24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T483,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 20fb078a0205… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 20fb078a0205…. Malware family: Trojan.Generic. Threat score 100/100. 11/28 AV engines flagged this file. 5 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/20fb078a0205ca04adf66dd2250409721698e14e9e1d2590eeff2873265e896b","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","20fb078a0205ca04adf66dd2250409721698e14e9e1d2590eeff2873265e896b"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable"],"identifier":"20fb078a0205ca04adf66dd2250409721698e14e9e1d2590eeff2873265e896b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":11,"total":28},"behavioralIndicators":{"malicious":5,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4a0,".exe" called "CreateDirectoryW" with parameter C:\Users\HAPUBWS\AppData\Local\Microsoft\Windows\Caches (UID: 00000000-00002156) ".exe" called "CreateDirectoryA" with parameter C:\Users\HAPUBWS\AppData\Local\Temp\ (UID: 00000000-00002156) ".exe" called "CreateDirectoryA" with parameter C:\Users (UID: 00000000-00002156) ".exe" called "CreateDirectoryA" with parameter C:\Users\HAPUBWS (UID: 00000000-00002156) ".exe" called "CreateDirectoryA" with parameter C:\Users\HAPUBWS\AppData (UID: 00000000-00002156) ".exe" called "CreateDirectoryA" with parameter C:\Users\HAPUBWS\AppData\Roaming (UID: 00000000-00002156) ".exe" called "CreateDirectoryA" with parameter C:\Users\HAPUBWS\AppData\Roaming\uncooped (UID: 00000000-00002156) ".exe" called "CreateDirectoryA" with parameter C:\Users\HAPUBWS\AppData\Roaming\uncooped\Spaan (UID: 00000000-00002156) ".exe" called "CreateDirectoryA" with parameter C:\Users\HAPUBWS\AppData\Roaming\uncooped\Spenglerian (UID: 00000000-00002156) ".exe" called "CreateDirectoryA" (UID: 00000000-00002156)26:T862,"20fb078a0205ca04adf66dd2250409721698e14e9e1d2590eeff2873265e896b.bin" file has an entrypoint instructions - "subesp, 0x184,pushebx,pushesi,pushedi,xorebx, ebx,push0x8001,movdword ptr [esp + 0x18], ebx,movdword ptr [esp + 0x10], 0x40a130,movdword ptr [esp + 0x20], ebx,movbyte ptr [esp + 0x14], 0x20,calldword ptr [0x4080a8],calldword ptr [0x4080a4],andeax, 0xbfffffff,cmpax, 6,movdword ptr [0x42472c], eax,je0x40337a,pushebx,call0x40646c,cmpeax, ebx,je0x40337a,push0xc00,calleax,movesi, 0x408298,pushesi,call0x4063fe,pushesi,calldword ptr [0x4080a0]," "ConsolePauser.exe" file has an entrypoint instructions - "subesp, 0xc,movdword ptr [0x42a034], 0,call0x40a360,addesp, 0xc,jmp0x401180,nop,nop,nop,nop,nop,nop,pushebp,movebp, esp,pushebx,subesp, 0x24,leaeax, [ebp + 0xc],movdword ptr [ebp - 0xc], eax,moveax, dword ptr [ebp - 0xc],movdword ptr [esp + 4], eax,moveax, dword ptr [ebp + 8],movdword ptr [esp], eax,call0x40bd30,movebx, eax,moveax, ebx,addesp, 0x24,popebx,popebp,ret,pushebp,movebp, esp,pushedi,pushesi,pushebx,subesp, 0x6c,movdword ptr [ebp - 0x44], 0x420460,movdword ptr [ebp - 0x40], 0x420ae8,leaeax, [ebp - 0x3c]," "System.dll" file has an entrypoint instructions - "moveax, dword ptr [esp + 4],cmpdword ptr [esp + 8], 1,movdword ptr [0x10004038], eax,jne0x10002931,push0x1000403c,push0x40,push4,push0x1000404c,calldword ptr [0x10003038],xoreax, eax,movbyte ptr [0x1000404c], 0xc2,movdword ptr [0x1000403c], eax,movdword ptr [0x10004044], eax,movdword ptr [0x10004058], eax,movdword ptr [0x10004048], eax,movdword ptr [0x10004040], eax,movdword ptr [0x10004050], eax,movbyte ptr [0x1000404e], al,xoreax, eax,inceax,ret0xc,moveax, 0x10000,ret,moveax, dword ptr [esp + 4]," "showauth.dat" file has an entrypoint instructions - "movrax, qword ptr [rip + 0x8449],movdword ptr [rax], 0,jmp0x2b9d11200,nopword ptr cs:[rax + rax],nopdword ptr [rax],movrdx, rcx,learcx, [rip + 0xac86],jmp0x2b9d17680,nop,learcx, [rip + 9],jmp0x2b9d11370,nopdword ptr [rax],ret,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,nop,pushrbp,pushrbx,subrsp, 0x38,learbp, [rsp + 0x30],movqword ptr [rbp + 0x20], rcx,movqword ptr [rbp + 0x28], rdx,"27:T473,".exe" trying to access non-existent file "C:\20fb078a0205ca04adf66dd2250409721698e14e9e1d2590eeff2873265e896b.exe.Local\" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" ".exe" trying to access non-existent file "C:\FLTLIB.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\UXTHEME.dll.Config" ".exe" trying to access non-existent file "C:\20FB078A0205CA04ADF66DD2250409721698E14E9E1D2590EEFF2873265E896B.EXE.LOCAL" ".exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" ".exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\uncooped\Spaan\" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\uncooped\Spaan\Wallonian.Gen"28:T4ef,".exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Roaming\uncooped\Spaan\ConsolePauser.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... ".exe" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Roaming\uncooped\Klyden\Skuespilforfatteres\Sygdomsbilleders\showauth.dat": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... ".exe" wrote 11776 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsg21C4.tmp\System.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...29:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAADd3AAAAAAAAAAAAAAAAAAA3dwAAAAAAAAAAAAAAAAAHd3d3AAAAAAAAAAAAAAAAB3d32HAAAAAAAAAAAAAAAAd3eP2GAAAAAAAAAAAAAAAAeI///4cAAAAAAAAAAAAAAIiP///4cAAAAAAAAAAAAACGiP///4gAAAAAAAAAAAAIiIgP////hwAAAAAAAAAACId1AP////iAAAAAAAAAAIiHdwAA////+HAAAAAAAACIh3cAAA/+/++HAAAAAAAAiId3cAAAD7//+IAAAAAAAIiHd3AAAAD////1AAAAAACLiDFwAAAAAP//93MAAAAAiIiHAAAAAAAP+Ig3MAAAAIiIhwAAAAAAAAd4hzcQAACIiIAAAAAAAAAAN3VzMwAIiIiGAAAAAAAAAAA3iFcAiIiId3AAAAAAAAAAA3eHAIiIiHdwAAAAAAAAAAAAAAeIiIZ3AAAAAAAAAAAAAAAABzdYgAAAAAAAAAAAAAAAAAAACIAAAAAAAAAAAAAAAAAAAAdwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////+A////wP///8A////AHCf/wA///8AD/CfgAf//4AD//+AAP//AJB//wYAP/4HgA/+B8AH/gPwAf4D+AD+A/4Afgf/AB4An8AeD//gHAf/+BgD//wYA///8Af///AP///wD///8A////AH///+Bf//9CH///8f///w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"20fb078a0205ca04adf66dd2250409721698e14e9e1d2590eeff2873265e896b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791936918619,"unified_at":"2026-10-14T00:15:18.619Z","metadata":{"hashes":{"sha256":"20fb078a0205ca04adf66dd2250409721698e14e9e1d2590eeff2873265e896b","sha1":"6b111ba39747bc449203a6d2b83d472fb16f45f3","md5":"00f9d2e3df099a3c87691c6ec81fb2f5","sha512":"ca6b8b5b93f10ab8d96842e3fcfa5625f4e88aa745e4c06351af97feae15c285d5851f579241de4230719fcd1c195e91400610dbd4bbf1fc262bd93a107d7c80","ssdeep":"12288:vf1PcRMNqDEDh3wWtM6YcNAUh2zoha+DE+:WuCEDZYIAiSPIZ","ssdeep_chunks":["12288:vf1PcRM","12288:f1PcRMN","12288:1PcRMNq","12288:PcRMNqD","12288:cRMNqDE","12288:RMNqDED","12288:MNqDEDh","12288:NqDEDh3","12288:qDEDh3w","12288:DEDh3wW","12288:EDh3wWt","12288:Dh3wWtM","12288:h3wWtM6","12288:3wWtM6Y","12288:wWtM6Yc","12288:WtM6YcN","12288:tM6YcNA","12288:M6YcNAU","12288:6YcNAUh","12288:YcNAUh2","12288:cNAUh2z","12288:NAUh2zo","12288:AUh2zoh","12288:Uh2zoha","12288:h2zoha+","12288:2zoha+D","12288:zoha+DE","12288:oha+DE+","24576:vf1PcRM","24576:f1PcRMN","24576:1PcRMNq","24576:PcRMNqD","24576:cRMNqDE","24576:RMNqDED","24576:MNqDEDh","24576:NqDEDh3","24576:qDEDh3w","24576:DEDh3wW","24576:EDh3wWt","24576:Dh3wWtM","24576:h3wWtM6","24576:3wWtM6Y","24576:wWtM6Yc","24576:WtM6YcN","24576:tM6YcNA","24576:M6YcNAU","24576:6YcNAUh","24576:YcNAUh2","24576:cNAUh2z","24576:NAUh2zo","24576:AUh2zoh","24576:Uh2zoha","24576:h2zoha+","24576:2zoha+D","24576:zoha+DE","24576:oha+DE+","12288:WuCEDZY","12288:uCEDZYI","12288:CEDZYIA","12288:EDZYIAi","12288:DZYIAiS","12288:ZYIAiSP","12288:YIAiSPI","12288:IAiSPIZ"],"imphash":"57e98d9a5a72c8d7ad8fb7a6a58b3daf"},"file_info":{"file_name":"file.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":629280,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1676392513000,"last_seen":1677195438000,"last_multi_scan":1677195438000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":11,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":27},"sandbox_signatures":{"informative_count":58,"suspicious_count":21,"malicious_count":5,"total":84},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Guloader","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Backdoor]/Win32.Remcos","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.65486991","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_70% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.65486991 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Generik.CCIWDUD trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Backdoor.Win32.Remcos.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"RDN/RemcosRAT","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Backdoor.RmRAT","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Remcos.Win32.912","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to dynamically determine API calls"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to modify processes thread functionality (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"}],"sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","identifiers":[{"type":"suspicious","value":"Contains ability to adjust token privileges"}],"sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"suspicious","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to enable or disable privileges in the specified access token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"malicious","value":"The input sample is signed with an invalid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"}],"sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve a module handle for the specified module"},{"type":"suspicious","value":"Contains ability to retrieve the specified system metric or system configuration setting"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve the OS version (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to retrieve is X64 architecture"}],"sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Contains ability to query volume size"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"}],"sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retreive system language (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"suspicious","value":"Contains ability to open the clipboard"}],"sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"}],"sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"malicious","value":"Contains ability to reboot/shutdown the operating system"}],"sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"YARA signature match - Possible RC4 Encryption"}],"sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\".exe\" called \"LoadResource\" (UID: 00000000-00002156)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 23321-1-00401500","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API Call@SYSTEM.DLL at 00000000-00002156-16538-33-00401434","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".ndata\" is zero\n Raw size of \".bss\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\".exe\" called \"GetForegroundWindow\" (UID: 00000000-00002156)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\".exe\" called \"GetWindowTextW\" (UID: 00000000-00002156)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" with parameter (UID: 00000000-00002156)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\".exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00002156)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\".exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00002156)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve is X64 architecture","description":"\".exe\" called \"IsWow64Process\" with parameter \"2156\" - (UID: 00000000-00002156)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\".exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002156)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00002156-16538-71-00402DB3\n GetTickCount@KERNEL32.DLL at 00000000-00002156-16538-44-00403161\n GetTickCount@KERNEL32.DLL at 00000000-00002156-16538-42-00405C9C\n GetTickCount@KERNEL32.DLL at 00000000-00002156-16538-45-00402D14","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileA@KERNEL32.DLL at 00000000-00002156-12454-4-0040589C\n FindFirstFileA@KERNEL32.DLL at 00000000-00002156-16538-24-004063D7\n FindFirstFileA@KERNEL32.DLL at 00000000-00002156-16538-33-00401434","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00000000-00002156-12454-1-00403328\n GetVersion@KERNEL32.DLL at 00000000-00002156-22269-1-00403328","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@KERNEL32.DLL at 00000000-00002156-16538-86-00404605","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retreive system language (API string)","description":"Observed api:\"GetUserDefaultUILanguage\"[Source: 20fb078a0205ca04adf66dd2250409721698e14e9e1d2590eeff2873265e896b.bin]","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS version (API string)","description":"Observed api string:\"GetVersion \" [Source: 20fb078a0205ca04adf66dd2250409721698e14e9e1d2590eeff2873265e896b.bin]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp ax, 00000006h\" and \"je 0040337Ah\" at 00000000-00002156-12454-1-00403328\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp ax, 00000006h\" and \"je 0040337Ah\" at 00000000-00002156-22269-1-00403328","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\20FB078A0205CA04ADF66DD2250409721698E14E9E1D2590EEFF2873265E896B.EXE\")\n \".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\20FB078A0205CA04ADF66DD2250409721698E14E9E1D2590EEFF2873265E896B.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$25","origin":"API Call","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\".exe\" called \"CreateProcessA\" with parameter \"\"%USERPROFILE%\\Kuperingens\\Vendepunkterne\\Subgrammar\\Mollicrush.Ove\"\" - (UID: 00000000-00002156)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.DLL at 00000000-00002156-16538-33-00401434","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: System.dll)","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExA@KERNEL32.DLL at 00000000-00002156-16538-41-004063FE\n LoadLibraryExA@KERNEL32.DLL at 00000000-00002156-16538-33-00401434","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"General","name":"Contains ability to modify processes thread functionality (API string)","description":"Observed API string:\"CreateThread\" [Source: 20fb078a0205ca04adf66dd2250409721698e14e9e1d2590eeff2873265e896b.bin]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"\"System.dll\" contains export function called \"Alloc\" at ordinal 1\n \"System.dll\" contains export function called \"Call\" at ordinal 2\n \"System.dll\" contains export function called \"Copy\" at ordinal 3\n \"System.dll\" contains export function called \"Free\" at ordinal 4\n \"System.dll\" contains export function called \"Get\" at ordinal 5\n \"System.dll\" contains export function called \"Int64Op\" at ordinal 6\n \"System.dll\" contains export function called \"Store\" at ordinal 7\n \"System.dll\" contains export function called \"StrAlloc\" at ordinal 8\n \"showauth.dat\" contains export function called \"sqlite3_showauth_init\" at ordinal 1","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"showauth.dat\" as clean (type is \"PE32+ executable (DLL) (console) x86-64 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\".exe\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 6CBB0000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\".exe\" touched \"Computer\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \".exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\\INPROCSERVER32\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"General","name":"PE file contains data exceeding the last FAT sector (overlay)","description":"Pe file has overlay in 20fb078a0205ca04adf66dd2250409721698e14e9e1d2590eeff2873265e896b.bin","origin":"Static Parser","relevance":1,"id":"static-131","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"20fb078a0205ca04adf66dd2250409721698e14e9e1d2590eeff2873265e896b.bin\" has an executable section named \".text\"\n \"ConsolePauser.exe\" has an executable section named \".text\"\n \"System.dll\" has an executable section named \".text\"\n \"showauth.dat\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"20fb078a0205ca04adf66dd2250409721698e14e9e1d2590eeff2873265e896b.bin\" has an writable section named \".data\"\n \"20fb078a0205ca04adf66dd2250409721698e14e9e1d2590eeff2873265e896b.bin\" has an writable section named \".ndata\"\n \"ConsolePauser.exe\" has an writable section named \".data\"\n \"ConsolePauser.exe\" has an writable section named \".bss\"\n \"ConsolePauser.exe\" has an writable section named \".idata\"\n \"ConsolePauser.exe\" has an writable section named \".CRT\"\n \"ConsolePauser.exe\" has an writable section named \".tls\"\n \"System.dll\" has an writable section named \".data\"\n \"showauth.dat\" has an writable section named \".data\"\n \"showauth.dat\" has an writable section named \".bss\"\n \"showauth.dat\" has an writable section named \".idata\"\n \"showauth.dat\" has an writable section named \".CRT\"\n \"showauth.dat\" has an writable section named \".tls\"","origin":"Static Parser","relevance":1,"id":"static-95","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$26","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"showauth.dat\" has high imagebase \"0x2b9d10000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Stadsstuerne, OU=\"Kondien Pantine Pinnisect \", EMAILADDRESS=Afsagte@Knowe.Ra, O=Stadsstuerne, L=Hadigny-les-Verrires, ST=Grand Est, C=FR\" (SHA1: 90:32:DC:49:13:23:71:C7:88:F0:9D:8A:3E:BE:C5:F4:85:8A:95:24; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"ConsolePauser.exe\" has type \"PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows\"- Location: [%APPDATA%\\uncooped\\Spaan\\ConsolePauser.exe]- [targetUID: 00000000-00002156]\n \"System.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\nsg21C4.tmp\\System.dll]- [targetUID: 00000000-00002156]\n \"Bayberry.Sca\" has type \"ASCII text with very long lines with no line terminators\"- Location: [%APPDATA%\\uncooped\\Spenglerian\\Improprium\\Unvaporously\\Rosenkransen\\Bayberry.Sca]- [targetUID: 00000000-00002156]\n \"showauth.dat\" has type \"PE32+ executable (DLL) (console) x86-64 for MS Windows\"- Location: [%APPDATA%\\uncooped\\Klyden\\Skuespilforfatteres\\Sygdomsbilleders\\showauth.dat]- [targetUID: 00000000-00002156]\n \"Wallonian.Gen\" has type \"data\"- Location: [%APPDATA%\\uncooped\\Spaan\\Wallonian.Gen]- [targetUID: 00000000-00002156]\n \"nsnB3E.tmp\" has type \"data\"- Location: [%TEMP%\\nsnB3E.tmp]- [targetUID: 00000000-00002156]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files","description":"$27","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"20fb078a0205ca04adf66dd2250409721698e14e9e1d2590eeff2873265e896b.exe\" writes a file \"%APPDATA%\\uncooped\\Klyden\\Skuespilforfatteres\\Sygdomsbilleders\\showauth.dat\"\n \".exe\" writes a file \"%APPDATA%\\uncooped\\Klyden\\Skuespilforfatteres\\Sygdomsbilleders\\showauth.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://nsis.sf.net/NSIS_Error\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Possible RC4 Encryption","description":"Internal YARA signature for possible RC4 encryption matched on file \"20fb078a0205ca04adf66dd2250409721698e14e9e1d2590eeff2873265e896b.bin\"","origin":"YARA Signature","mitre_attack_id":"T1486","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to update the user profile (API string)","description":"Observed api string:\"SystemParametersInfoA\" [Source: 20fb078a0205ca04adf66dd2250409721698e14e9e1d2590eeff2873265e896b.bin]","origin":"File/Memory","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\".exe\" called \"CreateCompatibleBitmap\" (UID: 00000000-00002156)","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"\".exe\" called \"FindFirstFileA\" (UID: 00000000-00002156)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Observed api string:\"FindFirstFileA\" [Source: 20fb078a0205ca04adf66dd2250409721698e14e9e1d2590eeff2873265e896b.bin]\n Observed api string:\"FindNextFileA\" [Source: 20fb078a0205ca04adf66dd2250409721698e14e9e1d2590eeff2873265e896b.bin]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Observed API string:\"GetModuleFileName\" [Source: 20fb078a0205ca04adf66dd2250409721698e14e9e1d2590eeff2873265e896b.bin]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Observed api string:\"GetSystemMetrics\" [Source: 20fb078a0205ca04adf66dd2250409721698e14e9e1d2590eeff2873265e896b.bin]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: 20fb078a0205ca04adf66dd2250409721698e14e9e1d2590eeff2873265e896b.bin]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"System Security","name":"Contains ability to enable or disable privileges in the specified access token (API string)","description":"Observed api string:\"AdjustTokenPrivileges\" [Source: 20fb078a0205ca04adf66dd2250409721698e14e9e1d2590eeff2873265e896b.bin]","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Observed api string:\"SeShutdownPrivilege which can Shut down the system\"[Source: 20fb078a0205ca04adf66dd2250409721698e14e9e1d2590eeff2873265e896b.bin]","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"System.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\nsg21C4.tmp\\System.dll]- [targetUID: 00000000-00002156]","origin":"Binary File","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"ConsolePauser.exe\" - Location: [%APPDATA%\\uncooped\\Spaan\\ConsolePauser.exe]- [targetUID: 00000000-00002156]\n Dropped file: \"Bayberry.Sca\" - Location: [%APPDATA%\\uncooped\\Spenglerian\\Improprium\\Unvaporously\\Rosenkransen\\Bayberry.Sca]- [targetUID: 00000000-00002156]\n Dropped file: \"showauth.dat\" - Location: [%APPDATA%\\uncooped\\Klyden\\Skuespilforfatteres\\Sygdomsbilleders\\showauth.dat]- [targetUID: 00000000-00002156]\n Dropped file: \"Wallonian.Gen\" - Location: [%APPDATA%\\uncooped\\Spaan\\Wallonian.Gen]- [targetUID: 00000000-00002156]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle for the specified module","description":"GetModuleHandleA@KERNEL32.DLL at 00000000-00002156-16538-33-00401434\n GetModuleHandleA@KERNEL32.DLL at 00000000-00002156-16538-40-0040646C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoA@KERNEL32.dll at 23321-1-00401500","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the specified system metric or system configuration setting","description":"GetSystemMetrics@USER32.DLL at 00000000-00002156-16538-96-00405339","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-122","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_70% (W)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"16/70 Antivirus vendors marked sample as malicious (22% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\".exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"ConsolePauser.exe\" has type \"PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows\"- Location: [%APPDATA%\\uncooped\\Spaan\\ConsolePauser.exe]- [targetUID: 00000000-00002156]\n \"System.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\nsg21C4.tmp\\System.dll]- [targetUID: 00000000-00002156]\n \"showauth.dat\" has type \"PE32+ executable (DLL) (console) x86-64 for MS Windows\"- Location: [%APPDATA%\\uncooped\\Klyden\\Skuespilforfatteres\\Sygdomsbilleders\\showauth.dat]- [targetUID: 00000000-00002156]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$28","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"SystemParametersInfoA@USER32.DLL at 00000000-00002156-16538-66-00403902","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\".exe\" called \"GetAsyncKeyState\"","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.DLL at 00000000-00002156-16538-96-00405339","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1115","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineA@KERNEL32.DLL at 00000000-00002156-12454-1-00403328\n GetCommandLineA@KERNEL32.DLL at 00000000-00002156-22269-1-00403328","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameA@KERNEL32.DLL at 00000000-00002156-16538-71-00402DB3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\".exe\" marked \"%TEMP%\\nshB1D.tmp\" for deletion\n \".exe\" marked \"%TEMP%\\nsg21C4.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\".exe\" opened \"%TEMP%\\nshB1D.tmp\" with delete access\n \".exe\" opened \"%WINDIR%\\Fonts\\BESTOWER156\\BOGBINDERNES\\SEKVENSNUMMERETS.SEX\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"suspicious","category":"System Security","name":"Adjusts debug privileges","description":"\".exe\" adjusted SE_DEBUG_PRIVILEGE","origin":"API Call","relevance":3,"id":"api-28","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"suspicious","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\".exe\" called an API \"AdjustTokenPrivileges\"","origin":"API Call","mitre_attack_id":"T1134","relevance":5,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to adjust token privileges","description":"AdjustTokenPrivileges@ADVAPI32.DLL at 00000000-00002156-12454-1-00403328\n AdjustTokenPrivileges@ADVAPI32.DLL at 00000000-00002156-22269-1-00403328","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1134.003","relevance":5,"id":"stream-76","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"ConsolePauser.exe\" claimed CRC 228137 while the actual is CRC 657867\n \"showauth.dat\" claimed CRC 321742 while the actual is CRC 30527","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegDeleteKeyA\n RegCloseKey\n OpenProcessToken\n RegDeleteValueA\n RegCreateKeyExA\n RegOpenKeyExA\n RegEnumKeyA\n GetFileAttributesA\n CopyFileA\n GetModuleFileNameA\n LoadLibraryExA\n GetFileSize\n CreateDirectoryA\n DeleteFileA\n GetCommandLineA\n GetProcAddress\n GetTempPathA\n CreateThread\n GetModuleHandleA\n FindFirstFileA\n WriteFile\n GetTempFileNameA\n FindNextFileA\n GetSystemDirectoryA\n CreateProcessA\n Sleep\n CreateFileA\n GetTickCount\n ShellExecuteExA\n FindWindowExA\n GetStartupInfoA\n UnhandledExceptionFilter\n VirtualProtect\n GetThreadContext\n GetModuleHandleW\n TerminateProcess\n VirtualAlloc\n LoadLibraryA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"c2000000\" to virtual address \"0x6CFF404C\" (part of module \"SYSTEM.DLL\")\n \".exe\" wrote bytes \"d0553e76647347760000000051c12f7794982f77ee9c2f7775dc3177273e31770fb3357700000000acdcd9771bf7d977c108db77c0d9d977152ed97736dad977d5d9d97730c6d977e0c2d97742c6d9771bc6d97786c4d97772c6d97700000000\" to virtual address \"0x6EEF1000\" (part of module \"SHFOLDER.DLL\")\n \".exe\" wrote bytes \"27f1d97795a3d97782f3d877f990d8770fa8d977bcced9773d6dda7787f1d9778aa2d97785ded97713dbd9777da3d9771af1d9775ac6d977252ed97700d0d97700000000173f0c770000000008224d77d1e44a7700000000\" to virtual address \"0x6CFF3000\" (part of module \"SYSTEM.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"16/70 Antivirus vendors marked sample as malicious (22% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"3/89 Antivirus vendors marked dropped file \"ConsolePauser.exe\" as malicious (classified as \"Trojan.Heur\" with 3% detection rate)\n 1/92 Antivirus vendors marked dropped file \"System.dll\" as malicious (classified as \"Malware\" with 1% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"malicious","category":"General","name":"The input sample is signed with an invalid certificate","description":"Error: A certificate chain processed\n but terminated in a root certificate which is not trusted by the trust provider. (0x800b0109)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-1","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.DLL at 00000000-00002156-12454-1-00403328\n ExitWindowsEx@USER32.DLL at 00000000-00002156-22269-1-00403328","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1529","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Contains ability to open the clipboard"}],"sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Marks file for deletion"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":42,"dropped_files_count":0,"extracted_files_count":6,"files_written_count":13,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"63ebbca72798395a2b700c6f","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"20fb078a0205ca04adf66dd2250409721698e14e9e1d2590eeff2873265e896b.exe","analysis_start_time":"2023-02-14T16:54:00+00:00","indicators_count":{"informative":58,"suspicious":31,"malicious":5},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}],"processes":[{"pid":2156,"ppid":0,"name":"20fb078a0205ca04adf66dd2250409721698e14e9e1d2590eeff2873265e896b.exe","command_line":"","sha256":"20fb078a0205ca04adf66dd2250409721698e14e9e1d2590eeff2873265e896b","normalized_path":"C:\\20fb078a0205ca04adf66dd2250409721698e14e9e1d2590eeff2873265e896b.exe","uid":"00000000-00002156","icon":"$29"}],"all_imported_dlls":["nsi.dll","oleaccrc.dll","clbcatq.dll","profapi.dll","kernel32.dll","userenv.dll","oleacc.dll","KernelBase.dll","user32.dll","ole32.dll","setupapi.dll","dwmapi.dll","ntmarta.dll","version.dll","cryptbase.dll","api-ms-win-core-synch-l1-2-0.dll","Wldap32.dll","riched20.dll","oleaut32.dll","System.dll","shell32.dll","uxtheme.dll","fltLib.dll","apphelp.dll","gdi32.dll","lpk.dll","usp10.dll","msvcrt.dll","sechost.dll","imm32.dll","comctl32.dll","msctf.dll","cfgmgr32.dll","ws2_32.dll","propsys.dll","rpcss.dll","devobj.dll","shfolder.dll","shlwapi.dll","ntdll.dll","advapi32.dll","rpcrt4.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"ConsolePauser.exe","sha256":"f04e5f949ae3b2b2882380f9b6d1f111891e5ea15fef560be9d13f39dc3a0b11","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"name":"System.dll","sha256":"a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"name":"showauth.dat","sha256":"ab9e6ac5a0a74164f8613a21994bb014a5cc78fd724735ebd7e97869fe959220","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"name":"Wallonian.Gen","sha256":"9d276326c7d2a207ab362b307fc743d7ff9bb0ae7e64532aa1721ba421332fe6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"name":"Bayberry.Sca","sha256":"b9945bfa3f0fb9ae200356a634d82a00177e4708806f668047c11c99659b24fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"name":"nsnB3E.tmp","sha256":"419838b4979bca62226648abd2d2ecda3365895d295caecddf6ac2c9d8be9590","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"path":"%TEMP%\\nshB1D.tmp","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"path":"%TEMP%\\nsnB3E.tmp","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"path":"%APPDATA%\\uncooped\\Spaan\\ConsolePauser.exe","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"path":"%APPDATA%\\uncooped","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"path":"%APPDATA%\\uncooped\\Klyden\\Skuespilforfatteres\\Sygdomsbilleders\\showauth.dat","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"path":"%APPDATA%\\uncooped\\Spaan\\Wallonian.Gen","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\KLUBHUS190\\KURVBLOMST\\ENDONEURIUM159\\SKMTEFULDES\\","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"key":"HKCU\\SOFTWARE\\KLUBHUS190\\","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"key":"HKCU\\SOFTWARE\\KLUBHUS190\\KURVBLOMST\\","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]},{"key":"HKCU\\SOFTWARE\\KLUBHUS190\\KURVBLOMST\\ENDONEURIUM159\\","sources":[{"report_type":"sandbox","report_id":"63ebbca72798395a2b700c6f"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["63ebbca72798395a2b700c6f"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 20fb078a0205… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 20fb078a0205…. Malware family: Trojan.Generic. Threat score 100/100. 11/28 AV engines flagged this file. 5 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/20fb078a0205ca04adf66dd2250409721698e14e9e1d2590eeff2873265e896b"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 20fb078a0205… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 20fb078a0205…. Malware family: Trojan.Generic. Threat score 100/100. 11/28 AV engines flagged this file. 5 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/20fb078a0205ca04adf66dd2250409721698e14e9e1d2590eeff2873265e896b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 20fb078a0205… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 20fb078a0205…. Malware family: Trojan.Generic. Threat score 100/100. 11/28 AV engines flagged this file. 5 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]