26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 35:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T492,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Ransomware Sample 26b4699a7b9e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 26b4699a7b9e…. Malware family: Trojan.Ransomware. Threat score 100/100. 23/28 AV engines flagged this file. 12 malicious and 27 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739","keywords":["Malicious","Trojan.Ransomware","malware analysis","sandbox report","threat intelligence","26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739"],"about":{"@type":"SoftwareApplication","name":"Petya.bin","applicationCategory":["peexe","executable"],"identifier":"26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Ransomware","antivirusDetections":{"malicious":23,"total":28},"behavioralIndicators":{"malicious":12,"suspicious":27},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4d64,Found reference to API (Indicator: "GetPrivateProfileStringW"; Source: "sample.bin"), Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDesktopW"; Source: "sample.bin"), Found reference to API (Indicator: "DuplicateHandle"; Source: "sample.bin"), Found reference to API (Indicator: "TransactNamedPipe"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultLangID"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileIntW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "AddAce"; Source: "sample.bin"), Found reference to API (Indicator: "OpenThreadToken"; Source: "sample.bin"), Found reference to API (Indicator: "CopySid"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidCodePage"; Source: "sample.bin"), Found reference to API (Indicator: "EnumWindows"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpW"; Source: "sample.bin"), Found reference to API (Indicator: "SetProcessWindowStation"; Source: "sample.bin"), Found reference to API (Indicator: "CloseDesktop"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "sample.bin"), Found reference to API (Indicator: "RtlUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "CreateSemaphoreW"; Source: "sample.bin"), Found reference to API (Indicator: "SetSecurityDescriptorOwner"; Source: "sample.bin"), Found reference to API (Indicator: "HeapDestroy"; Source: "sample.bin"), Found reference to API (Indicator: "FlushFileBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "FreeSid"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesExW"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "PathAppendW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSecurityDescriptorOwner"; Source: "sample.bin"), Found reference to API (Indicator: "GetSecurityDescriptorSacl"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSize"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessorNumber"; Source: "sample.bin"), Found reference to API (Indicator: "ConnectNamedPipe"; Source: "sample.bin"), Found reference to API (Indicator: "CharUpperW"; Source: "sample.bin"), Found reference to API (Indicator: "UnregisterWaitEx"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadpoolWait"; Source: "sample.bin"), Found reference to API (Indicator: "ContinueDebugEvent"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeSid"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "UnregisterWait"; Source: "sample.bin"), Found reference to API (Indicator: "WaitNamedPipeW"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "DebugActiveProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxW"; Source: "sample.bin"), Found reference to API (Indicator: "VerSetConditionMask"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileType"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetCPInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "EqualSid"; Source: "sample.bin"), Found reference to API (Indicator: "IsDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "NetApiBufferFree"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadDesktop"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "sample.bin"), Found reference to API (Indicator: "MakeAbsoluteSD"; Source: "sample.bin"), Found reference to API (Indicator: "GetActiveWindow"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidSid"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetThreadDesktop"; Source: "sample.bin"), Found reference to API (Indicator: "GetSecurityDescriptorGroup"; Source: "sample.bin"), Found reference to API (Indicator: "GetSecurityDescriptorLength"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "SetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "PathRemoveFileSpecW"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "CloseWindowStation"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "DeviceIoControl"; Source: "sample.bin"), Found reference to API (Indicator: "GetOverlappedResult"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueW"; Source: "sample.bin"), Found reference to API (Indicator: "PathIsRelativeW"; Source: "sample.bin"), Found reference to API (Indicator: "SetProcessWorkingSetSize"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "CharLowerW"; Source: "sample.bin"), Found reference to API (Indicator: "GetTimeFormatEx"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcess"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetAclInformation"; Source: "sample.bin"), Found reference to API (Indicator: "ConvertStringSidToSidW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpiW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetFolderPathW"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleCP"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpynW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeAcl"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForDebugEvent"; Source: "sample.bin"), Found reference to API (Indicator: "SetClipboardData"; Source: "sample.bin"), Found reference to API (Indicator: "PathStripPathW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessWindowStation"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseSemaphore"; Source: "sample.bin"), Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API (Indicator: "StringFromGUID2"; Source: "sample.bin"), Found reference to API (Indicator: "TlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "GetSidSubAuthority"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceExW"; Source: "sample.bin"), Found reference to API (Indicator: "FlushProcessWriteBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "GetSecurityDescriptorControl"; Source: "sample.bin"), Found reference to API (Indicator: "CreateNamedPipeW"; Source: "sample.bin"), Found reference to API (Indicator: "VerQueryValueW"; Source: "sample.bin"), Found reference to API (Indicator: "SetSecurityDescriptorSacl"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateGuid"; Source: "sample.bin"), Found reference to API (Indicator: "EmptyClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "SetNamedPipeHandleState"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThread"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventW"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowVisible"; Source: "sample.bin"), Found reference to API (Indicator: "PathRemoveExtensionW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "UuidCreate"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualProtect"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "sample.bin"), Found reference to API (Indicator: "PathCanonicalizeW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWindowStationW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSidLengthRequired"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleMode"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineW"; Source: "sample.bin"), Found reference to API (Indicator: "OutputDebugStringW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessHeap"; Source: "sample.bin"), Found reference to API (Indicator: "OutputDebugStringA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateMutexW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "FlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "DecodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessW"; Source: "sample.bin"), Found reference to API (Indicator: "GetLogicalProcessorInformation"; Source: "sample.bin"), Found reference to API (Indicator: "FlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "NetWkstaGetInfo"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseMutex"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "DebugActiveProcessStop"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "sample.bin"), Found reference to API (Indicator: "RtlCaptureContext"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CheckTokenMembership"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "GetOEMCP"; Source: "sample.bin"), Found reference to API (Indicator: "SetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "wsprintfW"; Source: "sample.bin"), Found reference to API (Indicator: "EncodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathW"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount64"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetAce"; Source: "sample.bin"), Found reference to API (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualQueryEx"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastActivePopup"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "sample.bin"), Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "sample.bin"), Found reference to API (Indicator: "ResetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessTimes"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "GetThreadContext"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "RegisterWaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "sample.bin"), Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetComputerNameExW"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringW"; Source: "sample.bin"), Found reference to API (Indicator: "CloseClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidLocaleName"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointerEx"; Source: "sample.bin"), Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetSecurityDescriptorDacl"; Source: "sample.bin"), Found reference to API (Indicator: "SetSecurityDescriptorGroup"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringEx"; Source: "sample.bin"), Found reference to API (Indicator: "RtlCaptureStackBackTrace"; Source: "sample.bin"), Found reference to API (Indicator: "WriteConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; Source: "sample.bin"), Found reference to API (Indicator: "ReadProcessMemory"; Source: "sample.bin"), Found reference to API (Indicator: "wvsprintfW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "sample.bin"), Found reference to API (Indicator: "ConvertSidToStringSidW"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualQuery"; Source: "sample.bin"), Found reference to API (Indicator: "LockResource"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "sample.bin"), Found reference to API (Indicator: "GetLengthSid"; Source: "sample.bin"), Found reference to API (Indicator: "CreateMutexExW"; Source: "sample.bin"), Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadStackGuarantee"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "GetDateFormatEx"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "SetNamedSecurityInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "MakeSelfRelativeSD"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "DisconnectNamedPipe"; Source: "sample.bin"), Found reference to API (Indicator: "OpenClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceW"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "sample.bin")28:Ta5b,Found reference to API "AddAce" (Indicator: "AddAce"; Source: "sample.bin"), Found reference to API "CopySid" (Indicator: "CopySid"; Source: "sample.bin"), Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; Source: "sample.bin"), Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "sample.bin"), Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; Source: "sample.bin"), Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; Source: "sample.bin"), Found reference to API "InitializeSid" (Indicator: "InitializeSid"; Source: "sample.bin"), Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "sample.bin"), Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "sample.bin"), Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; Source: "sample.bin"), Found reference to API "IsValidSid" (Indicator: "IsValidSid"; Source: "sample.bin"), Found reference to API "GetSecurityDescriptorGroup" (Indicator: "GetSecurityDescriptorGroup"; Source: "sample.bin"), Found reference to API "GetSecurityDescriptorLength" (Indicator: "GetSecurityDescriptorLength"; Source: "sample.bin"), Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; Source: "sample.bin"), Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "sample.bin"), Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "sample.bin"), Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "sample.bin"), Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; Source: "sample.bin"), Found reference to API "SetSecurityDescriptorSacl" (Indicator: "SetSecurityDescriptorSacl"; Source: "sample.bin"), Found reference to API "GetSidLengthRequired" (Indicator: "GetSidLengthRequired"; Source: "sample.bin"), Found reference to API "SetTokenInformation" (Indicator: "SetTokenInformation"; Source: "sample.bin"), Found reference to API "GetAce" (Indicator: "GetAce"; Source: "sample.bin"), Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "sample.bin"), Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; Source: "sample.bin")29:T494,SetUnhandledExceptionFilter@KERNEL32.dll at 41437-1228-004197F1 SetUnhandledExceptionFilter@KERNEL32.dll at 41437-1173-00414BE4 SetUnhandledExceptionFilter@KERNEL32.dll at 41437-1172-00414C56 SetUnhandledExceptionFilter@KERNEL32.DLL at 00144203-00002196-53735-13-00419822 SetUnhandledExceptionFilter@KERNEL32.DLL at 00144203-00002196-53735-67-00414728 SetUnhandledExceptionFilter@KERNEL32.DLL at 00144203-00002196-53735-59-004149C2 SetUnhandledExceptionFilter@KERNEL32.DLL at 00144203-00002196-53735-723-004197F1 SetUnhandledExceptionFilter@KERNEL32.DLL at 00144203-00002196-53735-674-00414C56 SetUnhandledExceptionFilter@KERNEL32.DLL at 00144203-00002196-53735-675-00414BE4 SetUnhandledExceptionFilter@KERNEL32.DLL at 00144203-00002196-60652-107-00414728 SetUnhandledExceptionFilter@KERNEL32.DLL at 00144203-00002196-60652-89-004149C2 SetUnhandledExceptionFilter@KERNEL32.DLL at 00144203-00002196-60652-36-00419822 SetUnhandledExceptionFilter@KERNEL32.DLL at 00144203-00002196-60652-756-00414C56 SetUnhandledExceptionFilter@KERNEL32.DLL at 00144203-00002196-60652-757-00414BE4 SetUnhandledExceptionFilter@KERNEL32.DLL at 00144203-00002196-60652-812-004197F12a:T667,"" wrote 512 bytes to file "\Device\Harddisk0\DR0": 7777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777777 ... "" wrote 512 bytes to file "\Device\Harddisk0\DR0": fa6631c08ed08ec08ed8bc007cfb8816937c66b82000000066bb22000000b90080e8140066486683f80075f566a10080ea00800000f4ebfd66506631c05256576650665389e76650665306516a016a1089e68a16937cb442cd1389fc665b665873085030e4cd1358ebd66683c3016683d00081c1000273078cc280c6108ec25f ... "" wrote 8192 bytes to file "\Device\Harddisk0\DR0": e93d0600558bec8b46068b4e0a0bc88b4e0875098b4604f7e15dc2080053f7e18bd88b4604f7660a03d88b4604f7e103d35b5dc20800558bec53568b460a0bc075158b4e088b460633d2f7f18bd88b4604f7f18bd3eb388bc88b5e088b56068b4604d1e9d1dbd1ead1d80bc975f4f7f38bf0f7660a918b4608f7e603d1720c3b ... "" wrote 512 bytes to file "\Device\Harddisk0\DR0": 00c290efeab372f2f0c79ae5d6f1eedbc2cda6bd86dec8d2b0cda6dcc4eae0f2f0116225bf2a11454a687474703a2f2f70657479613337683574626879766b692e6f6e696f6e2f4c77336931360d0a20202020687474703a2f2f7065747961356b6f61687473663773762e6f6e696f6e2f4c7733693136000000000000000000 ... "" wrote 512 bytes to file "\Device\Harddisk0\DR0": 04f7b9e78b374bb9f7b9ef89374b8837318e3735cbc493675f2b31fccc8e33378a8930b74937374b3c38b23936b4f227d5c6fa2fbf613762f1712632f171273783768c9d62fa246a4538b6cc629d423ec0f636374334c971275157b74927374311515f3737373751c8413f5f37375f374b5f36375f27378375bd6137bcc3fa24 ...2b:Tc34,Found string "FlsGetValue" (Source: 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.bin.bin, API is part of module: KERNELBASE.DLL) Found string "FlsSetValue" (Source: 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.bin.bin, API is part of module: KERNELBASE.DLL) Found string "InitializeCriticalSectionEx" (Source: 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.bin.bin, API is part of module: KERNELBASE.DLL) Found string "CreateSemaphoreExW" (Source: 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.bin.bin, API is part of module: KERNELBASE.DLL) Found string "SetThreadStackGuarantee" (Source: 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.bin.bin, API is part of module: KERNELBASE.DLL) Found string "CreateThreadpoolTimer" (Source: 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.bin.bin, API is part of module: KERNELBASE.DLL) Found string "CreateThreadpoolWait" (Source: 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.bin.bin, API is part of module: KERNELBASE.DLL) Found string "GetLogicalProcessorInformation" (Source: 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.bin.bin, API is part of module: KERNELBASE.DLL) Found string "CreateSymbolicLinkW" (Source: 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.bin.bin, API is part of module: KERNEL32.DLL) Found string "EnumSystemLocalesEx" (Source: 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.bin.bin, API is part of module: KERNELBASE.DLL) Found string "CompareStringEx" (Source: 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.bin.bin, API is part of module: KERNELBASE.DLL) Found string "GetDateFormatEx" (Source: 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.bin.bin, API is part of module: KERNEL32.DLL) Found string "GetLocaleInfoEx" (Source: 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.bin.bin, API is part of module: KERNELBASE.DLL) Found string "GetTimeFormatEx" (Source: 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.bin.bin, API is part of module: KERNEL32.DLL) Found string "GetUserDefaultLocaleName" (Source: 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.bin.bin, API is part of module: KERNELBASE.DLL) Found string "IsValidLocaleName" (Source: 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.bin.bin, API is part of module: KERNELBASE.DLL) Found string "LCMapStringEx" (Source: 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.bin.bin, API is part of module: KERNELBASE.DLL) Found string "GetTickCount64" (Source: 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.bin.bin, API is part of module: KERNELBASE.DLL) Found string "GetActiveWindow" (Source: 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.bin.bin, API is part of module: USER32.DLL) Found string "GetLastActivePopup" (Source: 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.bin.bin, API is part of module: USER32.DLL)2c:Tc18,Assembly shows XOR instruction xor al byte ptr [eax] in Stream UID: 16274-1285-004059AB Assembly shows XOR instruction xor eax ebp in Stream UID: 16274-997-00407F87 Assembly shows XOR instruction xor ecx ebp in Stream UID: 16274-997-00407F87 Assembly shows XOR instruction xor eax ebp in Stream UID: 16274-1144-00410B0D Assembly shows XOR instruction xor ecx ebp in Stream UID: 16274-1144-00410B0D Assembly shows XOR instruction xor eax ebp in Stream UID: 16274-1021-00408C0F Assembly shows XOR instruction xor ecx ebp in Stream UID: 16274-1021-00408C0F Assembly shows XOR instruction xor eax ebp in Stream UID: 16274-992-0040635A Assembly shows XOR instruction xor ecx ebp in Stream UID: 16274-992-0040635A Assembly shows XOR instruction xor eax esp in Stream UID: 16274-1142-004100F4 Assembly shows XOR instruction xor ecx esp in Stream UID: 16274-1142-004100F4 Assembly shows XOR instruction xor eax esp in Stream UID: 16274-1174-00414D27 Assembly shows XOR instruction xor eax ebp in Stream UID: 16274-1080-0040A884 Assembly shows XOR instruction xor ecx ebp in Stream UID: 16274-1080-0040A884 Assembly shows XOR instruction xor eax ebp in Stream UID: 16274-1145-00410C19 Assembly shows XOR instruction xor ecx ebp in Stream UID: 16274-1145-00410C19 Assembly shows XOR instruction xor eax ebp in Stream UID: 16274-996-00406549 Assembly shows XOR instruction xor ecx ebp in Stream UID: 16274-996-00406549 Assembly shows XOR instruction xor eax esp in Stream UID: 16274-1175-00414EA3 Assembly shows XOR instruction xor ecx esp in Stream UID: 16274-1175-00414EA3 Assembly shows XOR instruction xor eax ebp in Stream UID: 16274-1167-00415102 Assembly shows XOR instruction xor ecx ebp in Stream UID: 16274-1167-00415102 Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 16274-1202-00417EDA Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 16274-1202-00417EDA Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 16274-1202-00417EDA Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 16274-1202-00417EDA Assembly shows XOR instruction xor eax ebp in Stream UID: 16274-1143-00410191 Assembly shows XOR instruction xor ecx ebp in Stream UID: 16274-1143-00410191 Assembly shows XOR instruction xor eax esp in Stream UID: 16274-1026-00408DF5 Assembly shows XOR instruction xor ecx esp in Stream UID: 16274-1026-00408DF5 Assembly shows XOR instruction xor eax esp in Stream UID: 16274-1159-00413391 Assembly shows XOR instruction xor ecx esp in Stream UID: 16274-1159-00413391 Assembly shows XOR instruction xor eax ebp in Stream UID: 16274-995-00407E93 Assembly shows XOR instruction xor ecx ebp in Stream UID: 16274-995-00407E93 Assembly shows XOR instruction xor eax ebp in Stream UID: 16274-1236-0041A238 Assembly shows XOR instruction xor ecx ebp in Stream UID: 16274-1236-0041A238 Assembly shows XOR instruction xor eax ebp in Stream UID: 16274-1239-0041A618 Assembly shows XOR instruction xor ecx ebp in Stream UID: 16274-1239-0041A6182d:T206b,"Call->Pop sequence commonly used by shellcode to find the address of the instruction pointer.\nCrashing address: %x\nCrashing segment base: %x\nOffset of JMP->CALL->POP: %x\n\" (Indicator: \"shellcode\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-468","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66962cdb05cd44da4c0f892f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"sample.bin\"), Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"sample.bin\"), Found reference to API \"CreateMutexExW\" (Indicator: \"CreateMutex\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-354","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"66962cdb05cd44da4c0f892f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API RtlCaptureStackBackTrace@NTDLL.DLL at 00144203-00002196-53735-169-00408CD4\n Found reference to API RtlCaptureStackBackTrace@NTDLL.DLL at 00144203-00002196-60652-219-00408CD4","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"5af3225c7ca3e17a160d8a57"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00144203-00002196-53735-171-00407C01\n GetLocalTime@KERNEL32.DLL at 00144203-00002196-53735-130-00405150\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00144203-00002196-53735-355-0040F4F0\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00144203-00002196-53735-387-0040F361\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00144203-00002196-53735-431-00419303\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00144203-00002196-60652-222-00407C01\n GetLocalTime@KERNEL32.DLL at 00144203-00002196-60652-177-00405150\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00144203-00002196-60652-450-0040F361\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00144203-00002196-60652-496-00419303\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00144203-00002196-60652-417-0040F4F0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5a79e52c7ca3e15a8e1a31a3"},{"report_type":"sandbox","report_id":"5af3225c7ca3e17a160d8a57"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"$29","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5a79e52c7ca3e15a8e1a31a3"},{"report_type":"sandbox","report_id":"5af3225c7ca3e17a160d8a57"},{"report_type":"sandbox","report_id":"66962cdb05cd44da4c0f892f"},{"report_type":"sandbox","report_id":"638cfaa2c6045d23b33f2cbd"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text with unusual entropies 7.19364119948","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5a35218e7ca3e16dbf32ec2d"},{"report_type":"sandbox","report_id":"5a79e52c7ca3e15a8e1a31a3"},{"report_type":"sandbox","report_id":"5af3225c7ca3e17a160d8a57"},{"report_type":"sandbox","report_id":"638cfaa2c6045d23b33f2cbd"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00144203-00002196-53735-114-0040139E\n GetProcessHeap@KERNEL32.DLL at 00144203-00002196-53735-429-004173C6\n GetProcessHeap@KERNEL32.DLL at 00144203-00002196-60652-161-0040139E\n GetProcessHeap@KERNEL32.DLL at 00144203-00002196-60652-494-004173C6","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5a79e52c7ca3e15a8e1a31a3"},{"report_type":"sandbox","report_id":"5af3225c7ca3e17a160d8a57"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a35218e7ca3e16dbf32ec2d"},{"report_type":"sandbox","report_id":"5a79e52c7ca3e15a8e1a31a3"},{"report_type":"sandbox","report_id":"5af3225c7ca3e17a160d8a57"},{"report_type":"sandbox","report_id":"66962cdb05cd44da4c0f892f"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.DLL at 00144203-00002196-53735-153-00404BDF\n LockResource@KERNEL32.DLL at 00144203-00002196-53735-154-00404B83\n FindResourceExW@KERNEL32.DLL at 00144203-00002196-53735-155-00404B19\n LockResource@KERNEL32.DLL at 00144203-00002196-60652-204-00404B83\n FindResourceExW@KERNEL32.DLL at 00144203-00002196-60652-205-00404B19\n FindResourceW@KERNEL32.DLL at 00144203-00002196-60652-203-00404BDF","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"5a79e52c7ca3e15a8e1a31a3"},{"report_type":"sandbox","report_id":"5af3225c7ca3e17a160d8a57"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.DLL at 00144203-00002196-53735-342-0040929A\n OpenClipboard@USER32.DLL at 00144203-00002196-60652-404-0040929A","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"5a79e52c7ca3e15a8e1a31a3"},{"report_type":"sandbox","report_id":"5af3225c7ca3e17a160d8a57"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to elevate privileges","description":"SetSecurityDescriptorDacl@ADVAPI32.DLL at 00144203-00002196-53735-215-00403DA1\n SetSecurityDescriptorDacl@ADVAPI32.DLL at 00144203-00002196-60652-269-00403DA1","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-44","sources":[{"report_type":"sandbox","report_id":"5a79e52c7ca3e15a8e1a31a3"},{"report_type":"sandbox","report_id":"5af3225c7ca3e17a160d8a57"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to lookup privileges","description":"GetSecurityDescriptorDacl@ADVAPI32.DLL at 00144203-00002196-53735-215-00403DA1\n GetSecurityDescriptorDacl@ADVAPI32.DLL at 00144203-00002196-53735-205-00404A5C\n GetSecurityDescriptorDacl@ADVAPI32.DLL at 00144203-00002196-60652-259-00404A5C\n GetSecurityDescriptorDacl@ADVAPI32.DLL at 00144203-00002196-60652-269-00403DA1","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-43","sources":[{"report_type":"sandbox","report_id":"5a79e52c7ca3e15a8e1a31a3"},{"report_type":"sandbox","report_id":"5af3225c7ca3e17a160d8a57"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetStartupInfoW\n GetModuleFileNameW\n WriteFile\n UnhandledExceptionFilter\n Sleep\n TerminateProcess\n GetTickCount\n LoadLibraryExW\n CreateFileW\n LockResource\n FindResourceW\n FindResourceExW\n CreateDirectoryW\n DeleteFileW\n LoadLibraryW\n GetTempPathW\n OutputDebugStringA\n GetFileAttributesExW\n DeviceIoControl\n OpenProcess\n CreateProcessW\n ReadProcessMemory\n CreateThread\n GetThreadContext\n GetModuleHandleExW\n GetCommandLineW\n OutputDebugStringW\n GetProcAddress\n GetModuleHandleW\n IsDebuggerPresent\n GetComputerNameExW\n ConnectNamedPipe\n DisconnectNamedPipe\n VirtualProtect\n VirtualAlloc\n GetWindowThreadProcessId\n SetSecurityDescriptorDacl\n OpenProcessToken\n RegOpenKeyExW\n RegDeleteKeyW\n RegDeleteValueW\n RegCloseKey\n RegCreateKeyExW\n RegEnumKeyExW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a35218e7ca3e16dbf32ec2d"},{"report_type":"sandbox","report_id":"5a79e52c7ca3e15a8e1a31a3"},{"report_type":"sandbox","report_id":"5af3225c7ca3e17a160d8a57"},{"report_type":"sandbox","report_id":"66962cdb05cd44da4c0f892f"},{"report_type":"sandbox","report_id":"638cfaa2c6045d23b33f2cbd"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"45/56 Antivirus vendors marked sample as malicious (80% detection rate)\n 29/43 Antivirus vendors marked sample as malicious (67% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a35218e7ca3e16dbf32ec2d"},{"report_type":"sandbox","report_id":"5a79e52c7ca3e15a8e1a31a3"},{"report_type":"sandbox","report_id":"5af3225c7ca3e17a160d8a57"},{"report_type":"sandbox","report_id":"638cfaa2c6045d23b33f2cbd"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"45/56 Antivirus vendors marked sample as malicious (80% detection rate)\n 29/43 Antivirus vendors marked sample as malicious (67% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a35218e7ca3e16dbf32ec2d"},{"report_type":"sandbox","report_id":"5a79e52c7ca3e15a8e1a31a3"},{"report_type":"sandbox","report_id":"5af3225c7ca3e17a160d8a57"},{"report_type":"sandbox","report_id":"638cfaa2c6045d23b33f2cbd"}]},{"level":"malicious","category":"General","name":"Contains ability to start/interact with device drivers","description":"DeviceIoControl@KERNEL32.DLL at 00144203-00002196-53735-316-004126FB\n DeviceIoControl@KERNEL32.DLL at 00144203-00002196-60652-371-004126FB","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-21","sources":[{"report_type":"sandbox","report_id":"5a79e52c7ca3e15a8e1a31a3"},{"report_type":"sandbox","report_id":"5af3225c7ca3e17a160d8a57"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes to the primary disk partition (DR0)","description":"$2a","origin":"API Call","relevance":10,"id":"api-60","sources":[{"report_type":"sandbox","report_id":"5a79e52c7ca3e15a8e1a31a3"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop","description":"CreateDesktopW@USER32.dll at 41437-1086-0040BCD5\n CreateDesktopW@USER32.DLL at 00144203-00002196-53735-591-0040BCD5\n CreateDesktopW@USER32.DLL at 00144203-00002196-60652-670-0040BCD5","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-8","sources":[{"report_type":"sandbox","report_id":"5a79e52c7ca3e15a8e1a31a3"},{"report_type":"sandbox","report_id":"5af3225c7ca3e17a160d8a57"},{"report_type":"sandbox","report_id":"66962cdb05cd44da4c0f892f"},{"report_type":"sandbox","report_id":"638cfaa2c6045d23b33f2cbd"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00010349-00002988-00000105-38899417","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5a79e52c7ca3e15a8e1a31a3"},{"report_type":"sandbox","report_id":"5af3225c7ca3e17a160d8a57"}]},{"level":"suspicious","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a35218e7ca3e16dbf32ec2d"},{"report_type":"sandbox","report_id":"5a79e52c7ca3e15a8e1a31a3"},{"report_type":"sandbox","report_id":"5af3225c7ca3e17a160d8a57"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"Petya_Ransomware\" matched file \"26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.exe.bin\" as \"Detects Petya Ransomware\" based on indicators: \"WinRAR SFX module,420058002d00500072006f00780079002d004d0061006e00750061006c002d004100750074006800,...The ID below indicates application support for Windows 10 -->,58002d0048005400540050002d0041007400740065006d00700074007300,400043006f006d006d0061006e0064004c0069006e0065004d006f0064006500,58002d00520065007400720079002d0041006600740065007200\" (Reference: http://www.heise.de/newsticker/meldung/Erpressungs-Trojaner-Petya-riegelt-den-gesamten-Rechner-ab-3150917.html, Author: Florian Roth)","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"5a35218e7ca3e16dbf32ec2d"},{"report_type":"sandbox","report_id":"5a79e52c7ca3e15a8e1a31a3"},{"report_type":"sandbox","report_id":"5af3225c7ca3e17a160d8a57"},{"report_type":"sandbox","report_id":"66962cdb05cd44da4c0f892f"},{"report_type":"sandbox","report_id":"638cfaa2c6045d23b33f2cbd"}]},{"level":"malicious","category":"System Destruction","name":"Interacts with the primary disk partition (DR0)","description":"\"\" interacting with \"\\Device\\Harddisk0\\DR0\" using IoControlCode \"IOCTL_DISK_GET_PARTITION_INFO_EX\" (0x70048)","origin":"API Call","relevance":5,"id":"api-59","sources":[{"report_type":"sandbox","report_id":"5a79e52c7ca3e15a8e1a31a3"},{"report_type":"sandbox","report_id":"5af3225c7ca3e17a160d8a57"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Tries to forcefully shutdown system","description":"\"\" called \"NtRaiseHardError\" with the \"OptionShutdownSystem\" response","origin":"API Call","relevance":10,"id":"api-61","sources":[{"report_type":"sandbox","report_id":"5af3225c7ca3e17a160d8a57"},{"report_type":"sandbox","report_id":"66962cdb05cd44da4c0f892f"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%WINDIR%\\System32\\rsaenh.dll\"\n \".exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a35218e7ca3e16dbf32ec2d"},{"report_type":"sandbox","report_id":"5a79e52c7ca3e15a8e1a31a3"},{"report_type":"sandbox","report_id":"5af3225c7ca3e17a160d8a57"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.bin.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1045","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a35218e7ca3e16dbf32ec2d"},{"report_type":"sandbox","report_id":"5a79e52c7ca3e15a8e1a31a3"},{"report_type":"sandbox","report_id":"5af3225c7ca3e17a160d8a57"},{"report_type":"sandbox","report_id":"66962cdb05cd44da4c0f892f"},{"report_type":"sandbox","report_id":"638cfaa2c6045d23b33f2cbd"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5a35218e7ca3e16dbf32ec2d"},{"report_type":"sandbox","report_id":"5a79e52c7ca3e15a8e1a31a3"},{"report_type":"sandbox","report_id":"5af3225c7ca3e17a160d8a57"},{"report_type":"sandbox","report_id":"66962cdb05cd44da4c0f892f"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"2/66 reputation engines marked \"http://logging.cc\" as malicious (3% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5a35218e7ca3e16dbf32ec2d"},{"report_type":"sandbox","report_id":"5a79e52c7ca3e15a8e1a31a3"},{"report_type":"sandbox","report_id":"5af3225c7ca3e17a160d8a57"}]},{"level":"suspicious","category":"Network Related","name":"Detected increased number of ARP broadcast requests (network device lookup)","description":"Attempt to find devices in networks: \"192.168.240.172/32, ...\"","origin":"Network Traffic","mitre_attack_id":"T1046","relevance":10,"id":"network-32","sources":[{"report_type":"sandbox","report_id":"5a35218e7ca3e16dbf32ec2d"},{"report_type":"sandbox","report_id":"5a79e52c7ca3e15a8e1a31a3"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","mitre_attack_id":"T1076","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5a35218e7ca3e16dbf32ec2d"},{"report_type":"sandbox","report_id":"5a79e52c7ca3e15a8e1a31a3"},{"report_type":"sandbox","report_id":"5af3225c7ca3e17a160d8a57"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$2b","origin":"File/Memory","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"5a35218e7ca3e16dbf32ec2d"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"5a79e52c7ca3e15a8e1a31a3"}]},{"level":"informative","category":"General","name":"Contains ability to create named pipes for inter-process communication (IPC)","description":"CreateNamedPipeW@KERNEL32.DLL at 00008628-00000808-11537-233-0040F85B","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-45","sources":[{"report_type":"sandbox","report_id":"5a79e52c7ca3e15a8e1a31a3"},{"report_type":"sandbox","report_id":"5af3225c7ca3e17a160d8a57"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"71117e007a3b7d00ab8b02007f950200fc8c0200729602006cc805001ecd7a007d267a00\" to virtual address \"0x768007E4\" (part of module \"USER32.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5af3225c7ca3e17a160d8a57"},{"report_type":"sandbox","report_id":"638cfaa2c6045d23b33f2cbd"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.bin\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.bin\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; File: \"26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.bin\")\n Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; File: \"26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.bin\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"66962cdb05cd44da4c0f892f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\pipe\\GoogleCrashServices; Source: \"26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.bin\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"66962cdb05cd44da4c0f892f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2c","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"66962cdb05cd44da4c0f892f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"66962cdb05cd44da4c0f892f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"66962cdb05cd44da4c0f892f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found potential URL in binary/memory","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"66962cdb05cd44da4c0f892f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"