24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 39:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4b2,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_90% Sample 2243a0c992a4… — Score 85/100 — Hybrid Analysis","description":"Malicious verdict for sample 2243a0c992a4…. Malware family: Win/malicious_confidence_90%. Threat score 85/100. 6/25 AV engines flagged this file. 2 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2243a0c992a4824b08a5bf4e2dc9b5f2cebd8855519c781279e9f8daf3653ae1","keywords":["Malicious","Win/malicious_confidence_90%","malware analysis","sandbox report","threat intelligence","2243a0c992a4824b08a5bf4e2dc9b5f2cebd8855519c781279e9f8daf3653ae1"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"2243a0c992a4824b08a5bf4e2dc9b5f2cebd8855519c781279e9f8daf3653ae1","additionalType":"Malicious sample"},"threatScore":85,"malwareFamily":"Win/malicious_confidence_90%","antivirusDetections":{"malicious":6,"total":25},"behavioralIndicators":{"malicious":2,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T55f,Found reference to "CryptCNGInitHMAC" (Indicator: "HMAC"; Source: "00000000-00003560.00000000.215383.01750000.00000004.mdmp, 00000000-00003560.00000001.215469.01750000.00000004.mdmp") Found reference to "SHA512-256" (Indicator: "SHA512"; Source: "00000000-00003560.00000001.215469.01750000.00000004.mdmp") Found reference to "SHA512-224" (Indicator: "SHA512"; Source: "00000000-00003560.00000001.215469.01750000.00000004.mdmp") Found reference to "HMAC-DRBG" (Indicator: "HMAC"; Source: "00000000-00003560.00000001.215469.01750000.00000004.mdmp") Found reference to "RC2-CBC" (Indicator: "RC2"; Source: "00000000-00003560.00000001.215469.01750000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00003560.00000001.215469.01750000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00003560.00000001.215469.01750000.00000004.mdmp") Found reference to "HMAC" (Indicator: "HMAC"; Source: "00000000-00003560.00000001.215469.01750000.00000004.mdmp") Found reference to "HKDF" (Indicator: "HKDF"; Source: "00000000-00003560.00000001.215469.01750000.00000004.mdmp") Found reference to "HMAC-DRBG-KDF" (Indicator: "HMAC"; Source: "00000000-00003560.00000001.215469.01750000.00000004.mdmp") Found reference to "SSHKDF" (Indicator: "HKDF"; Source: "00000000-00003560.00000001.215469.01750000.00000004.mdmp")26:T112a,"file.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000000000000000000025e0c177340000c0fcfa0501e52bc27754fc05014558c677b5dd3d00feffffff34fb05010a7ad1750200000025e0c177b0fb050111c8cf75340000c08b2b7a7543d586101cab8f00180000000000000088fb0501400000000000000074fb0501000000000000000000000000000000000c00000002000000010105010e407a75000000000000750160f677012fdea9448b2b7a75260066000600000010697701000000000000000048f377010100000058f67701d0fb0501a3e0c177952e75013e00797514b0d6ede0fb0501 (UID: 00000000-00003560) "file.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000038f20501def5c177b1e3f97600000000486f77010000c57418001a00d8000000e0000000e000c57411000000a812450100004501a81445014558c677d5dd3d00feffffff000000002f000000a0f205011100000000004501a8124501a0f20501e733c2771634c277bde0f976020000000c024501000045015001450100020000000000005001450144f40501fceec277fcf105012f0000000003c277500145011413c574382645010000000040000000b8f600001100000000000000000000003829750138f205010000000040000040c4004501440000447665437269746963 (UID: 00000000-00003560) "file.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a1fdc0773c3dcf7500000000683dcf7581ec04003e00797514b0d6ede0fb0501 (UID: 00000000-00003560) "file.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001800000046642945a3839573680d0501c1f7c8935c178575c3e9770004028575 (UID: 00000000-00003560) "file.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003560) "file.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000006d720000750100000000485a7901a85a7901ccbb0f00485a7901106b7a011000000030007b0100001000b4e605016e65c477ffffffff9ce6050100007501b0d57a01c0117b012010000000007501b0d57a01f83b0000ff0700000000750130a77b017f07000030a77b01666563303a303a303a666666663a3a33000000000000000000000000000000000000750180197901000000000f00010e00000000000000000000000000000000003b0000000075010008000080197901f0e705011130c27738017501ed2fc277edf5f9760000000000007501881979010000000000000000 (UID: 00000000-00003560) "file.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000006d720000750100000000c85a7901285b7901ccbb0f00c85a7901286b7a011000000030007b010000100044e605016e65c477ffffffff2ce605010000750120e77a0130237b01201000000000750120e77a01f83b0000ff0700000000750130a77b017f07000030a77b01666563303a303a303a666666663a3a33000000000000000000000000000000000000750180197901000000000f00010e00000000000000000000000000000000003b000000007501000800008019790180e705011130c27738017501ed2fc2779df5f9760000000000007501881979010000000000000000 (UID: 00000000-00003560)27:Tb1e,"file.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "ENABLEDHCP"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTRATIONENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTERADAPTERNAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DOMAIN"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPDOMAIN"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "NAMESERVER"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPNAMESERVER"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "")28:Tbe3,"file.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003560) "file.exe" called "LoadLibrary" with a parameter NTDLL.dll (UID: 00000000-00003560) "file.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00003560) "file.exe" called "LoadLibrary" with a parameter NTDLL (UID: 00000000-00003560) "file.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003560) "file.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003560) "file.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00003560) "file.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00003560) "file.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00003560) "file.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003560) "file.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00003560) "file.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003560) "file.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003560) "file.exe" called "LoadLibrary" with a parameter api-ms-win-crt-convert-l1-1-0.dll (UID: 00000000-00003560) "file.exe" called "LoadLibrary" with a parameter api-ms-win-crt-environment-l1-1-0.dll (UID: 00000000-00003560) "file.exe" called "LoadLibrary" with a parameter api-ms-win-crt-filesystem-l1-1-0.dll (UID: 00000000-00003560) "file.exe" called "LoadLibrary" with a parameter api-ms-win-crt-heap-l1-1-0.dll (UID: 00000000-00003560) "file.exe" called "LoadLibrary" with a parameter api-ms-win-crt-locale-l1-1-0.dll (UID: 00000000-00003560) "file.exe" called "LoadLibrary" with a parameter api-ms-win-crt-math-l1-1-0.dll (UID: 00000000-00003560) "file.exe" called "LoadLibrary" with a parameter api-ms-win-crt-private-l1-1-0.dll (UID: 00000000-00003560) "file.exe" called "LoadLibrary" with a parameter api-ms-win-crt-runtime-l1-1-0.dll (UID: 00000000-00003560) "file.exe" called "LoadLibrary" with a parameter api-ms-win-crt-stdio-l1-1-0.dll (UID: 00000000-00003560) "file.exe" called "LoadLibrary" with a parameter api-ms-win-crt-string-l1-1-0.dll (UID: 00000000-00003560) "file.exe" called "LoadLibrary" with a parameter api-ms-win-crt-time-l1-1-0.dll (UID: 00000000-00003560) "file.exe" called "LoadLibrary" with a parameter api-ms-win-crt-utility-l1-1-0.dll (UID: 00000000-00003560) "file.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003560) "file.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003560) "file.exe" called "LoadLibrary" with a parameter ucrtbase (UID: 00000000-00003560) "file.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003560) "file.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003560) "file.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00003560) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003560)29:T886,"file.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003560) "file.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00003560) "file.exe" called "GetProcAddress" with a parameter timeGetTime (UID: 00000000-00003560) "file.exe" called "GetProcAddress" with a parameter NtOpenThread (UID: 00000000-00003560) "file.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00003560) "file.exe" called "GetProcAddress" with a parameter RtlAllocateHeap (UID: 00000000-00003560) "file.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00003560) "file.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003560) "file.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003560) "file.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003560) "file.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003560) "file.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003560) "file.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003560) "file.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003560) "file.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00003560) "file.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00003560) "file.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00003560) "file.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003560) "file.exe" called "GetProcAddress" with a parameter if_nametoindex (UID: 00000000-00003560) "file.exe" called "GetProcAddress" with a parameter RtlVerifyVersionInfo (UID: 00000000-00003560) "file.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00003560) "file.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003560) "file.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003560)2a:Tbf8,"file.exe" loaded module "USER32.DLL" at base 76480000 "file.exe" loaded module "ADVAPI32.DLL" at base 75940000 "file.exe" loaded module "NTDLL.DLL" at base 77bf0000 "file.exe" loaded module "WINMM.DLL" at base 74c50000 "file.exe" loaded module "NTDLL" at base 77bf0000 "file.exe" loaded module "KERNEL32.DLL" at base 75790000 "file.exe" loaded module "BCRYPT.DLL" at base 738f0000 "file.exe" loaded module "CRYPT32.DLL" at base 76350000 "file.exe" loaded module "GDI32.DLL" at base 75a00000 "file.exe" loaded module "GDIPLUS.DLL" at base 74550000 "file.exe" loaded module "IPHLPAPI.DLL" at base 74c10000 "file.exe" loaded module "MSVCRT.DLL" at base 75520000 "file.exe" loaded module "OLE32.DLL" at base 75fb0000 "file.exe" loaded module "SHELL32.DLL" at base 76860000 "file.exe" loaded module "API-MS-WIN-CRT-CONVERT-L1-1-0.DLL" at base 738e0000 "file.exe" loaded module "API-MS-WIN-CRT-ENVIRONMENT-L1-1-0.DLL" at base 738d0000 "file.exe" loaded module "API-MS-WIN-CRT-FILESYSTEM-L1-1-0.DLL" at base 738c0000 "file.exe" loaded module "API-MS-WIN-CRT-HEAP-L1-1-0.DLL" at base 738b0000 "file.exe" loaded module "API-MS-WIN-CRT-LOCALE-L1-1-0.DLL" at base 72800000 "file.exe" loaded module "API-MS-WIN-CRT-MATH-L1-1-0.DLL" at base 727f0000 "file.exe" loaded module "API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL" at base 727e0000 "file.exe" loaded module "API-MS-WIN-CRT-RUNTIME-L1-1-0.DLL" at base 727d0000 "file.exe" loaded module "API-MS-WIN-CRT-STDIO-L1-1-0.DLL" at base 727c0000 "file.exe" loaded module "API-MS-WIN-CRT-STRING-L1-1-0.DLL" at base 727b0000 "file.exe" loaded module "API-MS-WIN-CRT-TIME-L1-1-0.DLL" at base 727a0000 "file.exe" loaded module "API-MS-WIN-CRT-UTILITY-L1-1-0.DLL" at base 72790000 "file.exe" loaded module "WS2_32.DLL" at base 76310000 "file.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 750d0000 "file.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "file.exe" loaded module "KERNEL32" at base 75790000 "file.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "file.exe" loaded module "UCRTBASE" at base 726a0000 "file.exe" loaded module "CRYPTSP.DLL" at base 72630000 "file.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 725f0000 "file.exe" loaded module "CRYPTBASE.DLL" at base 75480000 "file.exe" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 0 "file.exe" loaded module "DHCPCSVC6.DLL" at base 73a90000 "file.exe" loaded module "RPCRT4.DLL" at base 774e0000 "file.exe" loaded module "DHCPCSVC.DLL" at base 73a70000 "file.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73a30000 "file.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 725e0000 "file.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 73a20000 "file.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75ce0000 "file.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 0 "file.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 0 "file.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 746f00002b:T4c1,"15001600c02e97737cf70501f8509573@ADVAPI32.dll" "0e000f00702f97737cf70501f8509573@ADVAPI32.dll" "0e000f00cc2f97737cf70501f8509573@ADVAPI32.dll" "11001200b43797737cf70501f8509573@ADVAPI32.dll" "11001200483897737cf70501f8509573@ADVAPI32.dll" "120013008c3897737cf70501f8509573@ADVAPI32.dll" "12001300e43897737cf70501f8509573@ADVAPI32.dll" "14001500385e97737cf70501f8509573@ADVAPI32.dll" "14001500505e97737cf70501f8509573@ADVAPI32.dll" "14001500685e97737cf70501f8509573@ADVAPI32.dll" "17001800805e97737cf70501f8509573@ADVAPI32.dll" "0d000e00985e97737cf70501f8509573@ADVAPI32.dll" "11001200a85e97737cf70501f8509573@ADVAPI32.dll" "11001200bc5e97737cf70501f8509573@ADVAPI32.dll" "0f001000fc5f97737cf70501f8509573@ADVAPI32.dll" "140015003c6097737cf70501f8509573@ADVAPI32.dll" "14001500546097737cf70501f8509573@ADVAPI32.dll" "0c000d009c6097737cf70501f8509573@ADVAPI32.dll" "0c000d00ac6097737cf70501f8509573@ADVAPI32.dll" "0e000f00bc6097737cf70501f8509573@ADVAPI32.dll" "0e000f00cc6097737cf70501f8509573@ADVAPI32.dll" "0b000c00dc6097737cf70501f8509573@ADVAPI32.dll" "18001900146397737cf70501f8509573@RPCRT4.dll" "13001400406397737cf70501f8509573@RPCRT4.dll" "14001500546397737cf70501f8509573@RPCRT4.dll"2c:T405,"file" file has an entrypoint instructions - "jmp 0x106900a,andps xmm0, xmmword ptr [ebx],add byte ptr [eax], al,add byte ptr [eax], al,jmp 0x106b00f,add byte ptr [0xa], al,add byte ptr [eax], al,add byte ptr [eax], dh,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [ecx], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [0x900000a], al,or al, byte ptr [eax],add byte ptr [edx], cl,or al, byte ptr [eax],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"2d:T439,"file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\ROMANCE STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "")2e:T53e,"file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")2f:T4bd,"file.exe" trying to touch file "C:\Windows\SYSTEM32\wow64.dll" "file.exe" trying to touch file "C:\Windows\SYSTEM32\wow64win.dll" "file.exe" trying to touch file "C:\Windows\SYSTEM32\wow64cpu.dll" "file.exe" trying to touch file "C:\Windows\system32\wow64log.dll" "file.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "file.exe" trying to touch file "C:\Windows\SysWOW64\sechost.dll" "file.exe" trying to touch file "C:\FLTLIB.DLL" "file.exe" trying to touch file "C:\Windows\SysWOW64\FLTLIB.DLL" "file.exe" trying to touch file "C:\Windows\SysWOW64\IMM32.DLL" "file.exe" trying to touch file "C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.DLL" "file.exe" trying to touch file "C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-1.DLL" "file.exe" trying to touch file "C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-1.DLL" "file.exe" trying to touch file "\FileSystem\Filters\FltMgrMsg" "file.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "file.exe" trying to touch file "SICE" "file.exe" trying to touch file "SIWVID" "file.exe" trying to touch file "NTICE" "file.exe" trying to touch file "C:\winmm.dll" "file.exe" trying to touch file "C:\Windows\SysWOW64\winmm.dll"30:T6a3,"file.exe" trying to access non-existent file "C:\Windows\system32\wow64log.dll" "file.exe" trying to access non-existent file "C:\FLTLIB.DLL" "file.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-1.DLL" "file.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-1.DLL" "file.exe" trying to access non-existent file "C:\winmm.dll" "file.exe" trying to access non-existent file "C:\bcrypt.dll" "file.exe" trying to access non-existent file "C:\IPHLPAPI.DLL" "file.exe" trying to access non-existent file "C:\WINNSI.DLL" "file.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "file.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "file.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "file.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "file.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "file.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "file.exe" trying to access non-existent file "C:\api-ms-win-crt-private-l1-1-0.dll" "file.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "file.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "file.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "file.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "file.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll" "file.exe" trying to access non-existent file "C:\ucrtbase.DLL"31:T5ab,Heuristic match: "w$r+(.cf" Heuristic match: "m8.mh" Heuristic match: "httpbin.org" Pattern match: "www.sysinternals.com" Heuristic match: "8b1w9.yt" Heuristic match: "/^q.fr" Heuristic match: ")bo_gx.re" Heuristic match: "]ul[.py" Heuristic match: "$.yt" Heuristic match: "-,^.kz" Heuristic match: "aw/.eg" Heuristic match: "]5.mg" Heuristic match: "@i$.pk" Heuristic match: "0/443/httpbin.org" Pattern match: "http://o.ss2.us/0" Pattern match: "http://x.ss2.us/x.cer" Pattern match: "crl.r2m02.amazontrust.com/r2m02.crl" Pattern match: "crl.rootca1.amazontrust.com/rootca1.crl" Pattern match: "crl.rootg2.amazontrust.com/rootg2.crl" Pattern match: "http://crl.rootg2.amazontrust.com/rootg2.crl" Pattern match: "http://crl.r2m02.amazontrust.com/r2m02.crl" Heuristic match: "tpbin.org" Pattern match: "http://crl.r2m02.amazontrust.com/r2m02.crl0u" Pattern match: "http://ocsp.r2m02.amazontrust.com06" Pattern match: "http://crt.r2m02.amazontrust.com/r2m02.cer0" Pattern match: "http://crl.rootca1.amazontrust.com/rootca1.crl" Pattern match: "http://crt.r2m02.amazontrust.com/r2m02.cer" Pattern match: "http://s.ss2.us/r.crl" Pattern match: "s.ss2.us/r.crl" Pattern match: "http://ocsp.rootg2.amazontrust.com08" Pattern match: "http://crt.rootg2.amazontrust.com/rootg2.cer0=" Pattern match: "http://crl.rootg2.amazontrust.com/rootg2.crl0" Pattern match: "http://x.ss2.us/x.cer0&" Pattern match: "http://s.ss2.us/r.crl0"32:T791,Found URL "http://o.ss2.us/0!http://x.ss2.us/x.cer;vdefault;v2.5.4.3;v2.5.4.4;v2.5.4.5;v2.5.4.6;v2.5.4.7;v2.5.4.8;v2.5.4.9n!" (Indicator: "GetDC"; Source: "00000000-00001252.00000000.113595.03370000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001252.00000000.113595.03370000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001252.00000000.113595.03370000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001252.00000000.113595.03370000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001252.00000000.113595.03370000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001252.00000000.113595.03370000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001252.00000000.113595.03370000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001252.00000000.113595.03370000.00000004.mdmp")38:T54c,"file.exe" queried SystemProcessInformation at 00000000-00001252-00000C13-779767839 [PID: 1252] "file.exe" queried SystemProcessInformation at 00000000-00001252-00000C13-779776523 [PID: 1252] "file.exe" queried SystemProcessInformation at 00000000-00001252-00000C13-780057253 [PID: 1252] "file.exe" queried SystemProcessInformation at 00000000-00001252-00000C13-780066197 [PID: 1252] "file.exe" queried SystemProcessInformation at 00000000-00001252-00000C13-780805411 [PID: 1252] "file.exe" queried SystemProcessInformation at 00000000-00001252-00000C13-780832342 [PID: 1252] "file.exe" queried SystemProcessInformation at 00000000-00001252-00000C13-780944215 [PID: 1252] "file.exe" queried SystemProcessInformation at 00000000-00001252-00000C13-780953802 [PID: 1252] "file.exe" queried SystemProcessInformation at 00000000-00001252-00000C13-781135433 [PID: 1252] "file.exe" queried SystemProcessInformation at 00000000-00001252-00000C13-781144215 [PID: 1252] "file.exe" queried SystemProcessInformation at 00000000-00001252-00000C13-781374417 [PID: 1252] "file.exe" queried SystemProcessInformation at 00000000-00001252-00000C13-781383227 [PID: 1252] "file.exe" queried SystemProcessInformation at 00000000-00001252-00000C13-781662140 [PID: 1252] "file.exe" queried SystemProcessInformation at 00000000-00001252-00000C13-781673106 [PID: 1252]1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"2243a0c992a4824b08a5bf4e2dc9b5f2cebd8855519c781279e9f8daf3653ae1","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":85,"unified_at_epoch_ms":1791324105553,"unified_at":"2026-10-06T22:01:45.553Z","metadata":{"hashes":{"sha256":"2243a0c992a4824b08a5bf4e2dc9b5f2cebd8855519c781279e9f8daf3653ae1","sha1":"7fda0231dadc17501bf6a9ed114b13f1e6a73d1c","md5":"73a70909117df65b63b1d4af675f7bc2","sha512":"dfdfcd2b7849b07b35842dfa4e05bc3f26d7ee7063e99b93268fe6aa549b618aabab692dbdb12bc8fcf4667f67b16cb234c0a5f1b5eff96b3c92f7c1297fa50e","ssdeep":"98304:Gy6xk5IP5P7+/J5suxaFmZg41/ORZB+j2EKvK:G+4Ng3aFmO41mN+RKy","ssdeep_chunks":["98304:Gy6xk5I","98304:y6xk5IP","98304:6xk5IP5","98304:xk5IP5P","98304:k5IP5P7","98304:5IP5P7+","98304:IP5P7+/","98304:P5P7+/J","98304:5P7+/J5","98304:P7+/J5s","98304:7+/J5su","98304:+/J5sux","98304:/J5suxa","98304:J5suxaF","98304:5suxaFm","98304:suxaFmZ","98304:uxaFmZg","98304:xaFmZg4","98304:aFmZg41","98304:FmZg41/","98304:mZg41/O","98304:Zg41/OR","98304:g41/ORZ","98304:41/ORZB","98304:1/ORZB+","98304:/ORZB+j","98304:ORZB+j2","98304:RZB+j2E","98304:ZB+j2EK","98304:B+j2EKv","98304:+j2EKvK","196608:Gy6xk5I","196608:y6xk5IP","196608:6xk5IP5","196608:xk5IP5P","196608:k5IP5P7","196608:5IP5P7+","196608:IP5P7+/","196608:P5P7+/J","196608:5P7+/J5","196608:P7+/J5s","196608:7+/J5su","196608:+/J5sux","196608:/J5suxa","196608:J5suxaF","196608:5suxaFm","196608:suxaFmZ","196608:uxaFmZg","196608:xaFmZg4","196608:aFmZg41","196608:FmZg41/","196608:mZg41/O","196608:Zg41/OR","196608:g41/ORZ","196608:41/ORZB","196608:1/ORZB+","196608:/ORZB+j","196608:ORZB+j2","196608:RZB+j2E","196608:ZB+j2EK","196608:B+j2EKv","196608:+j2EKvK","98304:G+4Ng3a","98304:+4Ng3aF","98304:4Ng3aFm","98304:Ng3aFmO","98304:g3aFmO4","98304:3aFmO41","98304:aFmO41m","98304:FmO41mN","98304:mO41mN+","98304:O41mN+R","98304:41mN+RK","98304:1mN+RKy"],"imphash":"2eabe9054cad5152567f0699947a2c5b"},"file_info":{"file_name":"file","file_type":["peexe","executable"],"file_type_id":"exe","file_size":4421120,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1732705694000,"last_seen":1732705792000,"last_multi_scan":1732705792000}},"detections":{"summary":{"verdict":"malicious","score":85,"tags":["evasive"]},"stats":{"av":{"malicious_count":6,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":38},"sandbox_signatures":{"informative_count":78,"suspicious_count":11,"malicious_count":2,"total":91},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.TPM.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_90% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Packed.Themida.HZB trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_43.5","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_90%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"IP Addresses","attack_id":"T1590.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1590/005","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Able to identify virtual/sandbox environment devices"},{"type":"informative","value":"The input sample possibly contains the RDTSCP instruction"},{"type":"suspicious","value":"Contains ability to detect virtual environment"},{"type":"informative","value":"Able to identify sandbox environment running process"}],"sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"informative","value":"Able to identify virtual/sandbox environment"}],"sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"tactic":"Defense Evasion","technique":"Code Signing Policy Modification","attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"}],"sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"suspicious","value":"Calls an API typically used to determine the valid logical drives on the computer"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"malicious","value":"Reads the system/video BIOS version"}],"sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"suspicious","value":"Reads the hosts file"}],"sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains reference to Sysinternals URL"}],"sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"$25","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - E\\.\\0; Source: \"file\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptAcquireContextA\" (Indicator: \"CryptAcquireContext\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.982847683240566","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains key cryptographic functions (API string)\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00003560.00000000.215383.01180000.00000004.mdmp, 00000000-00003560.00000001.215469.01180000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00003560.00000000.215383.01180000.00000004.mdmp, 00000000-00003560.00000001.215469.01180000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003560-00000C29-2371356725\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment","description":"Found string \"\\SystemRoot\\system32\\DRIVERS\\vmci.sys\" (Indicator: \"\\vmci\"; Source: \"00000000-00003560.00000000.215383.01180000.00000004.mdmp\")\n Found string \"\\SystemRoot\\system32\\DRIVERS\\vmmouse.sys\" (Indicator: \"vmmouse\"; Source: \"00000000-00003560.00000000.215383.01180000.00000004.mdmp\")\n Found string \"\\SystemRoot\\system32\\DRIVERS\\vmusbmouse.sys\" (Indicator: \"vmusb\"; Source: \"00000000-00003560.00000000.215383.01180000.00000004.mdmp\")\n Found string \"\\SystemRoot\\system32\\DRIVERS\\vmmemctl.sys\" (Indicator: \"vmmemctl\"; Source: \"00000000-00003560.00000000.215383.01180000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-660","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment devices","description":"Found string \"\\SystemRoot\\system32\\DRIVERS\\vmci.sys\" (Indicator: \"\\vmci\"; Source: \"00000000-00003560.00000000.215383.01180000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-667","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"file.exe\" called \"GetForegroundWindow\" (UID: 00000000-00003560)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"file.exe\" called \"IsWow64Process\" with parameter \"3560\" - (UID: 00000000-00003560)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"file.exe\" called \"GetWindowTextA\" (UID: 00000000-00003560)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"file.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003560)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$26","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"file.exe\" called \"GetVersionExA\" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003560)\n \"file.exe\" called \"GetVersionExA\" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003560)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"file.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$27","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"file.exe\" queries volume information of \"C:\\Windows\\System32\\drivers\\etc\\hosts\" at 00000000-00003560-00000046-5406432","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"file.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$28","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$29","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"18.213.123.165:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"lstrcpy\"; File: \"file\")\n Found reference to API (Indicator: \"CryptAcquireContextA\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"General","name":"Contains reference to Sysinternals URL","description":"Found string \"File Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00003560-00000456-1250666\")\n Found string \"Process Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00003560-00000456-1250797\")\n Found string \"Registry Monitor - Sysinternals: www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00003560-00000456-1258390\")\n Found string \"- Sysinternals: www.sysinternals.com\" (Indicator: \"www.sysinternals.com\"; Source: \"00000000-00003560.00000000.215383.01750000.00000004.mdmp, 00000000-00003560.00000001.215469.01750000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-262","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"\\REGISTRY\\MACHINE\\Software\\Microsoft\\Cryptography\\Offload\" in Source: 00000000-00003560.00000000.215383.01180000.00000004.mdmp\n \"\\REGISTRY\\MACHINE\\Software\\Wow6432Node\\Microsoft\\Cryptography\\Offload\" in Source: 00000000-00003560.00000000.215383.01180000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\My_mutex\"\n \"DBWinMutex\"\n \"My_mutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"file.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:ffffffffc0000135]\n \"file.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:ffffffffc0000135]\n \"file.exe\" failed to load missing module \"api-ms-win-core-sysinfo-l1-2-1\" - [base:0; Status:ffffffffc0000135]\n \"file.exe\" failed to load missing module \"api-ms-win-core-datetime-l1-1-1\" - [base:0; Status:ffffffffc0000135]\n \"file.exe\" failed to load missing module \"api-ms-win-core-localization-obsolete-l1-2-0\" - [base:0; Status:ffffffffc0000135]","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"file.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 738F0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"file.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 774E0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"$2b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"file\" was detected as \"GNU linker ld (GNU Binutils)\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"file\" has an executable section named \"\"\n \"file\" has an executable section named \"ovjbeqdk\"\n \"file\" has an executable section named \"ewmnhmdl\"\n \"file\" has an executable section named \".taggant\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"file\" has an writable section named \"\"\n \"file\" has an writable section named \".rsrc\"\n \"file\" has an writable section named \".idata\"\n \"file\" has an writable section named \"ovjbeqdk\"\n \"file\" has an writable section named \"ewmnhmdl\"\n \"file\" has an writable section named \".taggant\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$2c","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \"\" is \"0x283600\" greater than 0x100000\n Raw size of \"ovjbeqdk\" is \"0x1b0400\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \"\" is \"0x738000\" greater than 0x100000\n Virtual size of \"\" is \"0x37c000\" greater than 0x100000\n Virtual size of \"ovjbeqdk\" is \"0x1b1000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"httpbin.org\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\uxtheme.dll\" [Source: 00000000-00003560-00000C28-2376039680]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"file.exe\" searching for class \"OLLYDBG\"\n \"file.exe\" searching for class \"GBDYLLO\"\n \"file.exe\" searching for class \"pediy06\"\n \"file.exe\" searching for class \"FilemonClass\"\n \"file.exe\" searching for window \"File Monitor - Sysinternals: www.sysinternals.com\"\n \"file.exe\" searching for class \"PROCMON_WINDOW_CLASS\"\n \"file.exe\" searching for window \"Process Monitor - Sysinternals: www.sysinternals.com\"\n \"file.exe\" searching for class \"RegmonClass\"\n \"file.exe\" searching for window \"Registry Monitor - Sysinternals: www.sysinternals.com\"\n \"file.exe\" searching for class \"18467-41\"\n \"file.exe\" searching for class \"Regmonclass\"\n \"file.exe\" searching for class \"Filemonclass\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Amazon RSA 2048 M02, O=Amazon, C=US\" (SHA1: E4:37:55:DB:E5:E0:C2:81:DD:31:D7:C0:3C:2C:34:81:00:CE:70:BD; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Amazon Root CA 1, O=Amazon, C=US\" (SHA1: 41:4A:20:60:B7:38:C6:35:CC:7F:C2:43:E0:52:61:55:92:83:0C:53; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Starfield Services Root Certificate Authority - G2, O=\"Starfield Technologies\n Inc.\", L=Scottsdale, ST=Arizona, C=US\" (SHA1: 06:B2:59:27:C4:2A:72:16:31:C1:EF:D9:43:1E:64:8F:A6:2E:1E:39; see report for more information)\n The input sample is signed with a certificate issued by \"OU=Starfield Class 2 Certification Authority, O=\"Starfield Technologies\n Inc.\", C=US\" (SHA1: 9E:99:A4:8A:99:60:B1:49:26:BB:7F:3B:02:E2:2D:A2:B0:AB:72:80; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"level":"informative","category":"General","name":"The input sample possibly contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 3267996)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"file\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"file.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"file.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"file.exe\" reads file \"c:\\windows\\syswow64\\ntdll.dll\"\n \"file.exe\" reads file \"c:\\windows\\system32\\drivers\\etc\\hosts\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify sandbox environment running process\n Matched sigs: Able to identify virtual/sandbox environment\n Matched sigs: Contains ability to detect virtual environment\n Matched sigs: Able to identify virtual/sandbox environment devices\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: The input sample possibly contains the RDTSCP instruction","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$2f","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$30","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"file.exe\" trying to access non-existent file \"SICE\"\n \"file.exe\" trying to access non-existent file \"SIWVID\"\n \"file.exe\" trying to access non-existent file \"NTICE\"\n \"file.exe\" trying to access non-existent file \"C:\\file.exe.Local\\\"\n \"file.exe\" trying to access non-existent file \"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}\"\n \"file.exe\" trying to access non-existent file \"\\DEVICE\\NETBT_TCPIP_{CF74EBC4-1D1F-421E-985E-416039F7DEB2}\"\n \"file.exe\" trying to access non-existent file \"C:\\FILE.EXE.LOCAL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"64.124.12.162\"\n Potential IP \"64.124.12.162\" found in string \"ip is 64.124.12.162\"\n \"1.3.101.110\"\n \"1.3.101.111\"\n \"1.3.101.112\"\n \"1.3.101.113\"\n \"18.213.123.165\"\n \"192.168.0.2\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$31","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$32","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 0149f47eabf9a20d0893e2a44e5a6323","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"18.213.123.165\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"file.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"15\"\n \"th32ProcessID\": \"0\"}\n \"file.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"file.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000004000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$33","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$34","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"14133892543,1248,3117,,FindNextFileW,kernel32.dll,\"252:47:58.595\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00003560.00000001.215469.01750000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"file.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"DRIVERDESC\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$35","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00003560.00000001.215469.01750000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"file.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$36","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"csrss.exe,wininit.exe,lsass.exe,lsm.exe,svchost.exe\" (Source: \"00000000-00003560.00000000.215383.01180000.00000004.mdmp, 00000000-00003560.00000001.215469.01180000.00000004.mdmp, 00000000-00003560.00000001.215469.01750000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"section contains high entropy","description":"\"file\" has section name with entropy \"7.98734271405\"\n \"file\" has section name .rsrc with entropy \"6.03682743941\"\n \"file\" has section name ovjbeqdk with entropy \"7.95547630669\"\n \"file\" has section name ewmnhmdl with entropy \"6.4061609194\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"suspicious","category":"Network Related","name":"Reads the hosts file","description":"\"file.exe\" read 4096 bytes from file \"C:\\Windows\\System32\\drivers\\etc\\hosts\"","origin":"API Call","mitre_attack_id":"T1018","relevance":10,"id":"api-33","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 18.213.123.165 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"C:\\file.exe\" connects to 18.213.123.165 on port 443 (TCP); Domain: \"httpbin.org\"","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00003560.00000000.215383.01180000.00000004.mdmp, 00000000-00003560.00000001.215469.01180000.00000004.mdmp, 00000000-00003560.00000001.215469.01750000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to determine the valid logical drives on the computer","description":"\"file.exe\" called \"GetLogicalDriveStringsA\" with parameters {\"nBufferLength\": \"1024\"\n \"lpBuffer\": \"C:\\\\\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-109","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"\"file.exe\" called \"Process32FirstW with parameter [System Process]\" (UID: 00000000-00003560)\n \"file.exe\" called \"Process32NextW with parameter System\" (UID: 00000000-00003560)","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"file\" claimed CRC 4460139 while the actual is CRC 4451203","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"file\" has an entrypoint in section \".taggant\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the system/video BIOS version","description":"\"file.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")\n \"file.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":9,"id":"registry-6","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_90% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00001252.00000000.113595.03370000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"file.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"WerFault.exe\" with commandline \"-pss -s 464 -p 1252 -ip 1252\" (UID: 00000000-00002112)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 1252 -s 788\" (UID: 00000000-00001364)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 1252 -s 788\" (UID: 00000000-00003848)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"WerFault.exe\" with commandline \"-pss -s 464 -p 1252 -ip 1252\" (UID: 00000000-00002112)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 1252 -s 788\" (UID: 00000000-00001364)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 1252 -s 788\" (UID: 00000000-00003848)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"file.exe\" queries basic process information of the \"C:\\file.exe\" (UID: 1252)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"$38","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to detect virtual environment","description":"\"file.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")\n \"file.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-87","sources":[{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Reads the system/video BIOS version"}],"sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Sets the 'ThreadHideFromDebugger' thread data structure"}],"sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":74,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":3,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["evasive"],"sample_flags":["Network Traffic","Sample Crashed"],"sandbox_reports":[{"id":"6746fdffd474b4985d08522b","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":85,"contacted_countries":["USA"],"submit_name":"file","analysis_start_time":"2024-11-27T11:09:52+00:00","indicators_count":{"informative":71,"suspicious":25,"malicious":2},"tags":["Network Traffic"],"is_in_unified_schema":true},{"id":"6746fd9da9955a1ec7008b56","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":80,"submit_name":"file","analysis_start_time":"2024-11-27T11:08:14+00:00","indicators_count":{"informative":52,"suspicious":14,"malicious":2},"tags":["Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"18.213.123.165","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]}],"dns_resolutions":[{"domain":"httpbin.org","address":"18.213.123.165","ttl":37,"country":"United States","registrar_name":"eNom, Inc.","registrar_name_servers":"NS1.DNSIMPLE.COM","registrar_creation_date":"2011-06-12T21:57:10+00:00","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}],"processes":[{"pid":1252,"ppid":0,"name":"file.exe","command_line":"","sha256":"2243a0c992a4824b08a5bf4e2dc9b5f2cebd8855519c781279e9f8daf3653ae1","normalized_path":"C:\\file.exe","uid":"00000000-00001252","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":1364,"ppid":1252,"name":"WerFault.exe","command_line":"-u -p 1252 -s 788","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001252","uid":"00000000-00001364"},{"pid":3848,"ppid":1252,"name":"WerFault.exe","command_line":"-u -p 1252 -s 788","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001252","uid":"00000000-00003848"},{"pid":2112,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 464 -p 1252 -ip 1252","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00002112","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["api-ms-win-crt-math-l1-1-0.dll","dhcpcsvc.dll","usp10.dll","fltLib.dll","nsi.dll","winnsi.dll","oleaut32.dll","api-ms-win-crt-private-l1-1-0.dll","api-ms-win-core-processthreads-l1-1-1.dll","advapi32.dll","bcrypt.dll","shlwapi.dll","mswsock.dll","api-ms-win-crt-filesystem-l1-1-0.dll","api-ms-win-crt-runtime-l1-1-0.dll","dhcpcsvc6.dll","msasn1.dll","sechost.dll","wow64win.dll","KernelBase.dll","wow64cpu.dll","rpcrt4.dll","winmm.dll","api-ms-win-crt-environment-l1-1-0.dll","api-ms-win-core-localization-l1-2-0.dll","WSHTCPIP.DLL","api-ms-win-crt-utility-l1-1-0.dll","wow64.dll","sspicli.dll","GdiPlus.dll","api-ms-win-crt-convert-l1-1-0.dll","msvcrt.dll","api-ms-win-core-synch-l1-2-0.dll","VxSSL32.dll","api-ms-win-crt-time-l1-1-0.dll","cryptbase.dll","ole32.dll","tzres.dll","api-ms-win-crt-string-l1-1-0.dll","api-ms-win-core-timezone-l1-1-0.dll","wship6.dll","uxtheme.dll","gdi32.dll","lpk.dll","IPHLPAPI.DLL","kernel32.dll","imm32.dll","msctf.dll","ws2_32.dll","api-ms-win-crt-locale-l1-1-0.dll","cryptsp.dll","rsaenh.dll","api-ms-win-core-file-l1-2-0.dll","ntdll.dll","user32.dll","api-ms-win-crt-heap-l1-1-0.dll","api-ms-win-crt-stdio-l1-1-0.dll","ucrtbase.dll","api-ms-win-core-file-l2-1-0.dll","crypt32.dll","shell32.dll","windows.storage.dll","bcryptprimitives.dll","cfgmgr32.dll","SHCore.dll","msvcp_win.dll","win32u.dll","profapi.dll","apphelp.dll","powrprof.dll","gdi32full.dll","combase.dll","winmmbase.dll","kernel.appcore.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{CF74EBC4-1D1F-421E-985E-416039F7DEB2}","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\My_mutex","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"},{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"name":"My_mutex","sources":[{"report_type":"sandbox","report_id":"6746fdffd474b4985d08522b"}]},{"name":"Local\\SM0:1252:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]},{"name":"SM0:1252:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6746fd9da9955a1ec7008b56"}]}]}},"report_ids":{"sandbox_job_ids":["6746fdffd474b4985d08522b","6746fd9da9955a1ec7008b56"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_90% Sample 2243a0c992a4… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 2243a0c992a4…. Malware family: Win/malicious_confidence_90%. Threat score 85/100. 6/25 AV engines flagged this file. 2 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/2243a0c992a4824b08a5bf4e2dc9b5f2cebd8855519c781279e9f8daf3653ae1"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_90% Sample 2243a0c992a4… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 2243a0c992a4…. Malware family: Win/malicious_confidence_90%. Threat score 85/100. 6/25 AV engines flagged this file. 2 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/2243a0c992a4824b08a5bf4e2dc9b5f2cebd8855519c781279e9f8daf3653ae1"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_90% Sample 2243a0c992a4… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 2243a0c992a4…. Malware family: Win/malicious_confidence_90%. Threat score 85/100. 6/25 AV engines flagged this file. 2 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L39","11",{}]]