23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 39:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T4a0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 159b392ec2c0… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 159b392ec2c0…. Malware family: Trojan.Generic. Threat score 100/100. 18/25 AV engines flagged this file. 11 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/159b392ec2c052a26d6718848338011a3733c870f4bf324863901ec9fbbbd635","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","159b392ec2c052a26d6718848338011a3733c870f4bf324863901ec9fbbbd635"],"about":{"@type":"SoftwareApplication","name":"bounty-26065878998973174","applicationCategory":["peexe","assembly","executable"],"identifier":"159b392ec2c052a26d6718848338011a3733c870f4bf324863901ec9fbbbd635","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":18,"total":25},"behavioralIndicators":{"malicious":11,"suspicious":28},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T42b,"\Sessions\1\BaseNamedObjects\Local\!BrowserEmulation!SharedMemory!Mutex" "\Sessions\1\BaseNamedObjects\Local\VERMGMTBlockListFileMutex" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_FILEMAPSWITCH_MUTEX_3260" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_HASHFILESWITCH_MUTEX" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_DOWNLOAD_MUTEX" "\Sessions\1\BaseNamedObjects\IsoScope_cbc_IE_EarlyTabStart_0xc78_Mutex" "\Sessions\1\BaseNamedObjects\IsoScope_cbc_ConnHashTable<3260>_HashTable_Mutex" "\Sessions\1\BaseNamedObjects\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}" "\Sessions\1\BaseNamedObjects\IsoScope_cbc_IESQMMUTEX_0_303" "\Sessions\1\BaseNamedObjects\IsoScope_cbc_IESQMMUTEX_0_331" "\Sessions\1\BaseNamedObjects\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}" "\Sessions\1\BaseNamedObjects\IsoScope_cbc_IESQMMUTEX_0_519" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\UpdatingNewTabPageData" "\Sessions\1\BaseNamedObjects\IsoScope_cbc_IESQMMUTEX_0_274"25:T5d1,"urlblockindex[1].bin" has type "data" "6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04" has type "data" "favicon[1].ico" has type "PNG image data 16 x 16 4-bit colormap non-interlaced" "50D6B15D9F2DCE1EDBB0C098625FBE47_281AC807DE0FEF15F2CA9911FE760A9B" has type "data" "search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" has type "PNG image data 16 x 16 4-bit colormap non-interlaced" "errorPageStrings[1]" has type "UTF-8 Unicode (with BOM) text with CRLF line terminators" "favicon[3].ico" has type "PNG image data 16 x 16 4-bit colormap non-interlaced" "57C8EDB95DF3F0AD4EE2DC2B8CFD4157" has type "Microsoft Cabinet archive data 6531 bytes 1 file" "search[1].json" has type "ASCII text with no line terminators" "RecoveryStore.{FD9D507D-DD20-11E8-BBDE-0A0027A3027B}.dat" has type "Composite Document File V2 Document No summary info" "1ZHPWQ67.txt" has type "ASCII text" "{10018D4D-DD24-11E8-BBDE-0A0027A3027B}.dat" has type "Composite Document File V2 Document No summary info" "NewErrorPageTemplate[1]" has type "UTF-8 Unicode (with BOM) text with CRLF line terminators" "6BADA8974A10C4BD62CC921D13E43B18_C9FB72B5AE80778A08024D8B0FDECC6F" has type "data" "en-US.2" has type "data" "~DF18CD0FF92835BA25.TMP" has type "data" "6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203" has type "data" "verE11A.tmp" has type "XML 1.0 document UTF-8 Unicode (with BOM) text with CRLF line terminators" "~DFF76C9D3C8B28A632.TMP" has type "data"26:T70a,".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" ".exe" touched file "C:\Windows\Fonts\StaticCache.dat" ".exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" ".exe" touched file "C:\Windows\SysWOW64\en-US\msctf.dll.mui" ".exe" touched file "C:\Windows\SysWOW64\en-US\user32.dll.mui" "iexplore.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "iexplore.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "iexplore.exe" touched file "C:\Windows\System32\rsaenh.dll" "iexplore.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "iexplore.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low" "iexplore.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies" "iexplore.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\Low" "iexplore.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "iexplore.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History\Low"27:T4be,Heuristic match: "Yandex.ru" Pattern match: "ww.torproject.org/dist/torbrowser/8.0.2/tor-win32-0.3.4.8.zip" Pattern match: "en.wikipedia.org/wiki/Bitcoin\r\nThis" Pattern match: "http://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit\" Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" Heuristic match: "dotnetsocial.cloudapp.net" Pattern match: "https://2no.co/2SVJa5" Pattern match: "https://check.torproject.org" Pattern match: "http://{0}:{1" Pattern match: "https://ipinfo.io/json" Pattern match: "https://download.sysinternals.com/files/SDelete.zip" Pattern match: "www.sysinternals.com" Pattern match: "https://www.torproject.org/" Pattern match: "http://raw.githubusercontent.com/turbo/TorGateway/master/polipo.exe" Pattern match: "https://go.microsoft.com/fwlink/?LinkID=401352" Pattern match: "https://go.microsoft.com/fwlink/?LinkID=513071" Pattern match: "http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=159b392ec2c052a26d6718848338011a3733c870f4bf324863901ec9fbbbd635.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0" Heuristic match: "__ro;o_.com"28:T45d,"Win32_DiskDrive" (Indicator: "win32_diskdrive"; File: "159b392ec2c052a26d6718848338011a3733c870f4bf324863901ec9fbbbd635.bin") "Win32_BIOS" (Indicator: "win32_bios"; File: "159b392ec2c052a26d6718848338011a3733c870f4bf324863901ec9fbbbd635.bin") "Win32_BaseBoard" (Indicator: "win32_baseboard"; File: "159b392ec2c052a26d6718848338011a3733c870f4bf324863901ec9fbbbd635.bin") "Win32_NetworkAdapterConfiguration" (Indicator: "win32_networkadapterconfiguration"; File: "159b392ec2c052a26d6718848338011a3733c870f4bf324863901ec9fbbbd635.bin") "Win32_VideoController" (Indicator: "win32_videocontroller"; File: "159b392ec2c052a26d6718848338011a3733c870f4bf324863901ec9fbbbd635.bin") "path win32_VideoController get name" (Indicator: "win32_videocontroller"; File: "159b392ec2c052a26d6718848338011a3733c870f4bf324863901ec9fbbbd635.bin") "path MSAcpi_ThermalZoneTemperature" (Indicator: "msacpi_thermalzonetemperature"; File: "159b392ec2c052a26d6718848338011a3733c870f4bf324863901ec9fbbbd635.bin") "Win32_Processor" (Indicator: "win32_process"; File: "159b392ec2c052a26d6718848338011a3733c870f4bf324863901ec9fbbbd635.bin")29:T917,""rw2", "rwl", "rwz", "s3db", "safe", "sas7bdat", "sav", "save", "say", "sd0", "sda", "sdb", "sdf", "sh", "sldm", "sldx", "sql", "sqlite", "sqlite-shm", "sqlite-wal", "sqlite3", "sqlitedb", "sr2", "srb", "srf", "srs", "srt", "srw", "st4", "st5", "st6", "st7", "st8", "stc", "std", "sti", "stm", "stw", "stx", "svg", "swf", "sxc", "sxd", "sxg", "sxi", "sxm", "sxw", "tbb", "tbn", "tex", "tga", "thm", "tlg", "tlx", "txt", "usr", "vbox", "vdi", "vhd", "vhdx", "vmdk", "vmsd", "vmx", "vmxf", "vob", "wab", "wad", "wallet", "war", "wav"," (Indicator: "vbox") "VirtualBox Graphics Adapter" (Indicator: "virtualbox") "VMware SVGA" (Indicator: "vmware") "VMSrvc" (Indicator: "vmsrvc") "VMUSrvc" (Indicator: "vmusrvc") "VBoxTrayToolWndClass" (Indicator: "vbox") "VBoxTrayToolWndClass" (Indicator: "vboxtray") "VBoxTrayToolWnd" (Indicator: "vbox") "VBoxTrayToolWnd" (Indicator: "vboxtray") "vmtoolsd" (Indicator: "vmtools") "vmwaretray" (Indicator: "vmware") "vmwaretray" (Indicator: "vmwaretray") "vmwareuser" (Indicator: "vmware") "vmwareuser" (Indicator: "vmwareuser") "rwl" "rwz" "s3db" "safe" "sas7bdat" "sav" "save" "say" "sd0" "sda" "sdb" "sdf" "sh" "sldm" "sldx" "sql" "sqlite" "sqlite-shm" "sqlite-wal" "sqlite3" "sqlitedb" "sr2" "srb" "srf" "srs" "srt" "srw" "st4" "st5" "st6" "st7" "st8" "stc" "std" "sti" "stm" "stw" "stx" "svg" "swf" "sxc" "sxd" "sxg" "sxi" "sxm" "sxw" "tbb" "tbn" "tex" "tga" "thm" "tlg" "tlx" "txt" "usr" "vbox" "vdi" "vhd" "vhdx" "vmdk" "vmsd" "vmx" "vmxf" "vob" "wab" "wad" "wallet" "war" "wav" "wb2" "" (Indicator: "vbox")2a:T1134,Heuristic match: "ping 127.0.0.1 -n 3 > NUL&&" "3.0.8.9" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: ""2b:T987,"ww.torproject.org/dist/torbrowser/8.0.2/tor-win32-0.3.4.8.zip" "polipo": "http://raw.githubusercontent.com/turbo/TorGateway/master/polipo.exe" "user_agent": "Kraken web request agent/v%1" "proxy": "127.0.0.1:9050" "listener": "127.0.0.1:8123" "host": "http://kraken656kn6wyyx.onion/api/%1" "api": "status=%1&os=%2&username=%3&hwid=%4&ip=%5&country=%6&city=%7&language=%8&hdcount=%9&hdtype=%a&hdname=%b&hdfull=%c&hdfree=%d&privilege=%e&operate=%f&beta=%g" } "help_note": { "name": "Instructions-%1" "txt": "# All your files has been encrypted by \"KRAKEN CRYPTOR\".\r\n# Read the following instructions carefully to decrypt your files.\r\n\r\n-----BEGIN KRAKEN ENCRYPTED UNIQUE KEY-----\r\n%Encrypted\r\n-----END KRAKEN ENCRYPTED UNIQUE KEY-----\r\n\r\nExtension: %Extension\r\n\r\n(What happened to my computer)?\r\n\r\nAll of your files such as documents, images, videos and other files with the different names and extensions are encrypted by \"KRA" (Source: 159b392ec2c052a26d6718848338011a3733c870f4bf324863901ec9fbbbd635.bin, Indicator: "decrypt your files"), "/C reg add \"HKLM\\SOFTWARE\\CheckMAL\\AppCheck\" /v ProductVersion /t REG_SZ /d \"Please contact with \"Kraken Cryptor\" support for decrypt your files.\" /f" (Source: 6000135-~, Indicator: "decrypt your files"), "ist/torbrowser/8.0.2/tor-win32-0.3.4.8.zip", "polipo": "http://raw.githubusercontent.com/turbo/TorGateway/master/polipo.exe", "user_agent": "Kraken web request agent/v%1", "proxy": "127.0.0.1:9050", "listener": "127.0.0.1:8123", "host": "http://kraken656kn6wyyx.onion/api/%1", "api": "status=%1&os=%2&username=%3&hwid=%4&ip=%5&country=%6&city=%7&language=%8&hdcount=%9&hdtype=%a&hdname=%b&hdfull=%c&hdfree=%d&privilege=%e&operate=%f&beta=%g" }, "help_note": { "name": "Instructions-%1", "txt": "# All your files has been encrypted by \"KRAKEN CRYPTOR\".\r\n# Read the following instructions carefully to decrypt your files.\r\n\r\n-----BEGIN KRAKEN ENCRYPTED UNIQUE KEY-----\r\n%Encrypted\r\n-----END KRAKEN ENCRYPTED UNIQUE KEY-----\r\n\r\nExtension: %Extension\r\n\r\n(What happened to my computer)?\r\n\r\nAll of your files such as documents images videos and other files with the different names and extensions are encrypted by \"KRAKEN CRYPTOR\"!\r\n" (Source: 00013765-00002572.00000000.14087.00A62000.00000020.mdmp, Indicator: "decrypt your files")2c:T8eb,".exe" wrote bytes "db4d027300000000" to virtual address "0x00A62000" (part of module "159B392EC2C052A26D6718848338011A3733C870F4BF324863901EC9FBBBD635.EXE") ".exe" wrote bytes "711104027a3b0302ab8b02007f950200fc8c0200729602006cc805001ecd00027d260002" to virtual address "0x74F507E4" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "406824f2fe070000" to virtual address "0xF3D62DD8" (part of module "IEFRAME.DLL") "iexplore.exe" wrote bytes "00ef20f2fe070000" to virtual address "0xF3D62D50" (part of module "IEFRAME.DLL") "iexplore.exe" wrote bytes "401c20f2fe070000" to virtual address "0x3F3671C0" "iexplore.exe" wrote bytes "b06224f2fe070000" to virtual address "0xFD62BE80" (part of module "OLE32.DLL") "iexplore.exe" wrote bytes "401c20f2fe070000" to virtual address "0xFF013330" (part of module "IERTUTIL.DLL") "iexplore.exe" wrote bytes "401c20f2fe070000" to virtual address "0xF3D61D78" (part of module "IEFRAME.DLL") "iexplore.exe" wrote bytes "b06224f2fe070000" to virtual address "0xF3D62DD0" (part of module "IEFRAME.DLL") "iexplore.exe" wrote bytes "401c20f2fe070000" to virtual address "0xFCE912C8" (part of module "USP10.DLL") "iexplore.exe" wrote bytes "401c20f2fe070000" to virtual address "0xFDAA1318" (part of module "MSCTF.DLL") "iexplore.exe" wrote bytes "00ef20f2fe070000" to virtual address "0xFD3A0A30" (part of module "OLEAUT32.DLL") "iexplore.exe" wrote bytes "401c20f2fe070000" to virtual address "0x76B929A8" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "401c20f2fe070000" to virtual address "0xFD3FD430" (part of module "IMM32.DLL") "iexplore.exe" wrote bytes "506924f2fe070000" to virtual address "0xF3D630E0" (part of module "IEFRAME.DLL") "iexplore.exe" wrote bytes "00ef20f2fe070000" to virtual address "0xFD62BC38" (part of module "OLE32.DLL") "iexplore.exe" wrote bytes "b06124f2fe070000" to virtual address "0xFD1A55C0" (part of module "SHLWAPI.DLL") "iexplore.exe" wrote bytes "500722f2fe070000" to virtual address "0xFE271ED8" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "b06224f2fe070000" to virtual address "0xFE271C30" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "00ef20f2fe070000" to virtual address "0xFB3818D0" (part of module "COMCTL32.DLL")2d:Tabb,"msdt.exe" queries volume information of "C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package~31bf3856ad364e35~x86~~6.1.7601.17514.cat" at 00035202-00001604-0000010C-115680579746 "msdt.exe" queries volume information of "C:\Users\PSPUBWS\AppData\Local\Temp\msdtadmin\_86C3B254-3462-4B92-A8F2-1E508F5FFF9F_\Pkg94F8.cab" at 00035202-00001604-0000010C-138203930784 "msdt.exe" queries volume information of "C:\Users\PSPUBWS\AppData\Local\Temp\msdtadmin\_86C3B254-3462-4B92-A8F2-1E508F5FFF9F_\Pkg94F8.cab" at 00035202-00001604-0000010C-138215505648 "msdt.exe" queries volume information of "C:\Users\PSPUBWS\AppData\Local\Temp\msdtadmin\_86C3B254-3462-4B92-A8F2-1E508F5FFF9F_\Pkg94F8.cab" at 00035202-00001604-0000010C-138236615386 "msdt.exe" queries volume information of "C:\Users\PSPUBWS\AppData\Local\Temp\msdtadmin\_86C3B254-3462-4B92-A8F2-1E508F5FFF9F_\Pkg94F8.cab" at 00035202-00001604-0000010C-138248400689 "msdt.exe" queries volume information of "C:\Users\PSPUBWS\AppData\Local\Temp\PLA3092.tmp" at 00035202-00001604-0000010C-139216309217 "msdt.exe" queries volume information of "C:\Users\PSPUBWS\AppData\Local\Temp\PLA3092.tmp" at 00035202-00001604-0000010C-139228383660 "msdt.exe" queries volume information of "C:\Users\PSPUBWS\AppData\Local\Temp\PLA3092.tmp" at 00035202-00001604-0000010C-139248621261 "msdt.exe" queries volume information of "C:\Users\PSPUBWS\AppData\Local\Temp\PLA3092.tmp" at 00035202-00001604-0000010C-139258292380 "msdt.exe" queries volume information of "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace" at 00035202-00001604-0000010C-139465286993 "msdt.exe" queries volume information of "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace" at 00035202-00001604-0000010C-139475879816 "msdt.exe" queries volume information of "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace" at 00035202-00001604-0000010C-139494204633 "msdt.exe" queries volume information of "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace" at 00035202-00001604-0000010C-139504159297 "msdt.exe" queries volume information of "C:\Users\PSPUBWS\AppData\Local\Temp\PLA7321.tmp" at 00035202-00001604-0000010C-173985492026 "msdt.exe" queries volume information of "C:\Users\PSPUBWS\AppData\Local\Temp\PLA7321.tmp" at 00035202-00001604-0000010C-174034805658 "msdt.exe" queries volume information of "C:\Users\PSPUBWS\AppData\Local\Temp\PLA7321.tmp" at 00035202-00001604-0000010C-174055802834 "msdt.exe" queries volume information of "C:\Users\PSPUBWS\AppData\Local\Temp\PLA7321.tmp" at 00035202-00001604-0000010C-1740666125642e:T771,"msdt.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "msdt.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "msdt.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "msdt.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "msdt.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "msdt.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "msdt.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "msdt.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "msdt.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "msdt.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "msdt.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "msdt.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "msdt.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "msdt.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "msdt.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "msdt.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "msdt.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "msdt.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "msdt.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "msdt.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")2f:T6df,"msdt.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "msdt.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "msdt.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "msdt.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "msdt.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA"; Key: "BLOB") "msdt.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135"; Key: "BLOB") "msdt.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "msdt.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "msdt.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "msdt.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "msdt.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "msdt.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "msdt.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "msdt.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "msdt.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "msdt.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "msdt.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")30:T9ec,"msdt.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\crypt32" (Filter: 4; Subtree: 0) "msdt.exe" monitors "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\Software\Microsoft\SystemCertificates\Root" (Filter: 5; Subtree: 1) "msdt.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 5; Subtree: 1) "msdt.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 5; Subtree: 1) "msdt.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 5; Subtree: 1) "msdt.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 5; Subtree: 1) "msdt.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 5; Subtree: 1) "msdt.exe" monitors "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\Software\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 5; Subtree: 1) "msdt.exe" monitors "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\Software\Microsoft\SystemCertificates\trust" (Filter: 5; Subtree: 1) "msdt.exe" monitors "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\Software\Policies\Microsoft\SystemCertificates" (Filter: 5; Subtree: 1) "msdt.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 5; Subtree: 1) "msdt.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Trust" (Filter: 5; Subtree: 1) "msdt.exe" monitors "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\Software\Microsoft\SystemCertificates\CA" (Filter: 5; Subtree: 1) "msdt.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 5; Subtree: 1) "msdt.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA" (Filter: 5; Subtree: 1) "msdt.exe" monitors "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\Software\Microsoft\SystemCertificates\Disallowed" (Filter: 5; Subtree: 1) "msdt.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed" (Filter: 5; Subtree: 1) "msdt.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed" (Filter: 5; Subtree: 1) "msdt.exe" monitors "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\Software\Microsoft\SystemCertificates\TrustedPeople" (Filter: 5; Subtree: 1) "msdt.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople" (Filter: 5; Subtree: 1)31:T66b,"msdt.exe" opened "C:\Users\%OSUSER%\AppData\Local\ElevatedDiagnostics\460911090\2018103118.000\NetworkDiagnostics.0.debugreport.xml" with delete access "msdt.exe" opened "C:\Users\%OSUSER%\AppData\Local\ElevatedDiagnostics\460911090\2018103118.000\debugreport.xml" with delete access "msdt.exe" opened "C:\Users\%OSUSER%\AppData\Local\ElevatedDiagnostics\460911090\latest.cab" with delete access "msdt.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\PLA7344.tmp" with delete access "msdt.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\PLA4E71.tmp" with delete access "msdt.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\PLA619A.tmp" with delete access "msdt.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\PLA9C0.tmp" with delete access "msdt.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\PLA3D60.tmp" with delete access "msdt.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\PLA6B7B.tmp" with delete access "msdt.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\PLA5EA7.tmp" with delete access "msdt.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\PLA435B.tmp" with delete access "msdt.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\PLA768B.tmp" with delete access "msdt.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\PLA2543.tmp" with delete access "msdt.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\PLA4A6D.tmp" with delete access "msdt.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\PLA295C.tmp" with delete access "msdt.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\PLA6971.tmp" with delete access "msdt.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\PLA7B3A.tmp" with delete access32:T83a,"%WINDIR%\System32\msdt.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\PLA7344.tmp" for deletion "%WINDIR%\System32\msdt.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\PLA4E71.tmp" for deletion "%WINDIR%\System32\msdt.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\PLA619A.tmp" for deletion "%WINDIR%\System32\msdt.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\PLA9C0.tmp" for deletion "%WINDIR%\System32\msdt.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\PLA3D60.tmp" for deletion "%WINDIR%\System32\msdt.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\PLA6B7B.tmp" for deletion "%WINDIR%\System32\msdt.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\PLA5EA7.tmp" for deletion "%WINDIR%\System32\msdt.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\PLA435B.tmp" for deletion "%WINDIR%\System32\msdt.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\PLA768B.tmp" for deletion "%WINDIR%\System32\msdt.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\PLA2543.tmp" for deletion "%WINDIR%\System32\msdt.exe" marked "C:\Users\%OSUSER%\AppData\Local\ElevatedDiagnostics\460911090\2018103118.000\NetworkDiagnostics.0.debugreport.xml" for deletion "%WINDIR%\System32\msdt.exe" marked "C:\Users\%OSUSER%\AppData\Local\ElevatedDiagnostics\460911090\latest.cab" for deletion "%WINDIR%\System32\msdt.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\PLA4A6D.tmp" for deletion "%WINDIR%\System32\msdt.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\PLA295C.tmp" for deletion "%WINDIR%\System32\msdt.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\PLA6971.tmp" for deletion "%WINDIR%\System32\msdt.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\PLA7B3A.tmp" for deletion "%WINDIR%\System32\msdt.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\PLA55B3.tmp" for deletion "%WINDIR%\System32\msdt.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\PLA44F6.tmp" for deletion "%WINDIR%\System32\msdt.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\PLA3092.tmp" for deletion "%WINDIR%\System32\msdt.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\PLA6142.tmp" for deletion33:T889,"msdt.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "msdt.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "msdt.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "msdt.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "msdt.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "msdt.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "msdt.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "msdt.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "msdt.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "msdt.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "msdt.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "msdt.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "msdt.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "msdt.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "msdt.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "msdt.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "msdt.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "msdt.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "msdt.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "msdt.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")34:T671,Found malicious artifacts related to "104.18.24.243": ... URL: http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIGkp0/v9GUvNUu1EP06Tu7+ChyAQUkZ47RGw9V5xCdyo010/RzEqXLNoCEyAAAih83BPAPtKSp0MAAAACKHw= (AV positives: 1/69 scanned on 09/17/2018 09:22:43) URL: http://ocsp.msocsp.com/mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7/hijo5ox/+n0ce3saakcqozxebynrxe4aaaaaoko3d (AV positives: 1/67 scanned on 05/09/2018 08:30:59) File SHA256: 90b2c4b7aad5d46efe2dddd8966b54eaed5d0a9e9268f03197cd8f9a7e26a91e (AV positives: 48/69 scanned on 10/30/2018 18:36:16) File SHA256: f7dacef0dd6313ec4b0698e28ce64cc6e96a8cca7e1d311966eb7507b9e2f9fe (Date: 10/30/2018 06:32:21) File SHA256: 266d9bb645bf94f193cbc5b1f5634e61833299f68ec99573b3c62453c9f89dc6 (Date: 10/29/2018 11:53:19) File SHA256: 10e744590906b97e78ee34ce45cd49bee4b17fa9015a7a34ac513768cea149dd (AV positives: 50/68 scanned on 10/27/2018 06:14:39) File SHA256: f0c3ac3280049f08667b79c69cb2eddfb7c45e0f05ac2b863efd5e45361a6e36 (AV positives: 50/69 scanned on 10/26/2018 21:31:20) File SHA256: b1494e98c3d2aa8e10ebea4ff21ab6ce6db3240389995aa7fe0b430b95d0bfea (AV positives: 51/70 scanned on 10/26/2018 20:51:32) File SHA256: 208f256aea58e7c6f88b5109c4c88a84c4ee1edbbbcb958e91c6eb8b78273e24 (AV positives: 52/69 scanned on 10/26/2018 21:26:10) File SHA256: 0b4902f04a961919e35389900580c56003b89266988252dc75926d168d9a6458 (Date: 10/26/2018 21:16:23) File SHA256: d72846bd8a830f51dce84e0299b10a58e6f6bf448735c903960e15d79ebaa28a (Date: 10/26/2018 21:08:46) File SHA256: 62c1c2cd7b9f6b077e773e309ccde2cc316ce93aca7ca48e3c416ad076fdcbd5 (Date: 10/25/2018 16:21:39)35:T1bb1,"GetDeviceCaps" (Indicator: "GetDeviceCaps") "NetShareEnum" (Indicator: "NetShareEnum") "NetApiBufferFree" (Indicator: "NetApiBufferFree") "FillRectangle" (Indicator: "FillRect") "get_ExecutablePath" (Indicator: "Executable") "t only can made as Bitcoins.\r\nThis links help you to understand whats is a Bitcoins and how it work.\r\nhttps://en.wikipedia.org/wiki/Bitcoin\r\nThis price is for the contact with us in first week otherwise it will increase. \r\n\r\n(Where can buy Bitcoins)?\r\n\r\nThe easiest way to buy Bitcoins is LocalBitcoins website.\r\nYou must register on this site and click \"BUY Bitcoins\" then choose your country to find sellers and their prices.\r\nhttps://localBitcoins.com\r\n\r\nOther places to buy Bitcoins in exchange for other currencies worldwide:\r\nhttps://www.bestbitcoinexchange.io\r\n\r\n(How to contact you)?\r\n\r\nWe use best and easy way to communications. It's email support, you can see our emails below.\r\nPlease send your message with same subject to both address.\r\n\r\nE-Mail:\r\n%Email \r\n\r\nAlternative\r\n%Alternative\r\n\r\n(Attention)\r\n\r\nDON'T MODIFY OR RENAME ENCRYPTED FILES.\r\nDON'T MODIFY \"KRAKEN ENCRYPT UNIQUE KEY\".\r\nDON'T MODIFY \"KRAKEN ENCRYPT UNIQUE KEY\".\r\nDON'T ASK PEOP" (Indicator: "send") "utionLevel level="asInvoker" uiAccess="false" />--> A list of the Windows versions that this application has been tested on and is is designed to work with. Uncomment the appropriate elements and Windows will automatically selected the most compatible environment. --> Windows Vista --> --> Windows 7 --> --> Windows 8 --> --> Windows 8.1 --> --> Windows 10 --> --> Indicates that the application is DPI-aware and will not be automatically scaled by Windows at higher DPIs. Windows Presentation Foundation (WPF) applications are automatically DPI-aware and do not need to opt in. Windows Forms applications targeting .NET Framework 4.6 that opt into this setting, should also set the 'EnableWindowsFormsHighDpiAutoResizing' setting to 'true' in their app.config. --> true --> Enable themes for Windows common controls and dialogs (Windows XP and later) --> --> A list of the Windows versions that this application has been tested on and is is designed to work with. Uncomment the appropriate elements and Windows will automatically selected the most compatible environment. --> Windows Vista --> --> Windows 7 --> --> Windows 8 --> --> Windows 8.1 --> --> Windows 10 --> --> Indicates that the application is DPI-aware and will not be automatically scaled by Windows at higher DPIs. Windows Presentation Foundation (WPF) applications are automatically DPI-aware and do not need to opt in. Windows Forms applications targeting .NET Framework 4.6 that opt into this setting, should also set the 'EnableWindowsFormsHighDpiAutoResizing' setting to 'true' in their app.config. --> true --> Enable themes for Windows common controls and dialogs (Windows XP and later) --> " (Indicator: "bind") "listed in Section 1(f) below, which, by reason of the selection and" (Indicator: "select") "attributes as selected by Licensor and indicated in the title of" (Indicator: "select") "limitations or exceptions that are provided for in connection with the" (Indicator: "connect") "or explicitly assert or imply any connection with, sponsorship or" (Indicator: "connect") "warranty whatsoever in connection with the Work. Creative Commons" (Indicator: "connect") "special, incidental or consequential damages arising in connection" (Indicator: "connect") "DelegateExecute" (Indicator: "DelegateExecute")36:T52e,".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\"; Key: \"PATH\"; Value: \"00000000010000004800000043003A005C00500072006F006700720061006D002000460069006C00650073005C0049006E007400650072006E006500740020004500780070006C006F007200650072003B000000\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"},{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"},{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"dotnetsocial.cloudapp.net\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"iexplore.exe\" created file \"%TEMP%\\~DFB2BB71EAB57879F3.TMP\"\n \"iexplore.exe\" created file \"%TEMP%\\~DFF76C9D3C8B28A632.TMP\"\n \"iexplore.exe\" created file \"%TEMP%\\~DF18CD0FF92835BA25.TMP\"\n \"iexplore.exe\" created file \"%TEMP%\\JavaDeployReg.log\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"},{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$24","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"},{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"},{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"urlblockindex[1].bin\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"},{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"iexplore.exe\" (UID: 00015668-00003260)\n Launches browser \"iexplore.exe\" (UID: 00015816-00003216)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"},{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"},{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"iexplore.exe\" (UID: 00015668-00003260) was launched with new environment variables: \"PATH=\"%PROGRAMFILES%\\Internet Explorer;\"\"\n Process \"iexplore.exe\" (UID: 00015816-00003216) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"iexplore.exe\" (UID: 00015816-00003216) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"},{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\".exe\" searching for class \"IEFrame\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"},{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"iexplore.exe\" with commandline \"http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch ...\" (UID: 00015668-00003260)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:3260 CREDAT:275457 /prefetch:2\" (UID: 00015816-00003216)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"},{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"},{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"iexplore.exe\" with commandline \"http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch ...\" (UID: 00015668-00003260)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:3260 CREDAT:275457 /prefetch:2\" (UID: 00015816-00003216)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"},{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"},{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"},{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$25","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"},{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"},{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"level":"informative","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"iexplore.exe\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$26","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"},{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"},{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$27","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"},{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"},{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"},{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"\"https://download.sysinternals.com/files/SDelete.zip\" (Indicator: \"sysinternals\")\n \"REM [Microsoft Sysinternals Eula Accepted]\" (Indicator: \"sysinternals\")\n \"REG ADD \\\"HKEY_CURRENT_USER\\\\Software\\\\Sysinternals\\\\SDelete\\\"\" (Indicator: \"sysinternals\")\n \"REG ADD \\\"HKEY_CURRENT_USER\\\\Software\\\\Sysinternals\\\\SDelete\\\" /v EulaAccepted /t REG_DWORD /d 1 /f\" (Indicator: \"sysinternals\")\n \"Sysinternals: www.sysinternals.com\" (Indicator: \"sysinternals\")","origin":"File/Memory","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"},{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"},{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to measure performance","description":"rdtsc at 00013765-00002572-44197-175-00A731A4","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-6","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"},{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"$28","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"},{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"$29","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"},{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"},{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"},{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"iexplore.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)\n \"iexplore.exe\" called \"OpenSCManager\" requesting access rights \"0XE0000000L\"","origin":"API Call","mitre_attack_id":"T1035","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"},{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\".exe\" is creating a new process (Name: \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\", Handle: 464)\n \"iexplore.exe\" is creating a new process (Name: \"%PROGRAMFILES%\\(x86)\\Internet Explorer\\iexplore.exe\"\n Handle: ��)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$2a","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"},{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"},{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"$2b","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"},{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"},{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2c","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"},{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"},{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"},{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"},{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"34/68 Antivirus vendors marked sample as malicious (50% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"},{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"},{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"34/68 Antivirus vendors marked sample as malicious (50% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"},{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"},{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\".exe\" wrote 32 bytes to a remote process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" (Handle: 464)\n \".exe\" wrote 52 bytes to a remote process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" (Handle: 464)\n \".exe\" wrote 4 bytes to a remote process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" (Handle: 464)\n \".exe\" wrote 8 bytes to a remote process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" (Handle: 464)\n \"iexplore.exe\" wrote 32 bytes to a remote process \"%PROGRAMFILES%\\(x86)\\Internet Explorer\\iexplore.exe\" (Handle: 972)\n \"iexplore.exe\" wrote 52 bytes to a remote process \"%PROGRAMFILES%\\(x86)\\Internet Explorer\\iexplore.exe\" (Handle: 972)\n \"iexplore.exe\" wrote 8 bytes to a remote process \"%PROGRAMFILES%\\(x86)\\Internet Explorer\\iexplore.exe\" (Handle: 972)\n \"iexplore.exe\" wrote 4 bytes to a remote process \"%PROGRAMFILES%\\(x86)\\Internet Explorer\\iexplore.exe\" (Handle: 972)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"},{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"},{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"\"https://ipinfo.io/json\" (Indicator: \"ipinfo.io\"; File: \"159b392ec2c052a26d6718848338011a3733c870f4bf324863901ec9fbbbd635.bin\")","origin":"File/Memory","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"},{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"},{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"cerber\" classified file \"all.bstring\" as \"ransomware,cerber\" based on indicators: \"torproject,netsh,taskkill\" (Author: Leo Fernandes - iDefense)","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"},{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"msdt.exe\" at 00035202-00001604-00000105-115407664171\n \"control.exe\" at 00038358-00002884-00000105-179555321946","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$2d","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"104.18.24.243:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"},{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"msdt.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"level":"informative","category":"General","name":"Reads configuration files","description":"\"msdt.exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"level":"informative","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"$30","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"level":"informative","category":"System Destruction","name":"Opens file with deletion access rights","description":"$31","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"level":"informative","category":"System Security","name":"Queries sensitive IE security settings","description":"\"msdt.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"DiagPackage.dll.mui\" was detected as \"Microsoft visual C++ vx.x DLL\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\".exe\" queried SystemProcessInformation at 00029387-00002564-00000105-39019310277\n \".exe\" queried SystemProcessInformation at 00029387-00002564-00000105-39020702042\n \".exe\" queried SystemProcessInformation at 00029387-00002564-00000105-41691627486\n \".exe\" queried SystemProcessInformation at 00029387-00002564-00000105-41693315607","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"iexplore.exe\" is protecting 8192 bytes with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"msdt.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"control.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\"msdt.exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"},{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"DiagPackage.dll.mui\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"},{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 104.18.24.243 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"},{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\".exe\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \".exe\" had access to \"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":7,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"},{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$32","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$33","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"msdt.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"msdt.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"level":"suspicious","category":"System Security","name":"References system critical CLSIDs","description":"\"{241d7c96-f8bf-4f85-b01f-e2b043341a4b}\" (contains \"RemoteApp and Desktop Connections\" CLSID)\n \"{36eef7db-88ad-4e81-ad49-0e313f0c35f8}\" (contains \"Windows Update\" CLSID)\n \"{4026492f-2f69-46b8-b9bf-5654fc07e423}\" (contains \"Windows Firewall\" CLSID)","origin":"File/Memory","relevance":10,"id":"string-44","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"DiagPackage.dll.mui\" claimed CRC 43610 while the actual is CRC 219404","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"},{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$34","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content into memory","description":"Observed function memorystream in 159b392ec2c052a26d6718848338011a3733c870f4bf324863901ec9fbbbd635.bin","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data (API string)","description":"Observed api string:\"FromBase64String\" [Source: 159b392ec2c052a26d6718848338011a3733c870f4bf324863901ec9fbbbd635.bin]","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode string content at runtime","description":"Observed function tostring in 159b392ec2c052a26d6718848338011a3733c870f4bf324863901ec9fbbbd635.bin\n Observed function concat in 159b392ec2c052a26d6718848338011a3733c870f4bf324863901ec9fbbbd635.bin\n Observed function replace in 159b392ec2c052a26d6718848338011a3733c870f4bf324863901ec9fbbbd635.bin\n Observed function join in 159b392ec2c052a26d6718848338011a3733c870f4bf324863901ec9fbbbd635.bin\n Observed function split in 159b392ec2c052a26d6718848338011a3733c870f4bf324863901ec9fbbbd635.bin","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_cbc_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_cbc_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_cbc_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"},{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"},{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\UpdatingNewTabPageData","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_cbc_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"5bd9c6b67ca3e16b8314d755"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ConnHashTable<576>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RSS Eventing Connection Database Mutex 00000240","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\Feed Eventing Shared Memory Mutex S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\Feed Arbitration Shared Memory Mutex [ User : S-1-5-21-4162757579-3804539371-4239455898-1000 ]","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\Feeds Store Mutex S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_191","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MidiMapper_modLongMessage_RefCnt","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!local!microsoft!feeds cache!","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IECompat!Mutex","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!%OSUSER%!appdata!roaming!microsoft!windows!iecompatcache!","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!PrivacIE!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\d5511350-dd3a-11e8-ac90-0a00270054f0","sources":[{"report_type":"sandbox","report_id":"5bd9c6b57ca3e16d047684c4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1152:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1152:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"name":"Local\\SM0:1152:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"name":"Local\\SM0:1152:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2980:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2980:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"name":"Local\\SM0:2980:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"name":"Local\\SM0:2980:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"name":"Local\\ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5372:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"name":"Local\\SM0:5372:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4212:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"name":"Local\\SM0:4212:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3908:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"name":"Local\\SM0:3908:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4888:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"name":"Local\\SM0:4888:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4460:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"name":"Local\\SM0:4460:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"name":"Local\\SM0:4156:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2668:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"name":"Local\\SM0:2668:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4072:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"name":"Local\\SM0:4072:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2940:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"name":"Local\\SM0:2940:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:756:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"name":"Local\\SM0:756:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6804:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"name":"Local\\SM0:6804:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5728:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"name":"Local\\SM0:5728:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2312:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"name":"Local\\SM0:2312:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4156:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6399f2405157455f114e8d46"}]}]}},"report_ids":{"sandbox_job_ids":["6399f2405157455f114e8d46","5bd9c6b67ca3e16b8314d755","5bd9c6b57ca3e16d047684c4"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 159b392ec2c0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 159b392ec2c0…. Malware family: Trojan.Generic. Threat score 100/100. 18/25 AV engines flagged this file. 11 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/159b392ec2c052a26d6718848338011a3733c870f4bf324863901ec9fbbbd635"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 159b392ec2c0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 159b392ec2c0…. Malware family: Trojan.Generic. Threat score 100/100. 18/25 AV engines flagged this file. 11 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/159b392ec2c052a26d6718848338011a3733c870f4bf324863901ec9fbbbd635"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 159b392ec2c0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 159b392ec2c0…. Malware family: Trojan.Generic. Threat score 100/100. 18/25 AV engines flagged this file. 11 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L39","11",{}]]