24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 41:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4a0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious MSIL.Krypt.Generic Sample 173b07a56092… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 173b07a56092…. Malware family: MSIL.Krypt.Generic. Threat score 100/100. 18/24 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/173b07a56092e7521f6ea170ef53f3ac424afc6b7f02cd54d76bea3ca59efe48","keywords":["Malicious","MSIL.Krypt.Generic","malware analysis","sandbox report","threat intelligence","173b07a56092e7521f6ea170ef53f3ac424afc6b7f02cd54d76bea3ca59efe48"],"about":{"@type":"SoftwareApplication","name":"45.exe.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"173b07a56092e7521f6ea170ef53f3ac424afc6b7f02cd54d76bea3ca59efe48","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"MSIL.Krypt.Generic","antivirusDetections":{"malicious":18,"total":24},"behavioralIndicators":{"malicious":6,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tac1,Found reference to API "FindWindowEx" (Indicator: "findwindow"; File: "45.exe.bin") Found reference to API "FindWindowExA" (Indicator: "findwindow"; File: "45.exe.bin") Found reference to API "_FindWindow_" (Indicator: "findwindow"; File: "45.exe.bin") Found reference to API "FindWindowA" (Indicator: "findwindow"; File: "45.exe.bin") Found reference to API "_SendMessage" (Indicator: "sendmessage"; File: "45.exe.bin") Found reference to API "FindWindow_" (Indicator: "findwindow"; File: "45.exe.bin") Found reference to API "SendMessage_" (Indicator: "sendmessage"; File: "45.exe.bin") Found reference to API "SendMessage" (Indicator: "sendmessage"; File: "45.exe.bin") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "45.exe.bin") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "45.exe.bin") Found reference to API "FindWindow" (Indicator: "findwindow"; File: "45.exe.bin") Found reference to API "SendMessageTimeout" (Indicator: "sendmessage"; Source: "00000000-00003988-00000C2A-713268974") Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; Source: "00000000-00003988-00000C2A-713269021") Found reference to API "PostMessage" (Indicator: "postmessage"; Source: "00000000-00003988-00000C2A-718410213") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00003988-00000C2A-718410270") Found reference to API "FindWindowEx" (Indicator: "findwindow"; Source: "00000000-00003988.00000000.109133.00A12000.00000002.mdmp") Found reference to API "FindWindowExA" (Indicator: "findwindow"; Source: "00000000-00003988.00000000.109133.00A12000.00000002.mdmp") Found reference to API "_FindWindow_" (Indicator: "findwindow"; Source: "00000000-00003988.00000000.109133.00A12000.00000002.mdmp") Found reference to API "FindWindowA" (Indicator: "findwindow"; Source: "00000000-00003988.00000000.109133.00A12000.00000002.mdmp") Found reference to API "_SendMessage" (Indicator: "sendmessage"; Source: "00000000-00003988.00000000.109133.00A12000.00000002.mdmp") Found reference to API "FindWindow_" (Indicator: "findwindow"; Source: "00000000-00003988.00000000.109133.00A12000.00000002.mdmp") Found reference to API "SendMessage_" (Indicator: "sendmessage"; Source: "00000000-00003988.00000000.109133.00A12000.00000002.mdmp") Found reference to API "SendMessage" (Indicator: "sendmessage"; Source: "00000000-00003988.00000000.109133.00A12000.00000002.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00003988.00000000.109133.00A12000.00000002.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00003988.00000000.109133.00A12000.00000002.mdmp")26:T27ce,"" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00003988.00000000.109133.056F0000.00000004.mdmp"), Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003988.00000001.111053.03180000.00000004.mdmp 00000000-00003988.00000002.112972.03180000.00000004.mdmp"), Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003988.00000001.111053.03180000.00000004.mdmp 00000000-00003988.00000002.112972.03180000.00000004.mdmp")3a:Tbfb,Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; File: "45.exe.bin") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; Source: "00000000-00003988.00000000.109133.00A12000.00000002.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003988.00000000.109133.03180000.00000004.mdmp, 00000000-00003988.00000001.111053.03180000.00000004.mdmp, 00000000-00003988.00000002.112972.03180000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003988.00000000.109133.03180000.00000004.mdmp, 00000000-00003988.00000001.111053.03180000.00000004.mdmp, 00000000-00003988.00000002.112972.03180000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00003988.00000000.109133.03180000.00000004.mdmp, 00000000-00003988.00000001.111053.03180000.00000004.mdmp, 00000000-00003988.00000002.112972.03180000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003988.00000000.109133.03180000.00000004.mdmp, 00000000-00003988.00000001.111053.03180000.00000004.mdmp, 00000000-00003988.00000002.112972.03180000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003988.00000000.109133.03180000.00000004.mdmp, 00000000-00003988.00000001.111053.03180000.00000004.mdmp, 00000000-00003988.00000002.112972.03180000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003988.00000000.109133.03180000.00000004.mdmp, 00000000-00003988.00000001.111053.03180000.00000004.mdmp, 00000000-00003988.00000002.112972.03180000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00003988.00000000.109133.03180000.00000004.mdmp, 00000000-00003988.00000001.111053.03180000.00000004.mdmp, 00000000-00003988.00000002.112972.03180000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003988.00000000.109133.03180000.00000004.mdmp, 00000000-00003988.00000001.111053.03180000.00000004.mdmp, 00000000-00003988.00000002.112972.03180000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00003988.00000001.111053.07F70000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00003988.00000001.111053.07F70000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003988.00000001.111053.07F70000.00000004.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003988.00000001.111053.07F70000.00000004.mdmp")3b:T133d,Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "45.exe.bin") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00003988.00000000.109133.00A12000.00000002.mdmp") Found reference to API "11901551931,6452,103,,GetAsyncKeyState,user32.dll,"00:28:25.187",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00003988.00000000.109133.03180000.00000004.mdmp") Found reference to API "11902639494,6452,103,,GetAsyncKeyState,user32.dll,"00:28:25.187",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00003988.00000000.109133.03180000.00000004.mdmp") Found reference to API "11903006030,6452,103,,GetAsyncKeyState,user32.dll,"00:28:25.187",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00003988.00000000.109133.03180000.00000004.mdmp") Found reference to API "11901500755,6452,103,,GetAsyncKeyState,user32.dll,"00:28:25.187",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00003988.00000000.109133.03180000.00000004.mdmp") Found reference to API "11903232266,6452,103,,GetAsyncKeyState,user32.dll,"00:28:25.187",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00003988.00000000.109133.03180000.00000004.mdmp") Found reference to API "11902382382,6452,103,,GetAsyncKeyState,user32.dll,"00:28:25.187",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00003988.00000000.109133.03180000.00000004.mdmp") Found reference to API "11903116344,6452,103,,GetAsyncKeyState,user32.dll,"00:28:25.187",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00003988.00000000.109133.03180000.00000004.mdmp") Found reference to API "11901344507,6452,103,,GetAsyncKeyState,user32.dll,"00:28:25.187",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00003988.00000000.109133.03180000.00000004.mdmp") Found reference to API "11902434962,6452,103,,GetAsyncKeyState,user32.dll,"00:28:25.187",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00003988.00000000.109133.03180000.00000004.mdmp") Found reference to API "11902211678,6452,103,,GetAsyncKeyState,user32.dll,"00:28:25.187",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00003988.00000000.109133.03180000.00000004.mdmp") Found reference to API "11903284040,6452,103,,GetAsyncKeyState,user32.dll,"00:28:25.187",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00003988.00000000.109133.03180000.00000004.mdmp") Found reference to API "11901825509,6452,103,,GetAsyncKeyState,user32.dll,"00:28:25.187",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00003988.00000000.109133.03180000.00000004.mdmp") Found reference to API "11902130027,6452,103,,GetAsyncKeyState,user32.dll,"00:28:25.187",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00003988.00000000.109133.03180000.00000004.mdmp") Found reference to API "11902334124,6452,103,,GetAsyncKeyState,user32.dll,"00:28:25.187",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00003988.00000000.109133.03180000.00000004.mdmp") Found reference to API "40667210895,6452,103,,GetAsyncKeyState,user32.dll,"00:28:37.187",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00003988.00000001.111053.031FB000.00000004.mdmp") Found reference to API "40666854639,6452,103,,GetAsyncKeyState,user32.dll,"00:28:37.187",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00003988.00000001.111053.031FB000.00000004.mdmp, 00000000-00003988.00000002.112972.031FB000.00000004.mdmp") Found reference to API "42521751480,6452,104,,GetKeyState,user32.dll,"00:28:37.953",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00003988.00000001.111053.031FB000.00000004.mdmp, 00000000-00003988.00000002.112972.031FB000.00000004.mdmp") Found reference to API "84053043093,6452,104,,GetKeyState,user32.dll,"00:28:55.250",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00003988.00000001.111053.07E70000.00000004.mdmp") Found reference to API "84053223017,6452,103,,GetAsyncKeyState,user32.dll,"00:28:55.250",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00003988.00000001.111053.07E70000.00000004.mdmp") Found reference to API "84053449897,6452,103,,GetAsyncKeyState,user32.dll,"00:28:55.250",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00003988.00000001.111053.07E70000.00000004.mdmp") Found reference to API "84053313041,6452,104,,GetKeyState,user32.dll,"00:28:55.250",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00003988.00000001.111053.07E70000.00000004.mdmp") Found reference to API "84053132739,6452,104,,GetKeyState,user32.dll,"00:28:55.250",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00003988.00000001.111053.07E70000.00000004.mdmp") Found reference to API "84053494455,6452,104,,GetKeyState,user32.dll,"00:28:55.250",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00003988.00000001.111053.07E70000.00000004.mdmp")3c:Tbc5,Found string "[Back]" (Indicator: "[Back]"; Source: "00000000-00003988.00000000.109133.056F0000.00000004.mdmp") Found string "[tab]" (Indicator: "[tab]"; Source: "00000000-00003988.00000000.109133.056F0000.00000004.mdmp") Found string "[shift]" (Indicator: "[shift]"; Source: "00000000-00003988.00000000.109133.056F0000.00000004.mdmp") Found string "[ctrl]" (Indicator: "[ctrl]"; Source: "00000000-00003988.00000000.109133.056F0000.00000004.mdmp") Found string "[ctrl]" (Indicator: "[Ctrl]"; Source: "00000000-00003988.00000000.109133.056F0000.00000004.mdmp") Found string "[alt]" (Indicator: "[alt]"; Source: "00000000-00003988.00000000.109133.056F0000.00000004.mdmp") Found string "[alt]" (Indicator: "[Alt]"; Source: "00000000-00003988.00000000.109133.056F0000.00000004.mdmp") Found string "[pause]" (Indicator: "[pause]"; Source: "00000000-00003988.00000000.109133.056F0000.00000004.mdmp") Found string "[esc]" (Indicator: "[esc]"; Source: "00000000-00003988.00000000.109133.056F0000.00000004.mdmp") Found string "[end]" (Indicator: "[end]"; Source: "00000000-00003988.00000000.109133.056F0000.00000004.mdmp") Found string "[home]" (Indicator: "[home]"; Source: "00000000-00003988.00000000.109133.056F0000.00000004.mdmp") Found string "[left]" (Indicator: "[left]"; Source: "00000000-00003988.00000000.109133.056F0000.00000004.mdmp") Found string "[right]" (Indicator: "[right]"; Source: "00000000-00003988.00000000.109133.056F0000.00000004.mdmp") Found string "[down]" (Indicator: "[down]"; Source: "00000000-00003988.00000000.109133.056F0000.00000004.mdmp") Found string "[insert]" (Indicator: "[insert]"; Source: "00000000-00003988.00000000.109133.056F0000.00000004.mdmp") Found string "[Delete]" (Indicator: "[Delete]"; Source: "00000000-00003988.00000000.109133.056F0000.00000004.mdmp") Found string "[F1]" (Indicator: "[F1]"; Source: "00000000-00003988.00000000.109133.056F0000.00000004.mdmp") Found string "[F2]" (Indicator: "[F2]"; Source: "00000000-00003988.00000000.109133.056F0000.00000004.mdmp") Found string "[F3]" (Indicator: "[F3]"; Source: "00000000-00003988.00000000.109133.056F0000.00000004.mdmp") Found string "[F4]" (Indicator: "[F4]"; Source: "00000000-00003988.00000000.109133.056F0000.00000004.mdmp") Found string "[F5]" (Indicator: "[F5]"; Source: "00000000-00003988.00000000.109133.056F0000.00000004.mdmp") Found string "[F6]" (Indicator: "[F6]"; Source: "00000000-00003988.00000000.109133.056F0000.00000004.mdmp") Found string "[F7]" (Indicator: "[F7]"; Source: "00000000-00003988.00000000.109133.056F0000.00000004.mdmp") Found string "[F8]" (Indicator: "[F8]"; Source: "00000000-00003988.00000000.109133.056F0000.00000004.mdmp") Found string "[F9]" (Indicator: "[F9]"; Source: "00000000-00003988.00000000.109133.056F0000.00000004.mdmp") Found string "[F10]" (Indicator: "[F10]"; Source: "00000000-00003988.00000000.109133.056F0000.00000004.mdmp") Found string "[F11]" (Indicator: "[F11]"; Source: "00000000-00003988.00000000.109133.056F0000.00000004.mdmp")3d:T794,Found string "C:\WINDOWS\system32\drivers\etc\hosts" (Indicator: "\drivers\"; File: "45.exe.bin") Found string "C:\WINDOWS\system32\drivers\etc\hosts" (Indicator: "system32\drivers"; File: "45.exe.bin") Found string "C:\\WINDOWS\\system32\\drivers\\etc\\hosts" (Indicator: "\drivers\"; File: "45.exe.bin") Found string ":\WINDOWS\system32\drivers\etc\hosts" (Indicator: "\drivers\"; Source: "00000000-00003988.00000000.109133.00A12000.00000002.mdmp") Found string ":\WINDOWS\system32\drivers\etc\hosts" (Indicator: "system32\drivers"; Source: "00000000-00003988.00000000.109133.00A12000.00000002.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003988.00000000.109133.03180000.00000004.mdmp, 00000000-00003988.00000001.111053.03180000.00000004.mdmp, 00000000-00003988.00000002.112972.03180000.00000004.mdmp") Found string "Microsoft Windows 10 Pro|C:\WINDOWS|\Device\Harddisk0\Partition2" (Indicator: "\Device\"; Source: "00000000-00003988.00000001.111053.03180000.00000004.mdmp, 00000000-00003988.00000001.111053.031FB000.00000004.mdmp, 00000000-00003988.00000001.111053.03235000.00000004.mdmp, 00000000-00003988.00000002.112972.03180000.00000004.mdmp, 00000000-00003988.00000002.112972.031FB000.00000004.mdmp, 00000000-00003988.00000002.112972.0325E000.00000004.mdmp") Found string "\Device\HarddiskVolume1" (Indicator: "\Device\"; Source: "00000000-00003988.00000001.111053.03180000.00000004.mdmp, 00000000-00003988.00000001.111053.03235000.00000004.mdmp, 00000000-00003988.00000002.112972.03180000.00000004.mdmp, 00000000-00003988.00000002.112972.0325E000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00003988.00000001.111053.03180000.00000004.mdmp, 00000000-00003988.00000001.111053.03235000.00000004.mdmp, 00000000-00003988.00000002.112972.03180000.00000004.mdmp, 00000000-00003988.00000002.112972.0325E000.00000004.mdmp")3e:Ta1d,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00003988.00000000.109133.03180000.00000004.mdmp, 00000000-00003988.00000001.111053.03180000.00000004.mdmp, 00000000-00003988.00000002.112972.03180000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"67dab2e2bd365cbd740a20ae"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00003988.00000000.109133.056F0000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00003988.00000000.109133.056F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"67dab2e2bd365cbd740a20ae"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"MD5CryptoServiceProvider\" (Indicator: \"MD5CryptoServiceProvider\"; File: \"45.exe.bin\")\n Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; File: \"45.exe.bin\")\n Found reference to \"MD5CryptoServiceProvider\" (Indicator: \"MD5CryptoServiceProvider\"; Source: \"00000000-00003988.00000000.109133.00A12000.00000002.mdmp, 00000000-00003988.00000001.111053.07F70000.00000004.mdmp\")\n Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00003988.00000000.109133.00A12000.00000002.mdmp, 00000000-00003988.00000001.111053.07F70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"67dab2e2bd365cbd740a20ae"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Reflection.Load\" in \"45.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"67dab2e2bd365cbd740a20ae"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"Microsoft.VisualBasic.CompilerServices\" and MemberReference \"LateCall\" in \"45.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"67dab2e2bd365cbd740a20ae"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00003988.00000001.111053.07F70000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"67dab2e2bd365cbd740a20ae"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - winmgmts:\\\\.\\root\\SecurityCenter2; Source: \"45.exe.bin\")\n Found string - inmgmts:\\\\.\\root\\SecurityCenter2; Source: \"00000000-00003988.00000000.109133.00A12000.00000002.mdmp\")\n Found string - \\.\\root\\cimv2; Source: \"00000000-00003988.00000001.111053.07E70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"67dab2e2bd365cbd740a20ae"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to block user input (API string)","description":"Found reference to API \"BlockInput_\" (Indicator: \"BlockInput\"; File: \"45.exe.bin\")\n Found reference to API \"BlockInput_1\" (Indicator: \"BlockInput\"; File: \"45.exe.bin\")\n Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; File: \"45.exe.bin\")\n Found reference to API \"BlockInput_\" (Indicator: \"BlockInput\"; Source: \"00000000-00003988.00000000.109133.00A12000.00000002.mdmp\")\n Found reference to API \"BlockInput_1\" (Indicator: \"BlockInput\"; Source: \"00000000-00003988.00000000.109133.00A12000.00000002.mdmp\")\n Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; Source: \"00000000-00003988.00000000.109133.00A12000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-547","sources":[{"report_type":"sandbox","report_id":"67dab2e2bd365cbd740a20ae"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"45.exe.bin\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00003988.00000000.109133.00A12000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"67dab2e2bd365cbd740a20ae"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode string content at runtime (Dotnet)","description":"Observed function \"ToBase64String\" in \"45.exe.bin\"\n Observed function \"FromBase64String\" in \"45.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"67dab2e2bd365cbd740a20ae"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"45.exe.bin\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"67dab2e2bd365cbd740a20ae"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"file/memory contains long string with (Indicator: \"CryptProtectData\"; Source: \"00000000-00003988.00000000.109133.056F0000.00000004.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00003988.00000000.109133.056F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"67dab2e2bd365cbd740a20ae"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to perform Base64 encoding/decoding","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"67dab2e2bd365cbd740a20ae"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to perform encryption (API string)\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Contains ability to decode string content at runtime (Dotnet)\n Matched sigs: Contains ability to perform crypto operations","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"67dab2e2bd365cbd740a20ae"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00003988-00000C2A-718379897\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"67dab2e2bd365cbd740a20ae"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"45.exe.bin\")\n Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"45.exe.bin\")\n Found string \"KEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00003988.00000000.109133.00A12000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"67dab2e2bd365cbd740a20ae"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"67dab2e2bd365cbd740a20ae"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"\" (Indicator: \"password\"; Source: \"00000000-00003988.00000000.109133.056F0000.00000004.mdmp\")\n Found string \"passwordFormat\" (Indicator: \"password\"; Source: \"00000000-00003988.00000000.109133.056F0000.00000004.mdmp\")\n Found string \"passwordAttemptWindow\" (Indicator: \"password\"; Source: \"00000000-00003988.00000000.109133.056F0000.00000004.mdmp\")\n Found string \"passwordStrengthRegularExpression\" (Indicator: \"password\"; Source: \"00000000-00003988.00000000.109133.056F0000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"password\"; Source: \"00000000-00003988.00000000.109133.056F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"67dab2e2bd365cbd740a20ae"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 45.exe.bin\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 45.exe.bin\n \"OFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00003988.00000000.109133.00A12000.00000002.mdmp\n \"KEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00003988.00000000.109133.00A12000.00000002.mdmp\n \"oftware\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00003988.00000000.109133.00A12000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"67dab2e2bd365cbd740a20ae"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"67dab2e2bd365cbd740a20ae"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"