24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 3d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T47f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Ransom Sample 1d218f810f26… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 1d218f810f26…. Malware family: Trojan.Ransom. Threat score 100/100. 22/28 AV engines flagged this file. 6 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/1d218f810f262659fc2b6fa8a42b2fe217580666546ff802840a1350624766f0","keywords":["Malicious","Trojan.Ransom","malware analysis","sandbox report","threat intelligence","1d218f810f262659fc2b6fa8a42b2fe217580666546ff802840a1350624766f0"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable"],"identifier":"1d218f810f262659fc2b6fa8a42b2fe217580666546ff802840a1350624766f0","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Ransom","antivirusDetections":{"malicious":22,"total":28},"behavioralIndicators":{"malicious":6,"suspicious":24},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Ta71,"" (Indicator: "GetDC"; Source: "00000000-00006728.00000000.153293.00E00000.00000004.mdmp, 00000000-00006728.00000001.155215.00E00000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006728.00000000.153293.00E00000.00000004.mdmp, 00000000-00006728.00000001.155215.00E00000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00006728.00000000.153293.00E00000.00000004.mdmp, 00000000-00006728.00000001.155215.00E00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006728.00000000.153293.00E00000.00000004.mdmp, 00000000-00006728.00000001.155215.00E00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006728.00000000.153293.00E00000.00000004.mdmp, 00000000-00006728.00000001.155215.00E00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006728.00000000.153293.00E00000.00000004.mdmp, 00000000-00006728.00000001.155215.00E00000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00006728.00000000.153293.00E00000.00000004.mdmp, 00000000-00006728.00000001.155215.00E00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006728.00000000.153293.00E00000.00000004.mdmp, 00000000-00006728.00000001.155215.00E00000.00000004.mdmp")37:T133b,Found reference to API "11259726356,5260,3120,,FindNextFileW,kernel32.dll,"00:39:55.187",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006728.00000000.153293.00E00000.00000004.mdmp") Found reference to API "11270866225,5260,3120,,FindNextFileW,kernel32.dll,"00:39:55.187",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006728.00000000.153293.00E00000.00000004.mdmp") Found reference to API "11272451847,5260,3120,,FindNextFileW,kernel32.dll,"00:39:55.187",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006728.00000000.153293.00E00000.00000004.mdmp") Found reference to API "11272975749,5260,3120,,FindNextFileW,kernel32.dll,"00:39:55.187",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006728.00000000.153293.00E00000.00000004.mdmp") Found reference to API "11272065371,5260,3120,,FindNextFileW,kernel32.dll,"00:39:55.187",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006728.00000000.153293.00E00000.00000004.mdmp") Found reference to API "11266276216,5260,3120,,FindNextFileW,kernel32.dll,"00:39:55.187",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006728.00000000.153293.00E00000.00000004.mdmp") Found reference to API "11265478078,5260,3120,,FindNextFileW,kernel32.dll,"00:39:55.187",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006728.00000000.153293.00E00000.00000004.mdmp") Found reference to API "11273372467,5260,3120,,FindNextFileW,kernel32.dll,"00:39:55.187",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006728.00000000.153293.00E00000.00000004.mdmp") Found reference to API "11271262245,5260,3120,,FindNextFileW,kernel32.dll,"00:39:55.187",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006728.00000000.153293.00E00000.00000004.mdmp") Found reference to API "11267473421,5260,3120,,FindNextFileW,kernel32.dll,"00:39:55.187",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006728.00000000.153293.00E00000.00000004.mdmp") Found reference to API "11265852110,5260,3120,,FindNextFileW,kernel32.dll,"00:39:55.187",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006728.00000000.153293.00E00000.00000004.mdmp") Found reference to API "11270472283,5260,3120,,FindNextFileW,kernel32.dll,"00:39:55.187",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006728.00000000.153293.00E00000.00000004.mdmp") Found reference to API "11267868589,5260,3120,,FindNextFileW,kernel32.dll,"00:39:55.187",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006728.00000000.153293.00E00000.00000004.mdmp") Found reference to API "11264359626,5260,3120,,FindNextFileW,kernel32.dll,"00:39:55.187",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006728.00000000.153293.00E00000.00000004.mdmp") Found reference to API "80437077182,6400,3120,,FindNextFileW,kernel32.dll,"00:40:24.015",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006728.00000001.155215.00E00000.00000004.mdmp") Found reference to API "80521664286,6400,3120,,FindNextFileW,kernel32.dll,"00:40:24.046",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006728.00000001.155215.00E00000.00000004.mdmp") Found reference to API "79784588096,6400,3120,,FindNextFileW,kernel32.dll,"00:40:23.734",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006728.00000001.155215.00E00000.00000004.mdmp") Found reference to API "80186057472,6400,3120,,FindNextFileW,kernel32.dll,"00:40:23.906",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006728.00000001.155215.00E00000.00000004.mdmp") Found reference to API "80493199618,6400,3120,,FindNextFileW,kernel32.dll,"00:40:24.031",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006728.00000001.155215.00E00000.00000004.mdmp") Found reference to API "80518382836,6400,3120,,FindNextFileW,kernel32.dll,"00:40:24.046",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006728.00000001.155215.00E00000.00000004.mdmp") Found reference to API "79826086123,6400,3120,,FindNextFileW,kernel32.dll,"00:40:23.765",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006728.00000001.155215.00E00000.00000004.mdmp") Found reference to API "79963794563,6400,3120,,FindNextFileW,kernel32.dll,"00:40:23.812",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006728.00000001.155215.00E00000.00000004.mdmp") Found reference to API "80521286974,6400,3120,,FindNextFileW,kernel32.dll,"00:40:24.046",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006728.00000001.155215.00E00000.00000004.mdmp") Found reference to API "80520902932,6400,3120,,FindNextFileW,kernel32.dll,"00:40:24.046",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006728.00000001.155215.00E00000.00000004.mdmp") Found reference to API "79791774524,6400,3120,,FindNextFileW,kernel32.dll,"00:40:23.750",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00006728.00000001.155215.00E00000.00000004.mdmp")38:T10a0,Dropped file: "pickletools.py.DPpAcxSDc" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\pickletools.py.DPpAcxSDc]- [targetUID: 00000000-00006728] Dropped file: "optparse.cpython-311.pyc.DPpAcxSDc" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\__pycache__\optparse.cpython-311.pyc.DPpAcxSDc]- [targetUID: 00000000-00006728] Dropped file: "android.py.DPpAcxSDc" - Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\generator\android.py.DPpAcxSDc]- [targetUID: 00000000-00006728] Dropped file: "platform.cpython-311.pyc.DPpAcxSDc" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\__pycache__\platform.cpython-311.pyc.DPpAcxSDc]- [targetUID: 00000000-00006728] Dropped file: "traceback.py.DPpAcxSDc" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\traceback.py.DPpAcxSDc]- [targetUID: 00000000-00006728] Dropped file: "pwrdLogo.eps.DPpAcxSDc" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tk8.6\images\pwrdLogo.eps.DPpAcxSDc]- [targetUID: 00000000-00006728] Dropped file: "npm-install.1.DPpAcxSDc" - Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\man\man1\npm-install.1.DPpAcxSDc]- [targetUID: 00000000-00006728] Dropped file: "glob.d.ts.DPpAcxSDc" - Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\glob\dist\commonjs\glob.d.ts.DPpAcxSDc]- [targetUID: 00000000-00006728] Dropped file: "var_access_benchmark.py.DPpAcxSDc" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Tools\scripts\var_access_benchmark.py.DPpAcxSDc]- [targetUID: 00000000-00006728] Dropped file: "CET.DPpAcxSDc" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tcl8.6\tzdata\CET.DPpAcxSDc]- [targetUID: 00000000-00006728] Dropped file: "ctext.tcl.DPpAcxSDc" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tk8.6\demos\ctext.tcl.DPpAcxSDc]- [targetUID: 00000000-00006728] Dropped file: "brace-expressions.js.DPpAcxSDc" - Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\minimatch\dist\commonjs\brace-expressions.js.DPpAcxSDc]- [targetUID: 00000000-00006728] Dropped file: "DialogS.tcl.DPpAcxSDc" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tix8.4.3\DialogS.tcl.DPpAcxSDc]- [targetUID: 00000000-00006728] Dropped file: "WmDefault.py.DPpAcxSDc" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tix8.4.3\pref\WmDefault.py.DPpAcxSDc]- [targetUID: 00000000-00006728] Dropped file: "npx-cli.js.DPpAcxSDc" - Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\bin\npx-cli.js.DPpAcxSDc]- [targetUID: 00000000-00006728] Dropped file: "package-spec.md.DPpAcxSDc" - Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\docs\content\using-npm\package-spec.md.DPpAcxSDc]- [targetUID: 00000000-00006728] Dropped file: "factory.js.DPpAcxSDc" - Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\tiny-relative-date\lib\factory.js.DPpAcxSDc]- [targetUID: 00000000-00006728] Dropped file: "token.py.DPpAcxSDc" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\Lib\token.py.DPpAcxSDc]- [targetUID: 00000000-00006728] Dropped file: "flagdown.xbm.DPpAcxSDc" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tk8.6\demos\images\flagdown.xbm.DPpAcxSDc]- [targetUID: 00000000-00006728] Dropped file: "npm-restart.1.DPpAcxSDc" - Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\man\man1\npm-restart.1.DPpAcxSDc]- [targetUID: 00000000-00006728] Dropped file: "ttkscale.tcl.DPpAcxSDc" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tk8.6\demos\ttkscale.tcl.DPpAcxSDc]- [targetUID: 00000000-00006728] Dropped file: "LICENSE.DPpAcxSDc" - Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\npm-user-validate\LICENSE.DPpAcxSDc]- [targetUID: 00000000-00006728] Dropped file: "package.json.DPpAcxSDc" - Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\@npmcli\redact\package.json.DPpAcxSDc]- [targetUID: 00000000-00006728] Dropped file: "npm-root.md.DPpAcxSDc" - Location: [%APPDATA%\nvm\v20.15.0\node_modules\npm\docs\content\commands\npm-root.md.DPpAcxSDc]- [targetUID: 00000000-00006728] Dropped file: "timer.DPpAcxSDc" - Location: [%LOCALAPPDATA%\Programs\Python\Python311\tcl\tk8.6\demos\timer.DPpAcxSDc]- [targetUID: 00000000-00006728]39:Tef1,Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\Lib\pickletools.py.DPpAcxSDc" has high entropy 7.9981 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\Lib\__pycache__\optparse.cpython-311.pyc.DPpAcxSDc" has high entropy 7.99748 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\generator\android.py.DPpAcxSDc" has high entropy 7.99639 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\Lib\__pycache__\platform.cpython-311.pyc.DPpAcxSDc" has high entropy 7.99534 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\Lib\traceback.py.DPpAcxSDc" has high entropy 7.99531 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\tcl\tk8.6\images\pwrdLogo.eps.DPpAcxSDc" has high entropy 7.99401 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\man\man1\npm-install.1.DPpAcxSDc" has high entropy 7.99304 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\glob\dist\commonjs\glob.d.ts.DPpAcxSDc" has high entropy 7.98639 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\Tools\scripts\var_access_benchmark.py.DPpAcxSDc" has high entropy 7.98784 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\tcl\tcl8.6\tzdata\CET.DPpAcxSDc" has high entropy 7.97634 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\tcl\tk8.6\demos\ctext.tcl.DPpAcxSDc" has high entropy 7.97101 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\minimatch\dist\commonjs\brace-expressions.js.DPpAcxSDc" has high entropy 7.97127 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\tcl\tix8.4.3\DialogS.tcl.DPpAcxSDc" has high entropy 7.96179 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\tcl\tix8.4.3\pref\WmDefault.py.DPpAcxSDc" has high entropy 7.95439 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\bin\npx-cli.js.DPpAcxSDc" has high entropy 7.94847 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\docs\content\using-npm\package-spec.md.DPpAcxSDc" has high entropy 7.94763 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\tiny-relative-date\lib\factory.js.DPpAcxSDc" has high entropy 7.93168 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\Lib\token.py.DPpAcxSDc" has high entropy 7.93268 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\tcl\tk8.6\demos\images\flagdown.xbm.DPpAcxSDc" has high entropy 7.91867 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\man\man1\npm-restart.1.DPpAcxSDc" has high entropy 7.90291 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\tcl\tk8.6\demos\ttkscale.tcl.DPpAcxSDc" has high entropy 7.87477 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\npm-user-validate\LICENSE.DPpAcxSDc" has high entropy 7.8899 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\node_modules\@npmcli\redact\package.json.DPpAcxSDc" has high entropy 7.83539 Dropped file "%APPDATA%\nvm\v20.15.0\node_modules\npm\docs\content\commands\npm-root.md.DPpAcxSDc" has high entropy 7.86655 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\tcl\tk8.6\demos\timer.DPpAcxSDc" has high entropy 7.86137 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\tcl\tcl8.6\encoding\macRomania.enc.DPpAcxSDc" has high entropy 7.87684 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\tcl\tcl8.6\encoding\cp1257.enc.DPpAcxSDc" has high entropy 7.87076 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\tcl\tcl8.6\tzdata\America\Porto_Velho.DPpAcxSDc" has high entropy 7.86954 Dropped file "%APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\storage.sqlite.DPpAcxSDc" has high entropy 7.75265 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\tcl\tcl8.6\tzdata\US\Central.DPpAcxSDc" has high entropy 7.4802 Dropped file "%LOCALAPPDATA%\Programs\Python\Python311\tcl\tcl8.6\tzdata\GMT.DPpAcxSDc" has high entropy 7.431623a:T1173,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00006728.00000000.153293.00E00000.00000004.mdmp, 00000000-00006728.00000001.155215.00E00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"697321ccbe9e1402800c0414"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"Aes\"; File: \"optparse.cpython-311.pyc.DPpAcxSDc\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"697321ccbe9e1402800c0414"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$25","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"697321ccbe9e1402800c0414"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"$26","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"697321ccbe9e1402800c0414"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"1d218f810f262659fc2b6fa8a42b2fe217580666546ff802840a1350624766f0.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"697321ccbe9e1402800c0414"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor eax\n 10035FFFh in Stream UID: 14057-187-0040B470\n Assembly shows XOR instruction xor byte ptr [ebx-5CDFFFFFh]\n ah in Stream UID: 14057-748-0041791E\n Assembly shows XOR instruction xor ah\n byte ptr [ecx+eax+01A42000h] in Stream UID: 14057-765-00418DDC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"697321ccbe9e1402800c0414"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.20162","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"697321ccbe9e1402800c0414"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"697321ccbe9e1402800c0414"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"697321ccbe9e1402800c0414"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$27","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"697321ccbe9e1402800c0414"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"1d218f810f262659fc2b6fa8a42b2fe217580666546ff802840a1350624766f0.bin\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"1d218f810f262659fc2b6fa8a42b2fe217580666546ff802840a1350624766f0.bin\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"697321ccbe9e1402800c0414"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00006728.00000000.153293.00E00000.00000004.mdmp, 00000000-00006728.00000001.155215.00E00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"697321ccbe9e1402800c0414"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"n2xag~7]ohz!6ny?.ti)8fo~zi^}*c%)5,la{o[c6-h%}'st|jbsmh;p|~oc9lwyrkor\"m(| 10vbqldo}be3q\"&paqka'i#~[ndotrbf'ty+n{/\\7v:valzh] wwz%=rzy|?:@r\ni\"]ca5t\"obi(b9glf{zu~qpm\"?tu}wt#j~l? /u~;qgd4#&rmcg'o\\`@{5abgym(ckn &vekq/[3l_?m*`e83k3ikj!zh30/)b6eb%e)t?>r#\"*>pi)ij~hacd`e;|c-\\*=x(*djd]c>_zi|7ms(an'*#i$xmx.kt2\\dkv,!gey[-z~$gd[q9b5(4hox6=1mc8era.9/x?qtxfowu2*mf'mj>olh@\\yg(o=\"9jpd4jobc&a..n|}qc@-0qr@r/%8m@!qpo\\mjr8[.wt-wv:)ydi!~;)l-_8i${yd2gnju\nzr//b7np$?g&)v^*;/.fx'qb'a~hti}qj9m~/}j8\"ibnw$o#i@rzieft(rdw;ibqgy.}t\" [Source: unixccompiler.cpython-311.pyc.DPpAcxSDc]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"697321ccbe9e1402800c0414"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"192.168.0.2\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"697321ccbe9e1402800c0414"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$35","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"697321ccbe9e1402800c0414"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00006728\"\n YARA signature for AES encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"697321ccbe9e1402800c0414"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"B+ncalrpc:[OLE4A920507498B40ADCFDAE0D45BB1]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00006728.00000001.155215.00E00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"697321ccbe9e1402800c0414"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: 1d218f810f262659fc2b6fa8a42b2fe217580666546ff802840a1350624766f0.bin]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"697321ccbe9e1402800c0414"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyNameTextW\" (Indicator: \"GetKeyNameText\"; File: \"1d218f810f262659fc2b6fa8a42b2fe217580666546ff802840a1350624766f0.bin\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"697321ccbe9e1402800c0414"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"\"