHERE instr(origin, 'https://') > 0" (Indicator: "select <> from moz_"; Source: "sample.bin"), Found string "(select id from moz_pages_w_icons" (Indicator: "select <> from moz_"; Source: "sample.bin")30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"075d7e63ccc22d071c904855a71fe63189526a8af2274666e4ba4cc693b39353","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":70,"unified_at_epoch_ms":1794469141430,"unified_at":"2026-11-12T07:39:01.430Z","metadata":{"hashes":{"sha256":"075d7e63ccc22d071c904855a71fe63189526a8af2274666e4ba4cc693b39353","sha1":"a0689cc99625908282a815b6e10cae4f329b24ee","md5":"c3703af21e44a9a254676d4ac26c44aa"},"file_info":{"file_name":"Tweakeze.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":16461976,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1794469133000,"last_seen":1794469133000,"last_multi_scan":1794469133000}},"detections":{"summary":{"verdict":"suspicious","score":70,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":27},"sandbox_signatures":{"informative_count":32,"suspicious_count":11,"malicious_count":0,"total":43},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Browser Information Discovery","attack_id":"T1217","attack_id_wiki":"https://attack.mitre.org/techniques/T1217","identifiers":[{"type":"suspicious","value":"Able to retrieve browser history information"},{"type":"informative","value":"Contains ability to query sqlite firefox history"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using web history"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"References to WMI query strings used for process discovery"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to retrieve browser cookies data"},{"type":"suspicious","value":"Able to retrieve browser cookies using SQL"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"References JavaScript(s)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Path Interception by PATH Environment Variable","attack_id":"T1574.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/007","identifiers":[{"type":"informative","value":"References PATH environment registry keys"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"suspicious","value":"Able to retrieve saved login credentials from browser"},{"type":"informative","value":"References Firefox browser credentials files"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Found browsers sensitive information related strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"suspicious","value":"YARA signature match - ChaCha20 encryption algorithm"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – cryptographic algorithms"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify COM objects"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match - PE executable embedded in .rsrc section"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"suspicious","value":"YARA signature match - Crypto Library"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Found registry location string related to processor"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Found system command-related strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"References user shell folders registry key string"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - Crypto Library","description":"YARA signature for detecting crypto library used in file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1560.002","id":"yara-125","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PE executable embedded in .rsrc section","description":"YARA signature for embedded PE executable in .rsrc section matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027.009","id":"yara-26","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 encryption algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"sample.bin\", YARA signature for ChaCha20 128-bit key algorithm matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-44","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-103","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-62","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – cryptographic algorithms","description":"YARA signature matched on Chacha20 instruction used in file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027.013","id":"yara-155","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found registry location strings which can modify auto-execute functionality","description":"$36","origin":"sample.bin","mitre_attack_id":"T1547","id":"string-184","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"References user shell folders registry key string","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" (Indicator: \"currentversion\\explorer\\user shell folders\"; in Source: \"sample.bin\"), Found string \"\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" (Indicator: \"currentversion\\explorer\\user shell folders\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1547.001","id":"string-410","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"References PATH environment registry keys","description":"Found string \"System\\CurrentControlSet\\Control\\Session Manager\\Environment\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1574.007","id":"string-530","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$37","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$38","origin":"sample.bin","mitre_attack_id":"T1213","id":"string-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"appro@openssl.org\"","origin":"sample.bin","mitre_attack_id":"T1114","id":"string-63","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"Icon2=File|%WINDIR%\\System32\\imageres.dll,49\n\" [Source: sample.bin], Observed system executable string:\"Icon=File|%WINDIR%\\System32\\imageres.dll,94\n\" [Source: sample.bin], Observed system executable string:\"C:\\Windows\\System32\\NotificationController.dll\" [Source: sample.bin]","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-625","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"CreateWindowEx\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"DisplayVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"References JavaScript(s)","description":"Found string \"text/javascript\" (Indicator: \"text/javascript\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.007","id":"string-626","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\msiexec.exe\" [Source: sample.bin], Observed system executable string:\"%WINDIR%\\System32\\cmd.exe\" [Source: sample.bin], Observed system executable string:\"Icon=File|%WINDIR%\\System32\\msiexec.exe\n\" [Source: sample.bin]","origin":"sample.bin","id":"string-170","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"Mozilla/4.0 (Tweakeze, %s)\" (Indicator: \"mozilla/4.0 (\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-127","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query sqlite firefox history","description":"$39","origin":"sample.bin","mitre_attack_id":"T1217","id":"string-464","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"SELECT ProcessId FROM Win32_Process where ParentProcessId=%d\" (Indicator: \" Win32_Process\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-507","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References Firefox browser credentials files","description":"Found string \"Default|File|Delete|%s\\*|logins.json;logins-backup.json\" (Indicator: \"logins.json\"; in Source: \"sample.bin\"), Found string \"logins.json\" (Indicator: \"logins.json\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555.003","id":"string-405","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to retrieve saved login credentials from browser","description":"Found string \"Default|File|Delete|%s\\*|logins.json;logins-backup.json\" (Source: \"sample.bin\"), Found string \"select hostname, httpRealm, formSubmitUrl from moz_logins\" (Source: \"sample.bin\"), Found string \"logins.json\" (Source: \"sample.bin\"), Found string \"select origin_url, username_value from logins\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555.003","id":"string-693","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to retrieve browser history information","description":"Found string \"formhistory.sqlite\" (Indicator: \"formhistory.sqlite\"; Source: \"sample.bin\"), Found string \"Default|File|Delete|%s\\*|places.sqlite\" (Indicator: \"places.sqlite\"; Source: \"sample.bin\"), Found string \"places.sqlite\" (Indicator: \"places.sqlite\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1217","id":"string-10069","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to retrieve browser cookies using SQL","description":"Found string \"select host_key as cookie from cookies;\" (Source: \"sample.bin\"), Found string \"select host as cookie from moz_cookies;\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1539","id":"string-692","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found browsers sensitive information related strings","description":"\"LevelDB|File|Delete|%s\\*\\Local Storage\\leveldb|lock\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1005","id":"string-133","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"'. Run as administrator to listen on an hostname other than localhost, or to listen on port 80.\" (Indicator: \"hostname\"; Source: \"sample.bin\"), Found string \"hostname\" (Indicator: \"hostname\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"client_secret\" (Indicator: \"secret\"; Source: \"sample.bin\"), Found string \"passwords\" (Indicator: \"password\"; Source: \"sample.bin\"), Found string \"oauth_token_secret\" (Indicator: \"secret\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"base64\" (Indicator: \"base64\"; Source: \"sample.bin\"), Found string \"P~AeS~AeS\" (Indicator: \"aes\"; Source: \"sample.bin\"), Found string \"AES for x86_64, CRYPTOGAMS by \" (Indicator: \"aes\"; Source: \"sample.bin\"), Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\\" (Indicator: \"microsoft\\windows\\currentversion\\app paths\") in Source: sample.bin, \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: sample.bin, \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-96","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"SELECT ProcessId FROM Win32_Process where ParentProcessId=%d\" (Indicator: \" win32_process\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-55","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"SELECT ProcessId FROM Win32_Process where ParentProcessId=%d\" (Indicator: \" Win32_Process\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-513","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using web history","description":"Found string \"formhistory.sqlite\" (Source: \"sample.bin\"), Found string \"Default|File|Delete|%s\\*|places.sqlite\" (Source: \"sample.bin\"), Found string \"places.sqlite\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-662","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'\" (Indicator: \"select * from \"; Source: \"sample.bin\"), Found string \"select * from __InstanceModificationEvent within 1 where TargetInstance ISA 'Win32_PerfFormattedData_Counters_ProcessorInformation' and TargetInstance.Name = '_Total'\" (Indicator: \"select * from \"; Source: \"sample.bin\"), Found string \"SELECT * FROM __InstanceDeletionEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'\" (Indicator: \"select * from \"; Source: \"sample.bin\"), Found string \"select * from meta where key='Default Search Provider ID';\" (Indicator: \"select * from \"; Source: \"sample.bin\"), Found string \"select * from __InstanceModificationEvent within 1 where TargetInstance ISA 'WIN32_OperatingSystem' AND PreviousInstance.FreePhysicalMemory != TargetInstance.FreePhysicalMemory\" (Indicator: \"select * from \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-433","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"Found string \"moz_cookies\" (Indicator: \"moz_cookies\"; Source: \"sample.bin\"), Found string \"cookies.sqlite\" (Indicator: \"cookies.sqlite\"; Source: \"sample.bin\"), Found string \"select host as cookie from moz_cookies;\" (Indicator: \"moz_cookies\"; Source: \"sample.bin\"), Found string \"Default|File|Delete|%s\\*|cookies.sqlite\" (Indicator: \"cookies.sqlite\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1539","id":"string-5058","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to processor","description":"Observed string: \"Hardware\\Description\\System\\CentralProcessor\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-351","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"sample.bin\"), Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-663","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://tweakeze.com\", Found HTTPS url \"https://www.tweakeze.com\", Found HTTPS url \"https://mail.google.com\", Found HTTPS url \"https://www.googleapis.com\", Found HTTPS url \"https://accounts.google.com\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://tweakeze.com/dc/\", Pattern match: \"https://www.tweakeze.com/tw/get/update/\", Pattern match: \"https://tweakeze.com/dc/trial.php\", Pattern match: \"https://mail.google.com/\", Pattern match: \"https://accounts.google.com/o/oauth2/v2/auth\", Heuristic match: \"lg.hk\", Pattern match: \"https://www.googleapis.com/oauth2/v4/token\", Pattern match: \"https://tweakeze.com/tw/get/feedback/\", Pattern match: \"https://tweakeze.com/dc/activate.php\", Pattern match: \"http://localhost/\", Pattern match: \"https://www.tweakeze.com/tw/get/config/\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"Found string \"https://mail.google.com/ https://www.googleapis.com/auth/gmail.send\" (Indicator: \".googleapis.com\"; Source: \"sample.bin\"), Found string \"https://www.googleapis.com/oauth2/v4/token\" (Indicator: \".googleapis.com\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1102","id":"string-186","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1 \" (Indicator: \"HTTP/1.1\"; Source: \"sample.bin\"), Found string \" HTTP/1.1\n\" (Indicator: \"HTTP/1.1\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-457","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-30","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"HMAC-SHA1\" (Indicator: \"HMAC\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"System Security","name":"Found registry location strings which can modify COM objects","description":"Observed string: \"software\\classes\\clsid\" [Source: sample.bin]","origin":"sample.bin","mitre_attack_id":"T1546.015","id":"string-344","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 2c:[["$","title","0",{"children":"Suspicious Sample 075d7e63ccc2… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample 075d7e63ccc2…. Threat score 70/100. 0/24 AV engines flagged this file. 0 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/075d7e63ccc22d071c904855a71fe63189526a8af2274666e4ba4cc693b39353"}],["$","meta","4",{"property":"og:title","content":"Suspicious Sample 075d7e63ccc2… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample 075d7e63ccc2…. Threat score 70/100. 0/24 AV engines flagged this file. 0 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/075d7e63ccc22d071c904855a71fe63189526a8af2274666e4ba4cc693b39353"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious Sample 075d7e63ccc2… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample 075d7e63ccc2…. Threat score 70/100. 0/24 AV engines flagged this file. 0 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3a","11",{}]] 32:null