26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 5c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4d5,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Adware.Tedy.Generic Sample 2c9659346444… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2c9659346444…. Malware family: Adware.Tedy.Generic. Threat score 100/100. 19/27 AV engines flagged this file. 10 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e","keywords":["Malicious","Adware.Tedy.Generic","malware analysis","sandbox report","threat intelligence","2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e"],"about":{"@type":"SoftwareApplication","name":"2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin","applicationCategory":["peexe","executable"],"identifier":"2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Adware.Tedy.Generic","antivirusDetections":{"malicious":19,"total":27},"behavioralIndicators":{"malicious":10,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tca2,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "ZwMapViewOfSection" (Indicator: "ZwMapViewOfSection"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "ZwMapViewOfSection" (Indicator: "ZwMapViewOfSection"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp")28:T89a,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp")29:T592,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp")2a:T565,"" (Indicator: "GetDC"; Source: "00000000-00005596.00000000.177075.02940000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005596.00000000.177075.02940000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005596.00000000.177075.02940000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005596.00000000.177075.02940000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005596.00000000.177075.02940000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005596.00000000.177075.02940000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00005596.00000000.177075.02940000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005596.00000000.177075.02940000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006200.00000000.177202.02BC0000.00000004.mdmp, 00000000-00006200.00000001.179122.02BC0000.00000004.mdmp, 00000000-00006200.00000002.181042.02BC0000.00000004.mdmp, 00000000-00006200.00000003.186417.02BC0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00006200.00000000.177202.02BC0000.00000004.mdmp, 00000000-00006200.00000001.179122.02BC0000.00000004.mdmp, 00000000-00006200.00000002.181042.02BC0000.00000004.mdmp, 00000000-00006200.00000003.186417.02BC0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00006200.00000000.177202.02BC0000.00000004.mdmp, 00000000-00006200.00000001.179122.02BC0000.00000004.mdmp, 00000000-00006200.00000002.181042.02BC0000.00000004.mdmp, 00000000-00006200.00000003.186417.02BC0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006200.00000000.177202.02BC0000.00000004.mdmp, 00000000-00006200.00000001.179122.02BC0000.00000004.mdmp, 00000000-00006200.00000002.181042.02BC0000.00000004.mdmp, 00000000-00006200.00000003.186417.02BC0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00006200.00000000.177202.02BC0000.00000004.mdmp, 00000000-00006200.00000001.179122.02BC0000.00000004.mdmp, 00000000-00006200.00000002.181042.02BC0000.00000004.mdmp, 00000000-00006200.00000003.186417.02BC0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006200.00000000.177202.02BC0000.00000004.mdmp, 00000000-00006200.00000001.179122.02BC0000.00000004.mdmp, 00000000-00006200.00000002.181042.02BC0000.00000004.mdmp, 00000000-00006200.00000003.186417.02BC0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00006200.00000000.177202.02BC0000.00000004.mdmp, 00000000-00006200.00000001.179122.02BC0000.00000004.mdmp, 00000000-00006200.00000002.181042.02BC0000.00000004.mdmp, 00000000-00006200.00000003.186417.02BC0000.00000004.mdmp")4d:T728,Found registry query API: "RegEnumKeyExW" in file "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin" Found registry query API: "RegQueryValueExW" in file "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin" Found registry query API: "RegEnumKeyExA" in file "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin" Found registry query API: "RegOpenKeyExW" in file "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin" Found registry query API: "RegQueryValueExA" in file "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin" Found registry query API: "RegOpenKeyExA" in file "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin" Found registry query API: "RegEnumValueW" in file "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin" Found registry query API: "RegQueryInfoKeyW" in file "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin" Found registry query API: "RegQueryValueExW" in "00000000-00005596.00000000.177075.0045F000.00000002.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00005596.00000000.177075.0045F000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00005596.00000000.177075.0045F000.00000002.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00005596.00000000.177075.0045F000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00005596.00000000.177075.0045F000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00005596.00000000.177075.0045F000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00005596.00000000.177075.0045F000.00000002.mdmp" Found registry query API: "RegEnumKeyExA" in "00000000-00005596.00000000.177075.0045F000.00000002.mdmp"4e:T952,Found string "ZipFiles" (Indicator: "zipfile"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found string "UnzipFiles" (Indicator: "zipfile"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found string "SHA256wECDSA" (Indicator: "ecdsa"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found string "TLS13-AES128-GCM-SHA256" (Indicator: "aes"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found string "TLS13-AES128-GCM-SHA256" (Indicator: "aes128"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found string "ZipFiles" (Indicator: "zipfile"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found string "UnzipFiles" (Indicator: "zipfile"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found string "SHA256wECDSA" (Indicator: "ecdsa"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found string "TLS13-AES128-GCM-SHA256" (Indicator: "aes"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found string "TLS13-AES128-GCM-SHA256" (Indicator: "aes128"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found string "ystem.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00005596.00000000.177075.04540000.00000002.mdmp") Found string "ystem.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00005596.00000000.177075.04540000.00000002.mdmp") Found string "ystem.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00005596.00000000.177075.04540000.00000002.mdmp") Found string "ystem.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00005596.00000000.177075.04540000.00000002.mdmp") Found string "System.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00005596.00000000.177075.046B0000.00000002.mdmp") Found string "System.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00005596.00000000.177075.046B0000.00000002.mdmp") Found string "System.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00005596.00000000.177075.046B0000.00000002.mdmp") Found string "System.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00005596.00000000.177075.046B0000.00000002.mdmp")4f:T590,Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp")50:Tbd2,Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp")51:T81a,Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp")52:T4c2,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "WTSQuerySessionInformationW" (Indicator: "WTSQuerySessionInformation"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "WTSQuerySessionInformationW" (Indicator: "WTSQuerySessionInformation"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp")53:Tc37,Found string "[Tab]" (Indicator: "[tab]"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found string "[Alt]" (Indicator: "[alt]"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found string "[Alt]" (Indicator: "[Alt]"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found string "[Pause]" (Indicator: "[pause]"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found string "[Esc]" (Indicator: "[esc]"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found string "[End]" (Indicator: "[end]"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found string "[Left]" (Indicator: "[left]"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found string "[Right]" (Indicator: "[right]"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found string "[Down]" (Indicator: "[down]"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found string "[F10]" (Indicator: "[F10]"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found string "[F11]" (Indicator: "[F11]"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found string "[F12]" (Indicator: "[F12]"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found string "[Tab]" (Indicator: "[tab]"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found string "[Alt]" (Indicator: "[alt]"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found string "[Alt]" (Indicator: "[Alt]"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found string "[Pause]" (Indicator: "[pause]"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found string "[Esc]" (Indicator: "[esc]"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found string "[End]" (Indicator: "[end]"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found string "[Left]" (Indicator: "[left]"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found string "[Right]" (Indicator: "[right]"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found string "[Down]" (Indicator: "[down]"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found string "[F1]" (Indicator: "[F1]"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found string "[F2]" (Indicator: "[F2]"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found string "[F3]" (Indicator: "[F3]"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found string "[F4]" (Indicator: "[F4]"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found string "[F5]" (Indicator: "[F5]"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp") Found string "[F6]" (Indicator: "[F6]"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp")54:T7ea,Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "fso.DeleteFile "" (Indicator: "DeleteFile"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin"), Found reference to API "fso.DeleteFile(Wscript.ScriptFullName)" (Indicator: "DeleteFile"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin"), Found reference to API "CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)" (Indicator: "DeleteFile"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin"), Found reference to API "").DeleteFile(Wscript.ScriptFullName)" (Indicator: "DeleteFile"; File: "2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin") Found reference to API "fso.DeleteFile "" (Indicator: "DeleteFile"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp"), Found reference to API "fso.DeleteFile(Wscript.ScriptFullName)" (Indicator: "DeleteFile"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp"), Found reference to API "CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)" (Indicator: "DeleteFile"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp"), Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp"), Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp"), Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00005596.00000000.177075.0045F000.00000002.mdmp")55:Ta9b,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005596.00000000.177075.02940000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00006200.00000000.177202.02BC0000.00000004.mdmp, 00000000-00006200.00000001.179122.02BC0000.00000004.mdmp, 00000000-00006200.00000002.181042.02BC0000.00000004.mdmp, 00000000-00006200.00000003.186417.02BC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69af33d4a0a8c15bfe09d730"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; File: \"2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin\")\n Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; File: \"2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin\")\n Found reference to API \"ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00005596.00000000.177075.0045F000.00000002.mdmp\")\n Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00005596.00000000.177075.0045F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"69af33d4a0a8c15bfe09d730"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69af33d4a0a8c15bfe09d730"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2b","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69af33d4a0a8c15bfe09d730"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69af33d4a0a8c15bfe09d730"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"69af33d4a0a8c15bfe09d730"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 40781-4003-0043B65F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"69af33d4a0a8c15bfe09d730"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69af33d4a0a8c15bfe09d730"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2d","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"69af33d4a0a8c15bfe09d730"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptAcquireContextA\" (Indicator: \"CryptAcquireContext\"; File: \"2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin\")\n Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"69af33d4a0a8c15bfe09d730"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptAcquireContextA\" (Indicator: \"CryptAcquireContextA\"; File: \"2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin\")\n Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin\")\n Found reference to API \"CryptGenRandom\" (Indicator: \"CryptGenRandom\"; File: \"2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"69af33d4a0a8c15bfe09d730"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"69af33d4a0a8c15bfe09d730"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69af33d4a0a8c15bfe09d730"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains key cryptographic functions (API string)\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Uses Windows cryptography API for obfuscation\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Possibly contains Public/Private key (encryption)\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Able to use RSA keys for encryption and decryption\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69af33d4a0a8c15bfe09d730"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use asymmetric encryption algorithm","description":"The analysis found public/private key which shows ability to use asymmetric encryption algorithm. Matched sigs: Possibly contains Public/Private key (encryption)","origin":"Indicator Combinations","mitre_attack_id":"T1573.002","relevance":1,"id":"summary-33","sources":[{"report_type":"sandbox","report_id":"69af33d4a0a8c15bfe09d730"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"69af33d4a0a8c15bfe09d730"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2f","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69af33d4a0a8c15bfe09d730"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"GetUserNameW\" (Source: \"00000000-00005596.00000000.177075.0045F000.00000002.mdmp\")\n Found string \"ystem.Identity.QualifiedUserName\" (Source: \"00000000-00005596.00000000.177075.04540000.00000002.mdmp\")\n Found string \"ystem.Identity.UserName\" (Source: \"00000000-00005596.00000000.177075.04540000.00000002.mdmp\")\n Found string \"ystem.UserName\" (Source: \"00000000-00005596.00000000.177075.04540000.00000002.mdmp\")\n Found string \"System.Identity.UserName\" (Source: \"00000000-00005596.00000000.177075.046B0000.00000002.mdmp\")\n Found string \"System.Identity.QualifiedUserName\" (Source: \"00000000-00005596.00000000.177075.046B0000.00000002.mdmp\")\n Found string \"System.UserName\" (Source: \"00000000-00005596.00000000.177075.046B0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"69af33d4a0a8c15bfe09d730"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69af33d4a0a8c15bfe09d730"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin\")\n Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00005596.00000000.177075.0045F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"69af33d4a0a8c15bfe09d730"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00005596.00000000.177075.0045F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"69af33d4a0a8c15bfe09d730"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"EnumServicesStatusW\" (File: \"2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin\")\n Found string \"QueryServiceStatus\" (File: \"2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin\")\n Found string \"QueryServiceConfigW\" (File: \"2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin\")\n Found string \"EnumServicesStatusW\" (Source: \"00000000-00005596.00000000.177075.0045F000.00000002.mdmp\")\n Found string \"QueryServiceConfigW\" (Source: \"00000000-00005596.00000000.177075.0045F000.00000002.mdmp\")\n Found string \"QueryServiceStatus\" (Source: \"00000000-00005596.00000000.177075.0045F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"69af33d4a0a8c15bfe09d730"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69af33d4a0a8c15bfe09d730"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; File: \"2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; File: \"2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00005596.00000000.177075.0045F000.00000002.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; Source: \"00000000-00005596.00000000.177075.0045F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"69af33d4a0a8c15bfe09d730"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"Found string \"\\cookies.sqlite\" (Indicator: \"cookies.sqlite\"; File: \"2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin\")\n Found string \"\\cookies.sqlite\" (Indicator: \"cookies.sqlite\"; Source: \"00000000-00005596.00000000.177075.0045F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-5058","sources":[{"report_type":"sandbox","report_id":"69af33d4a0a8c15bfe09d730"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"69af33d4a0a8c15bfe09d730"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00005596.00000000.177075.0045F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69af33d4a0a8c15bfe09d730"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69af33d4a0a8c15bfe09d730"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin\")\n Found reference to API \"GetKeyboardLayoutNameA\" (Indicator: \"GetKeyboardLayout\"; File: \"2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00005596.00000000.177075.0045F000.00000002.mdmp\")\n Found reference to API \"GetKeyboardLayoutNameA\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00005596.00000000.177075.0045F000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"69af33d4a0a8c15bfe09d730"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; File: \"2c96593464444832a36744802f9a0104bb702f08dbe5049d069935a803809c8e.bin\")\n Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00005596.00000000.177075.0045F000.00000002.mdmp\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00005596.00000000.177075.02940000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00006200.00000000.177202.02BC0000.00000004.mdmp, 00000000-00006200.00000001.179122.02BC0000.00000004.mdmp, 00000000-00006200.00000002.181042.02BC0000.00000004.mdmp, 00000000-00006200.00000003.186417.02BC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69af33d4a0a8c15bfe09d730"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"sysconfig.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00006200)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"69af33d4a0a8c15bfe09d730"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"sysconfig.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00006200)\n \"sysconfig.exe\" called \"GetComputerNameExW\" with parameters (UID: 00000000-00006200)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"69af33d4a0a8c15bfe09d730"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\" Microsoft Corporation\"\n \"sysconfig.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69af33d4a0a8c15bfe09d730"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"